Cookie Policy

1. Purpose and Scope

As Paylisher Teknoloji Anonim Şirketi ("Paylisher", the "Company" or "we"), we care about the privacy of the people who visit our website and the protection of their personal data.

This Cookie Policy (the "Policy") has been prepared to explain the purposes for which personal data may be processed through cookies and similar technologies used on our website (the "Site"), the types of technologies used, their legal grounds and how visitors can manage their preferences.

In the processing of personal data, the applicable legislation is taken into account, in particular Law No. 6698 on the Protection of Personal Data ("KVKK").

This Policy relates to the cookie practices on Paylisher's own website.

Where Paylisher technologies are used in mobile applications or websites belonging to corporate customers, the privacy policies and KVKK privacy notices of those customers may also apply to the relevant operations.

2. What Is a Cookie?

Cookies are small data files that may be placed on a user's browser or device by the websites visited.

Cookies may be used for purposes such as enabling websites to function, managing secure sessions, remembering user preferences and, under certain conditions, analysing visitor interactions.

In addition to cookies, local storage, session storage, pixel tags and similar technologies may also be used.

These technologies are assessed under the relevant data protection legislation to the extent that they result in the processing of personal data.

3. Cookie Categories

The cookies that may be used on the Paylisher website are divided into the following categories according to their purposes.

The fact that a category is described in this Policy does not mean that all cookies in that category are used at all times.

3.1. Strictly Necessary Cookies

Strictly necessary cookies are cookies required to provide the basic functions of the website and the services explicitly requested by the user.

Their purposes of use may include the following:

• Secure operation of the website.
• Session management and authentication.
• Security and unauthorised access prevention mechanisms.
• Remembering cookie preferences.
• Performing the basic functions requested by the user.

These cookies may be used without explicit consent where an applicable and appropriate legal condition for processing exists for their purposes of use.

The fact that a cookie is technically useful or improves site performance does not by itself make it a strictly necessary cookie.

3.2. Functional Cookies

Functional cookies may be used to remember non-essential user preferences and to improve the website experience.

These cookies may be used for purposes such as:

• Storing language preferences,
• Remembering interface preferences,
• Preserving the display settings selected by the user,
• Providing non-essential personalisation functions.

Functional cookies that require explicit consent are not activated without the prior valid consent of the relevant visitor.

3.3. Performance and Analytics Cookies

Analytics cookies may be used to understand how visitors use the website and to evaluate the performance of the website.

In this context, the following information may be processed:

• Pages visited.
• Date and time of the visit.
• Transitions between pages.
• Duration of the visit.
• Interaction and click events.
• Browser, device and operating system information.
• Information on the traffic source.
• Technical error and performance information.

Information obtained through analytics cookies may constitute personal data where the person is identifiable, even if it does not directly contain identity information.

Analytics cookies that require explicit consent are activated when the visitor gives prior approval through an affirmative action.

3.4. Advertising and Marketing Cookies

Advertising and marketing cookies, where used, may serve to evaluate the performance of advertising campaigns or to associate visitor interactions with advertising activities.

These cookies may be used for the following purposes:

• Measuring site visits originating from advertisements.
• Evaluating the performance of campaign links.
• Analysing advertising conversions.
• Measuring the effectiveness of campaigns.
• Ad targeting and remarketing operations, under appropriate conditions.

These cookies may be linked to third-party advertising and measurement services.

Where explicit consent is required for advertising or marketing cookies, the relevant cookies are not run without the visitor's prior approval.

Visitors are not deprived of the basic functions of the website because they reject advertising and marketing cookies.

4. Classification of Cookies by Duration and Source

In terms of their duration of use, cookies can be considered in two main groups.

Session cookies are cookies that are used during the browser session and are generally deleted when the session ends.

Persistent cookies are cookies that are stored on the device for a specified period or that may remain valid until deleted by the user.

Cookies can also be classified according to their source.

First-party cookies are cookies placed by the website visited.

Third-party cookies are cookies placed in connection with domain names or service providers other than the website visited.

