Disclosure Notice on the Protection and Processing of Personal Data

Pursuant to the KVKK, your personal data are processed by ŞAH BOYA MOBİLYA DEKORASYON SAN. VE TİC. LTD. ŞTİ. acting as data controller, within the scope explained below. The Company operates in the retail of garden/outdoor and indoor furniture under the Rolvens Home Garden Concept brand and runs a physical showroom in Kayseri, Türkiye.

The contact details of the data controller are as follows:

• Legal name: ŞAH BOYA MOBİLYA DEKORASYON SAN. VE TİC. LTD. ŞTİ.
• Brand and website: Rolvens Home Garden Concept — https://rolvens.com
• Address: KUMSMALL AVM (Erkilet Gate), Camikebir Mahallesi, 5062. Cadde No:44, Kocasinan / Kayseri, Türkiye
• Telephone: +90 534 086 10 70
• E-mail: [email protected]

Since our website has no membership or account system, no shopping cart, no payment infrastructure and no online sales, we do not process identity verification, payment or order data. Personal data are collected through three forms that use the same flow — the contact form, the quote/price request modal, and the price request form on product pages — and, in addition, through the technical access logs kept by our web server when you visit the site.

Even if no form is completed, each page request made while you visit the site is written to our web server's access logs, including the IP address, the address of the requested page, the referer information and the browser (user-agent) information.

The data you enter into the form fields, together with the data automatically added by the server for technical reasons, are as follows:

• Name (mandatory field)
• Telephone number (mandatory field)
• E-mail address (optional field)
• Message content (optional field)
• Subject of the request (topic information)
• Product of interest (product name and product address/slug)
• Language preference selected on the site (tr/en/ar)
• IP address (recorded automatically by the server)
• Address of the page from which the form was submitted — referer information (automatic)
• Browser and device information — user-agent information (automatic)

The personal data listed above are processed in accordance with the principles set out in Article 4 of the KVKK — lawfulness and fairness; processing for specified, explicit and legitimate purposes; and being relevant, limited and proportionate to the purposes of processing — for the purposes set out below.

The IP address is additionally used within the scope of a rate limiting mechanism designed to prevent a large number of form submissions within a short period of time. The hidden field (honeypot) included in the forms, which is not visible to users, exists solely to distinguish automated spam submissions. The technical access logs kept by our web server are maintained in order to ensure information security, to detect misuse and to monitor the proper functioning of the website.

Our Company does not send newsletters, campaign announcements or any other commercial electronic messages through the website. Under Turkish Law No. 6563 on the Regulation of Electronic Commerce, sending commercial electronic messages requires separate consent; should such a practice be introduced in the future, the required consent process will be carried out separately and this notice will be updated.

• Evaluating and responding to the quote/price request you have submitted
• Providing information about our products and services and contacting you in line with your request
• Responding to information requests submitted about our showroom and our products
• Preventing spam and misuse in form submissions and ensuring information security
• Fulfilling legal obligations and establishing and protecting rights in the event of potential disputes

Your name, telephone number, e-mail address, message, request subject, product of interest and language preference are processed in order to respond to your request and to contact you, on the basis of Article 5/2-(c) of the KVKK, which permits processing where "it is necessary to process the personal data of the parties to a contract, provided that such processing is directly related to the conclusion or performance of that contract". A quote request constitutes the preparatory stage of a potential sales relationship.

Your IP address, referer and user-agent information, the technical access logs kept by our web server, as well as the operations carried out within the scope of rate limiting, are processed on the basis of Article 5/2-(f) of the KVKK, which permits processing where "processing is necessary for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject". Our legitimate interests here are ensuring system and information security, preventing spam and misuse, tracking requests accurately, and preserving the ability to provide evidence in the event of potential disputes.

Where our Company needs to process data for a purpose other than those stated in this notice, the relevant processing condition and purpose will be notified separately.

Your personal data are collected through the contact and quote forms on the website https://rolvens.com and through the access logs kept by our web server, in electronic form, by automated or partially automated means. Completing a form is entirely at your own discretion. When you visit the site, our web server records your IP address, the requested page, the referer information and the browser information as a technical access log for security purposes and for the proper functioning of the website; this processing falls within the legitimate interest ground under Article 5/2-(f) of the KVKK.

