Explicit Consent Statement.

• Effective date: 5 October 2026.
• Data controller: Mustafa Eren KOÇ (natural person).
• Contact / requests: kvkk@klaris.com.tr · klaris.com.tr

This Explicit Consent Statement has been prepared under Law No. 6698 on the Protection of Personal Data (KVKK) to obtain your explicit consent only for the following optional matters, which are not part of the app's core service:

• (a) The optional monthly selfie + skin diary feature; and
• (b) Optional push notifications; and
• (c) The allergens, pregnancy information and fragrance sensitivity you choose to add to your profile; and
• (d) Optional commercial electronic communications / marketing communications (newsletters, useful content and Klaris's own campaign/promotional messages).

Before reading or approving this statement, you can find full details about the processing of your personal data in the Privacy Notice. Consent given in this statement does not replace our duty to inform you; it supplements it.

Important: the core service does not depend on this consent. Klaris is primarily an app offering a cosmetic product compatibility / decision-support service based on scientific sources. Even if you give none of the consents in this statement, you can continue to use all of the app's core features in full, including barcode scanning, personalised compatibility assessment, your account and your skin/hair profile. Choosing not to use the features below (skipping them / choosing "Later") will in no way affect basic use of the app, reduce service quality or result in any disadvantage to you.

Klaris gives you the option to take a monthly selfie and keep a skin diary (notes, observations, products you use, etc.) for your own cosmetic tracking.

• It is entirely your choice and can always be skipped ("Take Later" / "Skip").
• Selfie and skin diary data are processed only for your own personal cosmetic tracking, so that you can observe changes in the appearance of your skin/hair over time with your own eyes.
• These data are not used for medical diagnosis or treatment, do not replace a dermatologist, and no biometric identification of a person is performed using the selfie; the image is only for your personal tracking.
• Consent is given through your action (consent-by-action): taking the optional selfie and/or creating a skin diary entry means that you give explicit consent to this processing. Skipping this step means you do not consent and has no adverse consequences.

Purpose of processing: personal cosmetic tracking and your own observation of changes in your skin/hair appearance.

Legal ground: KVKK Article 5/1, explicit consent.

Retention: your data are retained until you expressly request deletion; your request through kvkk@klaris.com.tr or in-app account/data deletion will be fulfilled within 30 days at the latest.

Hosting: your selfie and skin diary data are stored on servers in Türkiye. Cloudflare hosting for the separate web newsletter process does not cover this data set and is explained in the newsletter section below.

To send you push notifications about updates, reminders and features, a notification token (device token) belonging to your device is processed.

• Push notifications are optional, and your explicit consent is obtained when you read and approve a separate explanation within the app. This approval comes before the device's own permission prompt and is separate from it.
• If you select "Don't Allow" in the device permission prompt, no notifications will be sent to you. On iOS, in this case your device token is never processed; on Android, a device record may be created after your in-app consent has been recorded, but no notification is displayed without permission. Your in-app approval is only a record of your consent for the purpose; you may withdraw it at any time, and the device record is deleted when you do so.
• On iOS, if permission has previously been permanently denied, your explicit consent is never recorded. In this case, Klaris cannot open the system prompt itself; the in-app explanation that makes consent informed has no function in this branch and would leave nothing but a record that could never be used. You can give consent again after enabling permission in your device settings.
• When you withdraw consent, your device notification record is deleted; it is not merely silenced with a flag.
• The notification payload never contains your name, personal data or product formula/analysis information; the payload consists of the technical identifier that enables the device to receive the notification, along with the notification title and short text, and is transmitted through Apple or Google's notification infrastructure.

Purpose of processing: to send you push notifications.

Legal ground: KVKK Article 5/1, explicit consent.

Transfers abroad: because of the notification infrastructure (Apple Push Notification service on iOS and Google Firebase Cloud Messaging on Android), your limited technical identifiers (device token) may be transferred to secure servers abroad. This transfer is considered under KVKK Article 9 as a requirement of the contractual process initiated by the user. The notification title and short text, which contain no personal data, are also transmitted through the same infrastructure. No name, personal data or formula/analysis information is transferred.

When creating your skin/hair profile, you can leave the allergen, pregnancy and fragrance sensitivity fields blank. In the Klaris product contract, these are optional profile preferences that do not produce a medical diagnosis or health assessment and only personalise cosmetic product notes. If you choose to share any of these fields, the app asks for your separate explicit consent to this specific processing before saving them.

• All these fields are optional; leaving them blank does not prevent you from using barcode scanning, the general Klaris Score or the basic skin/hair axes of your profile.
• The values you share are used only to refine product notes according to your profile; they are not used for medical diagnosis or treatment.
• When you withdraw explicit consent, these optional profile additions are deleted from your account; you can continue to use your basic skin/hair profile and general product assessments.

Purpose of processing: to personalise the product notes offered according to your profile, using the preferences and circumstances you choose to share.