The fact that a cookie is a first-party cookie does not mean that it is necessary or that it does not require explicit consent.

5. Personal Data That May Be Processed Through Cookies

Depending on the cookies and similar technologies enabled on the website, the following categories of data may be processed:

• IP address.
• Browser and device information.
• Operating system information.
• Session identifiers.
• Cookie and other technical identifiers.
• Pages visited.
• Page view and interaction records.
• Time and duration of the visit.
• Traffic source and referral information.
• Cookie consent and preference records.
• Security and technical error records.

Not all of this data may be processed for every visitor or in every circumstance.

The scope of the data processed may vary according to the technologies enabled and the preferences of the relevant visitor.

6. Purposes of Processing Personal Data

Personal data obtained through cookies may be processed for the following purposes, depending on the relevant cookie category:

• Ensuring the security and basic functions of the website.
• Managing session and access operations.
• Remembering user preferences.
• Evaluating the technical performance of the website.
• Analysing visitor interactions.
• Improving the user experience and the usability of the site.
• Measuring marketing campaigns where the legal conditions are met.
• Preventing security breaches and misuse.
• Fulfilling the relevant legal obligations.

Personal data is processed only for specified, explicit and legitimate purposes, in a manner that is relevant, limited and proportionate to the purpose of processing.

7. Method of Collection and Legal Grounds for Processing Personal Data

Personal data processed through cookies may be collected by automated means in an electronic environment when the visitor accesses the website and interacts with the relevant technologies.

Personal data processing activities are based on the appropriate legal conditions for processing set out in Article 5 of the KVKK, depending on the nature of the specific operation.

7.1. Legitimate Interest

Within the scope of ensuring the security of the website, preventing unauthorised access and carrying out basic technical functions, operations required by the legitimate interest of the data controller may be carried out, provided that they do not harm the fundamental rights and freedoms of the data subject.

7.2. Legal Obligation

Records and operations required by legislation may be carried out so that the data controller can fulfil its legal obligations.

7.3. Explicit Consent

In relation to analytics, functional or advertising cookies that require explicit consent, personal data may be processed on the basis of the visitor's explicit consent, which relates to a specific matter, is based on information and is given of the visitor's own free will.

The mere fact that the visitor browses the website, scrolls a page or continues to use the site does not constitute explicit consent.

The legal ground for each data processing activity is assessed separately, taking into account the relevant purpose and the nature of the technology.

8. Cookie Preferences and Explicit Consent Management

Where Paylisher uses cookies that require explicit consent, it provides a mechanism through which visitors can manage their preferences regarding these cookies.

Through this mechanism, visitors can:

• Accept all non-essential cookies.
• Reject all non-essential cookies.
• Set separate preferences for cookie categories.
• Withdraw the explicit consent they have previously given.

Cookie categories that require explicit consent are kept switched off by default until the visitor gives approval.

As a rule, the options to accept and to reject cookies are equally accessible.

Approval given for one cookie category does not mean that approval is automatically given for other cookie categories.

The withdrawal of explicit consent does not in itself invalidate the lawful operations carried out on the basis of that consent before the withdrawal.

Cookie preferences can be changed through the preference management tool offered on the website.

9. Managing Cookies Through the Browser

Visitors can also manage cookies through the settings of the browsers they use.

Depending on the options offered by the browser:

• Existing cookies can be viewed.
• Stored cookies can be deleted.
• Third-party cookies can be blocked.
• The saving of new cookies can be restricted.
• Specific preferences can be set for particular sites.

Blocking cookies may affect some functions of the website.

Changing browser settings may not result in the automatic deletion of personal data previously transferred to third parties.

10. Third-Party Cookies and Service Providers

On the Paylisher website, the technologies of third-party service providers may be used, depending on the technical infrastructure in use and the integrations enabled.

These services may be related to purposes such as:

• Website hosting and security,
• Traffic and performance analysis,
• Form and communication services,
• Advertising performance measurement,
• Other technical integrations.

