Explicit Consent Statement

This Explicit Consent Statement explains the principles governing personal data processing activities for which Kayalar Jewellery may require an individual's explicit consent under Türkiye's Personal Data Protection Law No. 6698 (KVKK) and, where applicable, other relevant data protection legislation.

At Kayalar Jewellery, we recognise that consent must be freely given, specific and informed. Individuals should understand the purpose, scope and potential consequences of any processing activity before deciding whether to give their consent.

This statement is separate from the Privacy Policy and the relevant Personal Data Protection notices published by Kayalar Jewellery. It applies only to activities for which consent is an appropriate and legally required basis for processing personal data.

Where European Union or United Kingdom data protection legislation applies, any consent request must also meet the relevant requirements concerning freely given, specific, informed and unambiguous consent.

Publication of this statement does not, by itself, constitute the collection of consent. Where consent is required, it must be obtained through a separate, appropriate and demonstrable choice relating to the specific processing activity.

1. Data Controller

Kayalar Jewellery is the brand through which the relevant jewellery retail and e-commerce services are provided. Information concerning the business responsible for determining the purposes and means of personal data processing is provided through the applicable Personal Data Protection notices.

For general enquiries concerning personal data processing and consent preferences, the following contact details may be used:

2. Scope of Explicit Consent

Explicit consent is requested only where it is necessary and appropriate for a particular personal data processing activity under the applicable legal framework.

Personal data may also be processed on other lawful grounds. Depending on the relevant legislation and circumstances, these may include the performance of a contract, compliance with legal obligations, the establishment or protection of legal claims, or legitimate interests where legally permitted.

Where a processing activity is lawfully carried out on another appropriate legal basis, unnecessary consent will not be requested merely as an additional formality.

Any consent request must identify the relevant processing activity and provide sufficient information for the individual to make a meaningful choice.

Consent for one activity does not automatically authorise unrelated processing activities. Where separate purposes require consent, appropriate individual choices must be provided.

3. Categories of Personal Data That May Be Subject to Consent

Where a specific activity is lawfully based on consent, the categories of personal data involved will depend on the nature and purpose of that activity.

Depending on the particular processing operation, these categories may include:

• Identification Information: Name, surname and other identification details relevant to the specified purpose.
• Contact Information: Email address, telephone number or other contact details relevant to the activity.
• Customer Transaction Information: Purchase history, product selections and relevant interactions with our jewellery collections.
• Preferences & Interests: Product preferences, voluntarily provided interests and marketing-related choices.
• Website Usage Information: Browsing activity, website interactions and related technical information where collected through consent-based technologies.
• Other Relevant Personal Information: Information voluntarily provided by the individual for a clearly identified processing purpose.

The categories listed above describe information that may be relevant to particular consent-based activities. They do not indicate that every category is collected from every customer or that consent is requested for all such information.

Each applicable consent request should identify the relevant data and purpose. Information must not be collected or used beyond what is appropriate and necessary for the specified activity.

4. Purposes of Consent-Based Processing

Where consent is the appropriate legal basis, personal data may be processed only for the specific purposes communicated to the individual before that consent is obtained.

Depending on the services actually offered and the applicable legal requirements, activities for which consent may be requested could include:

• Analysing customer preferences and interests for optional personalisation activities.
• Providing personalised jewellery recommendations based on information used with the individual's valid consent.
• Conducting optional marketing analysis where consent is required by applicable law.
• Personalising selected website features or experiences through consent-based technologies.
• Analysing relevant campaign interactions where the activity requires consent.
• Carrying out another specifically identified optional activity for which valid consent is obtained in advance.

These examples do not constitute a general authorisation for all marketing, analytics or personalisation activities.

Where a particular activity requires consent, Kayalar Jewellery must clearly identify the relevant processing purpose, personal data involved and any material information necessary for an informed decision.

Consent obtained for one specified purpose will not be treated as permission to process personal data for an unrelated purpose without an appropriate legal basis.

5. Marketing Analysis & Profiling

Depending on the services and technologies in use, certain personalisation activities may involve analysing information such as purchasing preferences, product interests or interactions with jewellery collections.

Where such analysis is based on consent, the individual must receive clear information about the nature of the activity and its intended purpose before deciding whether to participate.

Consent-based profiling or personalised marketing activities must be limited to the purposes for which valid consent was obtained.

Where applicable law requires separate choices for analytics, advertising cookies, behavioural profiling or other processing purposes, the relevant preferences must be collected and managed accordingly.

If a processing activity involves decision-making based solely on automated processing and has legal or similarly significant effects on an individual, any additional obligations under applicable data protection legislation must be considered separately.

Individuals retain the right to withdraw consent for activities based on consent and may have additional rights concerning profiling and automated decision-making under applicable law.

6. Commercial Electronic Communications

This Explicit Consent Statement does not, by itself, constitute permission to receive commercial electronic communications from Kayalar Jewellery.

Marketing communications, including promotional emails, SMS messages, telephone calls, new collection announcements, discounts and special offers, are subject to the electronic marketing requirements applicable to the recipient and communication channel.

Where the law requires prior permission for commercial electronic communications, that permission must be obtained through an appropriate and separate process.

Customers may update their communication preferences or withdraw marketing permission in accordance with applicable legislation and the communication methods made available.

Further information is provided in our Marketing Communications Consent information.

7. Sharing Personal Data With Third Parties

Certain processing activities may involve sharing personal information with external service providers or other recipients where the sharing is necessary, lawful and appropriately disclosed.

