Privacy & Data Protection Notice

This is an English translation provided for convenience. The Turkish version of this notice is the legally binding text; in the event of any discrepancy, the Turkish version prevails.

Effective date: the date this text is published. This notice is issued to fulfil the disclosure obligation under Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and explains how information collected through arcnar.com and the customer panel is processed, together with cookie use and data security principles. Operations requiring explicit consent are separately submitted for approval via an "Explicit Consent Text".

1. Data Controller

Berat Tayşı — Address: Devlet Mah. İzzettin Çağpar Cad. No:13 D:11 Kırklareli / Vize — Tax Office / No: Vize V.D. / 8330937199 — BTK Hosting Provider Authorisation: yakında eklenecek — Email: [email protected] — Phone: +90 850 840 20 73.

2. Categories of Personal Data Processed

• Identity: full name/title, Turkish ID number (only in cases of domain registration, billing and legal obligation).

• Contact: email, phone, notification address.

• Account and Billing Information: tax office/number, billing profile (individual/corporate), preferred currency.

• Customer Transactions: orders, invoices, payment references, balance movements, support requests and history.

• Domain (WHOIS) Information: contact and registration information that must be transferred to the relevant registrar and under ICANN/registry rules. When WHOIS privacy (ID Protection) is enabled, this information is masked from third parties.

• Transaction Security and Traffic: under Law No. 5651 and related legislation, IP address, access and session logs, cookie identifiers, device/browser information, in-panel transaction logs.

• Service-related Data: server/hosting resource usage metrics and service configuration data.

• Marketing: if explicit consent has been given, commercial electronic message permissions and preference records.

• Payment Information: payments are taken through the infrastructure of the secure payment institution PayTR; your credit card or sensitive financial information is not stored on Arcnar servers. Only the transaction reference, payment amount and transaction result are kept.

3. Purposes of Processing

• Setting up, providing, uninterruptedly maintaining, renewing and billing the Services,

• Ensuring account security, preventing fraud, cyber attacks and misuse, and running information security processes,

• Responding to customer support requests and providing operational communication,

• Fulfilling legal obligations (invoice retention under the Tax Procedure Law, logging obligations under Law No. 5651, WHOIS/registration requirements, requests of authorised public institutions),

• Sending campaign, announcement and information messages where explicit consent has been given,

• Measuring, reporting and improving service quality through aggregate and anonymous statistical analysis.

4. Legal Grounds (KVKK Art. 5 and Art. 6)

Your personal data is processed on the basis of the following legal grounds set out in KVKK Art. 5 and Art. 6:

• Art. 5/2-c: being necessary to process personal data of the parties to a contract, provided that it is directly related to the conclusion or performance of that contract,

• Art. 5/2-ç: being mandatory for the data controller to fulfil its legal obligation,

• Art. 5/2-e: data processing being mandatory for the establishment, exercise or protection of a right,

• Art. 5/2-f: data processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject,

• Art. 5/1 and Art. 6/2: explicit consent for the sending of commercial electronic messages and, in the cases required by legislation, for cross-border transfers.

5. Method of Collection

Your personal data is collected electronically, by fully or partly automated means, through registration and order forms, your transactions on the customer panel, support tickets, cookies, the payment infrastructure and registration integrations.

6. Sharing and Transfer of Information

Your personal data is in no way sold to third parties for commercial purposes. It may be shared with the following parties only within the scope of performing the service and legal obligations:

• Infrastructure Providers: server hosting, data centre and cloud infrastructure providers (e.g. OVHcloud and official partners), according to the physical location where the service is hosted.

• Domain Registrars: DomainNameAPI and the relevant upper registry bodies (e.g. METUNIC, ICANN-accredited registration authorities).

• Payment Institution: PayTR Payment Institution.

• Communication and Monitoring Tools: technical infrastructure providers that carry out transactional email delivery and error/system-health monitoring.

• Legal Authorities: financial advisers, independent auditors, legal counsel, and authorised public institutions such as courts/prosecutors' offices (in the event of requests for information and documents arising from legislation).

• Cross-border Transfer: where data is hosted in data centres abroad depending on the location chosen for the service, transfer is carried out — without prejudice to the provisions of Article 9 of KVKK — to countries with adequate protection, or, where adequate protection is not present, on the basis of undertakings compliant with legislation and, where required, your explicit consent.

7. Cookies and Similar Technologies

Cookies and local storage (localStorage) technologies are used on our site and panel to maintain sessions, remember preferences and keep the infrastructure running securely.

• 7.1 Essential Cookies: mandatory for the basic functions of the site and panel to work; cannot be turned off. Session cookies (e.g. arcnar_session), CSRF/security cookies (XSRF-TOKEN), language/currency preferences and cookie preference management are within this scope.

• 7.2 Functional Cookies: optional preferences that personalise the user experience.

• 7.3 Analytics / Performance Cookies: used to measure visitor trends in an anonymous manner. No third-party advertising/tracking cookies are hosted.

• 7.4 Payment Provider Cookies: cookies required by the PayTR infrastructure for fraud detection and transaction security at the payment step.

• 7.5 Cookie Management: you can manage or delete cookies via the cookie banner or your browser settings. However, if essential cookies are blocked, logging into the Customer Panel becomes technically impossible.

8. Retention Periods

• Invoice and Accounting Records: retained for the statutory period of 10 years under the Tax Procedure Law (VUK) and the Turkish Commercial Code (TTK).

• Account and Service Logs: for the duration of the service relationship and, in any dispute, for the statute-of-limitations periods.

• Transaction and Traffic Security Logs: for the minimum periods required by Law No. 5651 and related legislation.

• Support Correspondence: retained for a reasonable period after the request is closed, for audit and quality purposes.

• When the periods expire, the data is deleted, destroyed or anonymised in accordance with KVKK and the related regulations.

9. Data Security Measures

To prevent the unlawful processing of and access to your personal data and to ensure its safekeeping, Arcnar applies administrative and technical measures such as TLS encryption, cryptographic (hashing) storage of passwords, role-based authorisation, two-factor authentication (2FA) options, encrypted backups and security monitoring software. Emergency procedures are operated against the risk of a data breach; statutory notification obligations are complied with.

10. Rights of the Data Subject (KVKK Art. 11)

Your rights under Article 11 of KVKK:

• To learn whether your personal data is being processed,

• To request information if it has been processed,

• To learn the purpose of processing and whether it is used in accordance with that purpose,

• To know the third parties to whom it is transferred domestically or abroad,

• To request its correction if it has been processed incompletely or incorrectly,

• To request its deletion or destruction within the framework of the conditions set out in KVKK legislation,

• To request that the above operations be notified to the third parties to whom it has been transferred,

• To object to a result arising against you due to the analysis of the processed data solely by automated systems,

• To request compensation if you suffer damage due to unlawful processing.

Application Method: to exercise your rights, you may submit your requests in writing in accordance with the provisions of the "Communiqué on the Procedures and Principles of Application to the Data Controller", or send them to [email protected] via secure electronic signature, mobile signature or your email address registered in the system. You may also create data deletion or export requests directly from the "My Account → My Data" section on the Customer Panel. Your applications are concluded free of charge within 30 (thirty) days at the latest.

11. Children's Privacy

Arcnar services are not directed at minors (under 18); personal data is not knowingly collected from persons under 18.

12. Changes

This text may be updated in line with changes in legislation or developments in Arcnar's service structure. Material changes are announced via the Panel and by email; the current text is always kept accessible at this address.

13. Contact

• Title / Provider: Berat Tayşı

• Email: [email protected]

• Phone: +90 850 840 20 73