Data Subject Request Form Under the KVKK.

Article 11 of Law No. 6698 on the Protection of Personal Data ("KVKK" or the "Law") grants various rights to natural persons whose personal data are processed ("data subjects"). Under Article 13 of the same Law, you have the right to submit requests concerning these rights to the data controller.

The data controller for the Klaris app is not a legal entity (company), but Mustafa Eren KOÇ, an individual entrepreneur acting as a natural person. The data controller processes your personal data only for the stated purposes, lawfully and on servers located in Türkiye.

This form has been prepared to make it easier for you to apply to the data controller to exercise your rights under Article 11 of the KVKK. Using this form is not mandatory; you may also submit a written request clearly stating your identity and the subject of your request. Completing this form in full, however, helps your request to be concluded more quickly and accurately.

Under KVKK Article 13/2, the data controller will conclude your request free of charge as soon as possible depending on its nature, and in any event within thirty (30) days at the latest from the date it reaches the data controller. If the process incurs an additional cost, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board.

Effective date: 5 October 2026. Version: 1.3.

• Data controller: Mustafa Eren KOÇ (natural person / individual entrepreneur).
• App / service: Klaris, Cosmetic Decision-Support App.
• Request / contact channel (KVKK): kvkk@klaris.com.tr.
• Website: klaris.com.tr.
• Data hosting: mobile app data are stored on servers located in Türkiye. In the separate web newsletter process, email/consent records may also be processed outside Türkiye on the globally distributed Cloudflare Workers KV; this distinction is explained in the Newsletter Privacy Notice.

All data subject applications and KVKK requests must be sent to kvkk@klaris.com.tr. You can also create an account deletion request within the app.

The following information must be provided in full so that your application can be assessed and your identity verified.

• First and last name: the applicant's first and last name.
• Turkish Republic identity number: passport number / foreign national identity number for foreign nationals.
• Email address linked to your Klaris account: the email address used to create your account.
• Email address for correspondence: the address to which the response will be sent.
• Telephone number: optional.
• Username / profile you use in the Klaris app: if any.

Your relationship with the data controller (please specify the option that applies to you):

• Registered user: I am a registered user of the Klaris app (I used Sign in with Apple on iOS or Sign in with Google on Android).
• Former / deleted account: I am the holder of a former or deleted account.
• Third party: I have another relationship with the data controller (please explain).

Under Article 11 of the KVKK, you may exercise the following rights concerning your personal data by applying to the data controller. Please specify the right(s) you wish to exercise and, where possible, give specific details of your request in the explanation field.

• 1: Learning whether data are processed: I wish to learn whether my personal data are processed.
• 2: Request for information: if my personal data have been processed, I request information about this.
• 3: Purpose: I wish to learn the purpose of processing my personal data and whether they are used in accordance with that purpose.
• 4: Transfers: I wish to learn the third parties to whom my personal data are transferred within Türkiye or abroad.
• 5: Correction: I request correction of my personal data if they have been processed incompletely or incorrectly.
• 6: Deletion: I request deletion or destruction of my personal data under the conditions set out in KVKK Article 7.
• 7: Notification: I request that actions taken under (5) and (6) be notified to third parties to whom my personal data have been transferred.
• 8: Objection to automated analysis: I object to a result against me arising from the analysis of my processed data exclusively through automated systems.
• 9: Compensation for damage: I request compensation if I suffer damage due to unlawful processing of my personal data.

Note. Klaris relies on explicit consent for the optional (skippable) selfie + skin diary and push notification features. You have the right to withdraw your explicit consent at any time for these features. You may also submit your withdrawal request through this form. When consent is withdrawn, the core service, barcode scanning and compatibility assessment, continues to operate under the performance of a contract.

Explanation / details of your request. Please make your request as specific as possible; for example, explain which data, date range or feature it concerns.

The data controller will respond to your application electronically (by email). The response will be sent to the email address for correspondence specified by the applicant; if no such address is given, it will be sent to the email address from which you submitted your application.

The data controller does not have a published postal/address-for-service address, and all KVKK correspondence is conducted electronically via kvkk@klaris.com.tr. If you want your response in writing/by physical post, state this in the explanation field for the subject of your request; the data controller will consider such a request to the extent possible and in communication with you.

Under the KVKK and the Communiqué on the Procedures and Principles for Applications to the Data Controller, the data controller must verify that the applicant is indeed the data subject. This is a security measure for your benefit, to prevent disclosure of your personal data to unauthorised persons.

For this reason:

• Application channel: your application must be made from the email address linked to your Klaris account or with information that verifies your identity.
• Additional information/documents: the data controller may request additional information or documents (for example, confirmation of information linked to your account or identity-verification questions) to verify your identity beyond reasonable doubt.
• Failure to verify: if your identity cannot be verified, the data controller may not conclude the application in order to protect your personal data; in this case, you will be informed of the reason.
• Minimum information: please do not send a full copy of your identity document or all your sensitive information; the data controller will request only the minimum information necessary for identity verification.

You may submit your application through the following channels:

• Email (recommended and primary channel): complete this form or write your request clearly and send it to kvkk@klaris.com.tr.
• In the app: for an account deletion request, you can use the "Delete My Account" (Hesabımı Sil) feature in the Klaris app; this option is provided as required by both KVKK Article 11 and the Apple App Store and Google Play. Step-by-step instructions are on the account deletion page.

Your application will be concluded within 30 days at the latest from the time it reaches the data controller.

I acknowledge and declare that the information I have provided in this form is accurate and up to date; that the request concerns my own personal data; that, if I am applying on another person's behalf, I will provide evidence of my authority (power of attorney, etc.); and that I am responsible for any consequences arising if I provide incomplete or incorrect information.

• Applicant's first and last name: the applicant's first and last name.
• Application date: day / month / year.
• Signature: for written applications.

If your application is rejected, you find the response insufficient or no response is given within the prescribed period, you retain the right to lodge a complaint with the Personal Data Protection Board within thirty (30) days from learning of the response and, in any event, within sixty (60) days from the application date (KVKK Article 14).

This form has been prepared to help data subjects exercise their rights under the KVKK and does not constitute legal advice.