We would like to emphasise that our website does not store the data you submit through the forms in its own database. Each form submission is transmitted as an e-mail message to our Company's e-mail address via the SMTP protocol, and the data therefore reside in our Company's e-mail inbox.

Our website uses a functional session cookie named NEXT_LOCALE in order to preserve the language you have selected for the duration of your visit; this cookie carries no expiry date and is deleted when you close your browser. In addition, the Cloudflare infrastructure behind the site may set technical cookies for security and bot management purposes depending on the nature of the visit (e.g. __cf_bm); the lifetime of such cookies is determined entirely by Cloudflare. The cookies set by our own site are limited to these; cookies set by the relevant provider when third-party embedded content is displayed fall outside this scope. Our website contains no analytics tools, no advertising/marketing cookies and no tracking pixels. Should any such tool be added in the future, this notice will be updated.

Your personal data may be transferred, to the extent necessary to achieve the purposes listed above and in compliance with the relevant provisions of the KVKK, to our SMTP e-mail service provider for the delivery of e-mail messages, to our hosting service provider for the publication of the website, and to our content delivery network/security service provider.

Our website is published behind the Cloudflare content delivery network and security layer. For this reason, technical data such as your IP address processed while you access the site and submit forms may involve a transfer via servers located abroad. This is stated explicitly in accordance with the principle of transparency.

Our website contains promotional videos served through Cloudflare Stream. When such content is displayed, the relevant provider may use its own cookies or similar technologies. The site also contains external links directing you to our Instagram profile; when you click such a link, Instagram's own policies apply. Likewise, if you click on links directing you to WhatsApp (wa.me), WhatsApp's own privacy policies will apply. The practices of these third parties are not under our Company's control.

Where duly submitted requests are received from legally authorised public authorities and judicial bodies, information may be shared within the framework of the applicable legislation.

Your personal data are retained for as long as necessary for the purposes for which they are processed, and in any event until the statutory limitation periods and legal retention obligations set out in the applicable legislation have expired. For quote and contact requests, this period ends once the request has been concluded and the relevant periods have elapsed.

This notice does not state a fixed number of days; the retention period is determined by the nature of the request and by obligations arising from legislation. Where the purpose of retention ceases to exist, your personal data are deleted, destroyed or anonymised.

Bearing in mind that the data are held in our Company's e-mail inbox, you may at any time request the deletion of your data using the application methods set out below.

Pursuant to Article 11 of the KVKK, you may apply to our Company and exercise the following rights:

• To learn whether your personal data are being processed
• To request information if your personal data have been processed
• To learn the purpose of processing your personal data and whether they are used in accordance with that purpose
• To know the third parties in Türkiye or abroad to whom your personal data are transferred
• To request the rectification of your personal data if they have been processed incompletely or inaccurately
• To request the erasure or destruction of your personal data within the framework of the conditions set out in Article 7 of the KVKK
• To request that operations carried out pursuant to your rectification, erasure or destruction requests be notified to the third parties to whom your personal data have been transferred
• To object to a result arising against you as a consequence of the analysis of the processed data exclusively by automated systems
• To claim compensation for damage arising from the unlawful processing of your personal data

Pursuant to Article 13 of the KVKK and the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit requests concerning the rights listed above together with your name, surname, signature (for written applications), your Turkish identity number if any, your address for notification, your telephone number and explanations regarding the subject of your request, along with information verifying your identity.

You may submit your application in writing to KUMSMALL AVM (Erkilet Gate), Camikebir Mahallesi, 5062. Cadde No:44, Kocasinan / Kayseri, Türkiye, or by using the e-mail address you have previously notified to our Company and which is registered in our system, to [email protected]. Your requests will be concluded as soon as possible depending on their nature, and in any event within thirty days as provided under the Law. If your application is rejected, if the response given is found insufficient, or if no response is provided within the prescribed period, you reserve the right to lodge a complaint with the Personal Data Protection Board.

Turkish law shall apply to any dispute arising from this Disclosure Notice, and the Courts and Enforcement Offices of Kayseri shall have jurisdiction. Our Company reserves the right to amend this notice due to legislative changes or updates to its business processes; the current version is always published on this page.

The Turkish version of this notice is the original text. The English and Arabic versions are translations provided for information purposes only; in the event of any difference or conflict between the versions, the Turkish text shall prevail.