Personal Data Notice

Under Law No. 6698 on the Protection of Personal Data (“KVKK”), the data controller is KÖSTEBEK Araştırma Teknoloji Ticaret Anonim Şirketi (“KÖSTEBEK” or the “Company”). This Notice has been prepared regarding the processing of personal data of persons visiting the main website at www.mol-e.co.

This notice covers persons who visit the main website without creating membership or a user account, and persons who contact the Company via contact form, e-mail or telephone where applicable.

Membership, offer, reservation, payment and operational processes on App MOL-E are subject to the App MOL-E Privacy Notice; project selection, e-waste delivery, donation/contribution routing and project participation processes within Project MOL-E are subject to the Project MOL-E Privacy Notice. If you access these areas via a link on the main website, the relevant notice is provided separately at the stage when personal data is collected.

Depending on the use of the main website and communication processes, the following personal data may be processed only to the extent actually collected:

• Transaction security and technical data: IP address, connection date and time, device and browser information, access logs, referring page information, session and log records, and security and abuse detection records.
• Communication and request data: When a contact form or other communication channels are used: name, surname, e-mail address, phone number, employer and job title information, and request or message content.
• Legal proceedings and application data: Complaints, legal requests, KVKK applications, related correspondence and records regarding the conclusion of applications.
• Cookie data: Limited technical data obtained through strictly necessary cookies used for the operation of the main website. Details of cookies used are explained in the Main Website Cookie Policy.

No personal data is processed on the main website for performance/analytics measurement, advertising, marketing or user profiling purposes. Visitors are expected not to enter special category personal data or third-party data that is not necessary for evaluating their request in communication fields.

Personal data is processed for publishing the main website and operating its basic functions; ensuring access and transaction security; detecting and preventing errors, attacks and abuse; receiving and responding to communication, information, promotion, meeting or service requests; carrying out pre-contractual processes related to requested services; fulfilling legal and regulatory obligations; establishing, exercising and protecting the rights of the Company or data subjects; and managing disputes and data subject applications.

Visiting the main website or sending a communication request is not considered commercial electronic message consent on its own. If commercial electronic messages are planned to be sent, a separate consent process will be operated where necessary.

Personal data is processed based on the following legal grounds set out in the second paragraph of Article 5 of the KVKK, depending on the processing activity:

• Being directly related to the establishment or performance of a contract (KVKK Art. 5/2-c): Evaluating communication, information, meeting or service requests and carrying out pre-contractual processes related to the requested service.
• Being mandatory for the data controller to fulfill its legal obligation (KVKK Art. 5/2-ç): Responding to requests from authorized authorities and fulfilling record and application obligations.
• Being mandatory for the establishment, exercise or protection of a right (KVKK Art. 5/2-e): Conducting applications, complaints, disputes and legal processes and preserving evidence.
• Being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (KVKK Art. 5/2-f): Operating the website securely and functionally, keeping mandatory technical records and managing communication requests.

Personal data is collected electronically by automated methods through browser, device, strictly necessary cookies, server logs and security infrastructure when the website is visited; and wholly or partly by automated methods based on the declarations of the data subject when contact forms, e-mail, telephone or other communication channels are used.

Personal data may be transferred, in a manner connected, limited and proportionate to the purpose, to software, server/hosting, cloud, e-mail, CAPTCHA, CDN, logging, system security and technical support service providers for operating, hosting, securing the website and managing communication requests; to lawyers, consultants and auditors for conducting legal processes; and to public institutions and organizations, courts and administrative authorities authorized by law when legally requested, in accordance with Article 8 of the KVKK.

Cross-border transfer of personal data from Turkey within the scope of the main website may occur only to the extent necessary for providing the relevant technical service, where the infrastructure of the server/hosting, cloud, e-mail, CAPTCHA, CDN, logging, system security or technical support services actually used is located abroad or data is accessed from abroad within the scope of these services.

Such cross-border transfers are carried out pursuant to Article 9 of the KVKK by means of an adequacy decision or by providing one of the appropriate safeguards; where the General Data Protection Regulation (“GDPR”) applies, transfers are carried out in accordance with the conditions set out in Chapter V of the GDPR. Except for transfers arising from the technical services stated above, personal data is not transferred abroad within the scope of the main website.

Personal data is retained for the period necessary for the purposes for which it is processed and limited by retention periods stipulated in applicable legislation. Communication and request records are retained for the period necessary to conclude the request and protect rights that may arise from any related business or contractual relationship; legal proceedings and application records are retained for the relevant statutory and limitation periods; access, security and log records are retained for the maximum period necessary for security purposes and as determined in the technical inventory. When the retention period expires, data is deleted, destroyed or anonymized in accordance with legislation. Retention periods for strictly necessary cookies are also shown in the Cookie Policy.

Pursuant to Article 11 of the KVKK, by applying to the Company you have the right to learn whether your personal data is processed; to request information if processed; to learn the purpose of processing and whether it is used in accordance with its purpose; to know the third parties to whom personal data is transferred domestically or abroad; to request correction if personal data is incomplete or incorrectly processed; to request deletion or destruction of personal data within the framework of the conditions set out in the KVKK; to request that correction, deletion or destruction operations be notified to third parties to whom personal data was transferred; to object to a result against you arising from analysis exclusively by automated systems; and to claim compensation if you suffer damage due to unlawful processing of personal data.

For processing activities within the scope of the GDPR, the data subject has the rights to access their data, request correction or deletion of data, request restriction of processing, object to processing and, where conditions exist, data portability. Where processing is based on explicit consent, explicit consent may be withdrawn. The data subject may also lodge a complaint with the competent supervisory authority in their place of residence or work, or where the alleged infringement occurred.

Requests under the KVKK may be submitted together with information sufficient to identify the identity and the subject of the request, in writing to the Company’s address below, via registered e-mail (KEP), using secure electronic signature or mobile signature, or via [email protected] from an e-mail address previously notified to the Company by the data subject and registered in the Company’s systems.

If there is a significant change in processed data categories, purposes, legal bases, recipient groups, technical services used or cross-border transfer structure, this notice is updated before the relevant new data processing activity begins. The current notice applies as of the date it is published on the main website. 30/07/2026