ENGLISH (UPDATED PRIVACY NOTICE)

PRIVACY AND PERSONAL DATA PROCESSING NOTICE

This Privacy Notice has been prepared by Hepopa!, acting in the capacity of Data Controller, in accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK” / "Law"), to inform users and applicants inquiring about agency consultations regarding the purposes of processing personal data, legal grounds, methods of collection, and their rights.

1. Collected Personal Data and Method of Collection

Within the scope of the services, UGC infrastructure solutions, and contact forms provided via the Hepopa! platform, your personal data specified below is collected electronically through our website via automated or non-automated methods:

• Identity Data: First name and last name.

• Contact Data: Email address, phone number.

• Professional / Corporate Data: Agency or brand website, Instagram handle, application type, and related corporate inquiries.

2. Purposes of Processing Personal Data

Your collected personal data is processed in accordance with the personal data processing conditions specified in Articles 5 and 6 of the KVKK for the following purposes:

• Planning and executing UGC (User-Generated Content) operations, agency solutions, and growth strategy consultations offered through the Hepopa! platform,

• Contacting the applicant and managing requests, inquiries, and complaints,

• Formulating operation plans tailored to the needs of brands or agencies and providing feedback within 24 hours,

• Managing information security processes and fulfilling legal obligations.

3. Authorized Third Parties and Purposes of Data Transfer

Your collected personal data may be shared, in accordance with the conditions set forth in Articles 8 and 9 of the KVKK, with legally authorized public institutions and organizations, as well as our infrastructure, hosting, and server service providers with whom we conduct our business processes, strictly for the realization of the purposes mentioned above.

4. Legal Grounds for Personal Data Collection

Your personal data is processed based on your explicit consent provided during the completion of contact and application forms on our website, and/or on the legal grounds specified in Article 5 of the Law: "Necessary processing of personal data belonging to the parties of a contract, provided that it is directly related to the establishment or performance of that contract" and "Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject."

5. Your Rights Under Article 11 of the KVKK

Pursuant to Article 11 of the KVKK, as the data subject, you hold the following rights:

• To learn whether your personal data is being processed,

• To request information if your personal data has been processed,

• To learn the purpose of processing your personal data and whether it is used in accordance with its purpose,

• To know the third parties to whom your personal data is transferred domestically or abroad,

• To request the correction of your personal data if it has been processed incompletely or inaccurately,

• To request the deletion or destruction of your personal data within the framework of the conditions stipulated in the KVKK legislation,

• To request notification of the operations carried out pursuant to the above correction, deletion, or destruction requests to third parties to whom your personal data has been transferred,

• To object to any outcome against you that arises exclusively from the analysis of processed data through automated systems,

• To demand indemnification for damages in case you suffer damage due to unlawful processing of personal data.

To exercise your rights under the Law, submit your requests, or ask any questions regarding personal data protection, you may contact us at any time via the contact channels available on our website.