Legal ground: KVKK Article 5/1, explicit consent. Unless these fields are selected, no consent checkbox is displayed and no optional profile addition is submitted.

Retention and withdrawal: you can remove these fields from the Profile screen or withdraw your explicit consent. Withdrawal initiates deletion of the optional profile additions from the server.

If you provide Klaris with your email address, you may give this consent optionally to allow us to send you messages about Klaris's own products and services. This consent is independent of and separate from the consents above; it is given separately and withdrawn separately.

• Scope: if you give this consent, you agree to receive all types of communication by email, including newsletters, informative and educational content, announcements of new features and services, surveys and satisfaction studies, and commercial electronic communications containing campaigns, discounts, promotions and advertising relating to Klaris's own products and services.
• These are only Klaris's own communications; your email address is not sold or transferred to third parties for advertising/marketing purposes.
• It is entirely optional; no feature of the app depends on this consent, and not consenting will not result in any disadvantage to you.
• Signing in to the app is not marketing consent: the email address received from the provider when you create your account (the address you share through Sign in with Apple or that Apple generates on your behalf on iOS, or your Google account address on Android) does not, on its own, replace this consent and is not used to send commercial electronic communications unless you separately give the consent in this section.
• You may opt out at any time, without giving a reason and free of charge. You can send requests relating to in-app permissions to kvkk@klaris.com.tr. The channel for unsubscribing from the web newsletter is explained separately below; messages stop being sent when you opt out.
• Recording consent and refusal: before Klaris starts sending commercial communications, it records your consent and refusal within the applicable period. No commercial communications are sent before this recording process is ready.

Purpose of processing: to communicate with you and send newsletters, useful content and Klaris's own promotional/campaign messages within the scope of your consent.

Legal ground: KVKK Article 5/1, explicit consent. Web newsletter registration requires separate subscription consent. Details of Cloudflare-based storage and possible processing abroad are explained in the Newsletter Privacy Notice.

Separate scope for the web newsletter. The Klaris Newsletter contains informative content, selections from the Academy and Klaris updates. No more than two emails are sent each month. The separate subscription consent in the web form covers only this newsletter; it does not replace other permissions in the app. To unsubscribe, you can write to info@klaris.com.tr. Newsletter delivery will stop upon your request.

• The explicit consent you give through this statement is limited solely to the processing activities expressly specified in sections 1.1, 1.2 and, if given, 1.3 and 1.4 above.
• The app's core service (account, skin/hair onboarding profile, barcode scanning, personalised compatibility assessment) is necessary for the performance of a contract and therefore relies on the legal ground of KVKK Article 5/2-c and does not depend on this explicit consent. Not giving or withdrawing this consent therefore does not prevent you from using the core service.

You may withdraw the explicit consent you have given at any time, without giving a reason and free of charge. You may withdraw your consent in the following ways:

• Within the app: by removing the relevant data (for example, deleting your selfie/skin diary entries or optional profile additions) or using the in-app account/data deletion option; and/or
• By email: by sending your request to kvkk@klaris.com.tr.

If you withdraw your consent, the relevant processing activity stops from the moment we receive your withdrawal request, and your personal data within the scope of the withdrawal are deleted, destroyed or anonymised within 30 days at the latest. Withdrawal of consent does not affect processing lawfully carried out before the withdrawal date. Withdrawing consent does not affect your ability to use the app's core services.

Under Article 11 of the KVKK, you have the following rights by applying to the data controller:

• a) To learn whether your personal data are processed;
• b) To request information if they have been processed;
• c) To learn the purpose of processing and whether they are used in accordance with that purpose;
• ç) To know the third parties to whom data are transferred within Türkiye or abroad;
• d) To request correction if they have been processed incompletely or incorrectly;
• e) To request deletion or destruction if the reasons for processing cease to exist;
• f) To request that correction, deletion and destruction be notified to third parties to whom the data have been transferred;
• g) To object to a result against you arising from the analysis of processed data exclusively through automated systems;
• ğ) To request compensation if you suffer damage due to unlawful processing of your personal data.

You can send requests relating to these rights to kvkk@klaris.com.tr. Depending on their nature, your requests will be concluded free of charge within 30 days at the latest.

I have read and understood the explanations above. For the relevant personal tracking and profile notes, I give explicit consent to the processing of the information I choose to share through the optional selfie + skin diary feature and my allergen, pregnancy and fragrance sensitivity information; and to the processing of my device notification token to send push notifications, based on my explicit consent. I understand that notification consent is separate from the device's notification permission and that, even if I do not grant permission, I may withdraw this consent at any time, free of charge, within the app or via kvkk@klaris.com.tr. With this understanding, I give my explicit consent of my own free will.

I understand that not using (skipping) any of these features or withdrawing my consent will not affect my ability to use the app's core services.

This statement may be updated at any time; the current version is always published at klaris.com.tr.