The relevant legal basis for a disclosure depends on the processing purpose, the recipient's role and the applicable data protection requirements.

Where a particular disclosure requires the individual's consent, the consent request must provide sufficient information about the relevant processing and recipients or recipient categories, as required by law.

Providing consent for a specific activity does not automatically authorise unrelated disclosures or unrestricted sharing with third parties.

Where personal data is shared for activities such as payment processing, shipping, order fulfilment or compliance with legal obligations on another appropriate legal basis, separate consent is not necessarily required.

Any third-party sharing must comply with the relevant principles of lawful processing, transparency, data minimisation and appropriate security.

8. International Transfers of Personal Data

The operation of an international e-commerce website may involve service providers, technology infrastructure or business activities located outside Türkiye.

Where personal data is transferred internationally, the relevant transfer must comply with the legal requirements applicable to that processing activity.

Under Türkiye's Personal Data Protection Law No. 6698, international transfers are governed by Article 9, which provides for recognised transfer mechanisms and specific legal conditions.

Depending on the circumstances, lawful international transfers may be based on an applicable adequacy decision, appropriate safeguards or another mechanism expressly permitted by law.

Under the Turkish framework, explicit consent is not a general substitute for the legal requirements governing routine international transfers.

Where no applicable adequacy decision or appropriate safeguard is available, consent may be relevant to certain exceptional and non-repetitive international transfers, provided that the specific statutory requirements are satisfied and the individual has been informed of the possible risks.

Where the EU GDPR or applicable United Kingdom data protection legislation governs a particular international transfer, the relevant transfer conditions and safeguards must also be considered.

If consent is legally relied upon for a specific international transfer, the individual must receive appropriate information about that transfer, its purpose, relevant recipients or destinations and any material risks that must be disclosed under the applicable law.

This statement does not constitute a general or advance authorisation for unrestricted transfers of personal data to other countries.

9. Freely Given Consent

Consent must represent a genuine and informed choice made by the individual without inappropriate pressure or disadvantage.

Where processing is optional and requires consent, individuals must be able to refuse without being prevented from using unrelated essential services that do not depend on that processing activity.

For Kayalar Jewellery customers, refusal of optional consent does not, by itself, prevent ordinary account management, order placement, payment processing, invoicing, shipping or other activities that can lawfully be carried out without consent.

Where consent is required for more than one independent purpose, individuals should be offered separate choices where required by law.

Silence, inactivity, pre-selected checkboxes or merely browsing the website will not be treated as valid consent where an affirmative action is required.

Consent must also be distinguishable from acceptance of general website terms, membership conditions and other contractual obligations.

10. Withdrawal of Consent

Individuals may withdraw previously granted consent at any time.

Withdrawal applies prospectively and does not, by itself, affect the lawfulness of processing carried out on the basis of valid consent before the withdrawal.

When Kayalar Jewellery receives a valid withdrawal request, the relevant processing activities that depend on the withdrawn consent must cease in accordance with the applicable legal requirements.

Where particular information must continue to be retained or processed under another applicable legal obligation or lawful basis, that processing will be assessed separately and must remain limited to the relevant lawful purpose.

Where EU or UK data protection legislation applies, withdrawing consent must be as easy as giving it.

Individuals may contact Kayalar Jewellery using the official details provided below to communicate their consent preferences or request assistance.

Where consent has been provided through a specific website preference mechanism, any applicable withdrawal controls should also be made available in accordance with the relevant legal requirements.

11. Explicit Consent Declaration

Where Kayalar Jewellery requests explicit consent for a specific personal data processing activity, the individual must first be provided with the relevant privacy information and a clear explanation of the processing for which consent is requested.

Where a specific processing activity requires my consent, I understand that Kayalar Jewellery must inform me of the relevant purpose, the personal data involved and other legally required details before requesting my permission.

I understand that any decision to consent must be made freely through an appropriate affirmative action, and that refusing optional consent will not, by itself, prevent access to essential services that can lawfully be provided without it.

I also understand that I may withdraw consent at any time, subject to the applicable legal provisions, and that withdrawal will not retrospectively invalidate processing lawfully carried out before it.

Where multiple independent activities require consent, separate permissions should be obtained as required by law. No blanket or unrestricted consent is established by this general declaration.

12. Your Personal Data Protection Rights

Individuals whose personal data is processed by Kayalar Jewellery may exercise the rights granted to them under applicable data protection legislation.

Under Article 11 of Türkiye's Personal Data Protection Law No. 6698, individuals have rights concerning their personal data, subject to the relevant statutory requirements.

Depending on the circumstances, these may include requesting information about personal data processing, accessing relevant information, requesting correction of inaccurate or incomplete data, and requesting deletion or destruction where the legal conditions are satisfied.

Where the EU GDPR, UK data protection legislation or another applicable privacy framework governs a particular processing activity, additional or different rights may apply.

These may include rights of access, rectification, erasure, restriction, objection, data portability and rights relating to certain automated decisions, where the relevant legal conditions are met.

Individuals may also have the right to lodge a complaint with the competent data protection supervisory authority under the applicable legislation.

For further information about your rights and the procedures for submitting a request, please review our Personal Data Protection notices and Data Subject Request Form information.

13. Contact Information

If you have questions about personal data processing, explicit consent, consent withdrawal, international data transfers or the exercise of your privacy rights, please contact Kayalar Jewellery through the official communication channels below.