The role of third-party service providers in data processing activities is assessed according to the nature of the service provided and which party determines the purposes of data processing.

Paylisher is obliged to ensure that third-party data transfers carried out under its own responsibility as data controller comply with the relevant legal conditions.

Where third-party cookies are present, the names, providers, purposes and retention periods of the relevant cookies are described in this Policy.

11. Transfer of Personal Data Abroad

Where personal data obtained through cookies or similar technologies is to be transferred to service providers located abroad, the conditions in Article 9 of the KVKK apply.

Data transfers abroad are carried out on the basis of the legal mechanisms appropriate to the specific transfer activity.

These mechanisms may include, where applicable, an adequacy decision, appropriate safeguards or the exceptional transfer cases specified in the law.

Access to data from abroad, the use of infrastructure located abroad and data sharing carried out through third-party tracking technologies are assessed separately.

Where a transfer abroad takes place, the relevant information obligations are fulfilled.

12. Retention Periods of Cookies

The retention periods of cookies may vary according to their purposes of use, their technical characteristics and the relevant legal requirements.

Session cookies may be deleted when the relevant session ends.

Persistent cookies, on the other hand, may remain on the device until the specified expiry date or until they are deleted by the data subject.

The period for which personal data obtained through cookies is stored on the server side may differ from the lifetime of the cookie on the device.

Personal data is retained only for the period required by the purposes of processing or for the periods provided for in the legislation.

When the retention period expires or the conditions for data processing cease to exist, the relevant personal data is erased, destroyed or anonymised in accordance with the applicable legislation.

13. Paylisher SDK and Customer Applications

Paylisher may provide its corporate customers with mobile application analytics, web analytics, user engagement, campaign management and advertising measurement technologies.

These technologies may be used on customers' own websites or mobile applications through SDK, API and similar integrations.

The relevant customer acts as data controller where it determines the purposes and essential means of processing personal data.

Paylisher, in turn, may act as data processor within the framework of the customer's instructions.

With regard to cookies, technical identifiers and similar tracking technologies used in customer applications, the following matters are assessed according to the legal roles of the relevant parties:

• Information (privacy notice) obligations,
• Determining the legal grounds for processing,
• Obtaining the necessary user permissions,
• Determining retention periods,
• Managing end-user rights requests.

This Policy describes the cookie practices carried out on Paylisher's own website and does not replace the independent cookie policies of corporate customers.

14. Rights of Data Subjects

Pursuant to Article 11 of the KVKK, and subject to the statutory conditions and exceptions, data subjects have the following rights:

1. To learn whether their personal data is processed.
2. To request information where their personal data has been processed.
3. To learn the purpose of processing and whether the data is used in accordance with that purpose.
4. To know the third parties to whom personal data is transferred, within the country or abroad.
5. To request the rectification of incomplete or inaccurately processed data.
6. To request erasure or destruction within the scope of the statutory conditions.
7. To request that rectification, erasure or destruction operations be notified to the third parties to whom the data has been transferred.
8. To object to a result that is to the person's detriment arising from analysis carried out exclusively by automated systems.
9. To claim compensation for damage arising from unlawful data processing.

To exercise these rights, you may apply to Paylisher in accordance with Article 13 of the KVKK and the relevant application procedures.

Applications are concluded as soon as possible and within thirty days at the latest, depending on the nature of the request.

As a rule, applications are free of charge. Where the operation entails an additional cost, the fees in the tariff set by the Personal Data Protection Board may be charged.

15. Policy Updates

Paylisher may update this Policy in line with changes in legislation, technological developments or changes in the cookies and similar technologies used on the website.

The updated Policy is published on the website with the date of the last update indicated.

The use of a new cookie or tracking technology does not begin before the necessary legal assessments and explicit consent processes have been completed.

Where the legislation requires a new notice or explicit consent, the relevant steps are taken.

16. Contact

You can contact Paylisher at the address below regarding the Cookie Policy, the protection of personal data or data subject applications.

The official application methods to be used for personal data applications are subject to the KVKK and the relevant legislation.