Privacy Notice

Last updated: 1 October 2026

This privacy notice has been prepared by Gül Gross Market Gıda Sanayi ve Ticaret A.Ş. (“GÜL” or the “Company”), acting as data controller, pursuant to Article 10 of Turkish Personal Data Protection Law No. 6698 (the “KVKK”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.

1. Data controller

| Item | Details | |---|---| | Company | Gül Gross Market Gıda Sanayi ve Ticaret A.Ş. | | Address | Gül Plaza, Merkez Mah. Gross Cad. No:1, 34750 Ataşehir/İstanbul | | General contact | iletisim@gulgross.com.tr | | Data protection requests | kvkk@gulgross.com.tr | | Customer service | +90 850 000 00 00 |

2. Categories of personal data processed

Depending on how you use our services, the following personal data may be processed:

• Identity and contact: Name, surname, e-mail address, telephone number, province.
• Contact form: The subject and content of your message and the date of the request.
• Newsletter: E-mail address, language preference, subscription confirmation record and date.
• Job applications: CV, education and work experience, the position applied for and cover letter. Please do not include unnecessary data such as health information or a photograph in your CV.
• Supplier and wholesale (GÜL Card) applications: Company name, details of the authorised person, tax number, field of activity and additional application-specific information.
• Store security: CCTV recordings in store, car park and warehouse areas.
• Transaction security: IP address, browser information, form submission time and security logs.
• Cookies: Usage data collected by analytics and marketing cookies, subject to your consent (see our Cookie Policy for details).

3. Purposes of processing

Your personal data is processed for the following purposes:

1. Receiving, assessing and resolving your requests, suggestions and complaints,
2. Sending newsletters and campaign announcements where you have given explicit consent,
3. Running human resources processes, assessing candidates and recruitment,
4. Assessing supplier and wholesale customer applications and managing contract processes,
5. Ensuring the safety of our store, employees and customers and preventing theft and fraud,
6. Managing information security and preventing misuse and automated attacks,
7. Fulfilling legal obligations and responding to requests from competent authorities,
8. Operating and improving the website.

4. Legal grounds

Your personal data is processed on the following legal grounds set out in Article 5 of the KVKK: it is expressly provided for by law (Art. 5/2-a), it is directly related to the conclusion or performance of a contract (Art. 5/2-c), it is necessary for compliance with a legal obligation of the data controller (Art. 5/2-ç), it is necessary for the establishment, exercise or protection of a right (Art. 5/2-e) and it is necessary for our legitimate interests, provided that your fundamental rights and freedoms are not harmed (Art. 5/2-f). Sending newsletters and using non-essential cookies are based on your explicit consent (Art. 5/1). Special categories of personal data are processed only under the conditions of Article 6 of the KVKK and with the necessary safeguards.

5. Transfers of personal data

Limited to the purposes above, your personal data may be transferred in accordance with Article 8 of the KVKK to competent public authorities under legal obligations, to our IT, hosting, e-mail delivery and security service providers, to legal and financial advisers and to our business partners. If cloud or e-mail infrastructure is located abroad, the transfer is carried out with one of the appropriate safeguards set out in Article 9 of the KVKK (such as standard contractual clauses) and with the required notification to the Data Protection Authority.

6. Method of collection

Your personal data is collected wholly or partly by automated means through forms on our website, e-mail, our customer service line, our store, CCTV systems and cookies.

7. Retention periods

| Data group | Retention period | |---|---| | Contact form records | 2 years after the request is resolved | | Newsletter subscription | Until unsubscription, plus a 1-year proof record | | Job applications and CVs | 1 year from the application | | Supplier / wholesale applications | 2 years if unsuccessful; contract term + 10 years if a contract is signed | | CCTV recordings | 30 days (or for the duration of an incident investigation) | | Security and access logs | 2 years |

Data whose retention period has expired is deleted, destroyed or anonymised in accordance with our Personal Data Retention and Destruction Policy.

8. Your rights under Article 11 of the KVKK

By applying to the Company, you have the right to learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of processing and whether it is used in line with that purpose; to know the third parties to whom it is transferred in Türkiye or abroad; to request correction if it is incomplete or inaccurate; to request deletion or destruction under Article 7 of the KVKK; to request that these actions be notified to third parties to whom the data was transferred; to object to a result against you arising exclusively from automated analysis; and to claim compensation if you suffer damage due to unlawful processing.

9. How to apply

You can submit your request in writing with information that identifies you, either by a signed letter to our address above, by secure electronic signature to our registered e-mail (KEP) address, or from the e-mail address registered in our systems to kvkk@gulgross.com.tr. Requests are resolved free of charge within 30 days at the latest, depending on their nature; if the action involves an additional cost, the fee set by the Data Protection Board may be charged.