Identity of the Data Controller

Data Controller: LIQAVO Legal title: Kartal Mesuthan Demyen Tax ID: 2900601530 Address: İsmet İnönü Mah. 2062 Sok. Çeşme/İzmir E-mail (KVKK and legal): legal@liqavo.com E-mail (support): support@liqavo.com As an intermediary digital platform between venues, event organisers and transfer companies on the one hand and end users on the other, LIQAVO qualifies as a "data controller" within the meaning of Article 3(1)(ı) of the KVKK.

Categories of Personal Data Processed

Within the scope of the services it provides, LIQAVO processes the following categories of data: - Identity data: first name, last name, date of birth, gender and, for LIQAVO Drive trips, the Turkish ID or passport number provided. - Contact data: e-mail address, phone number (in E.164 format, stored encrypted), invoicing and delivery address. - Customer transaction data: reservation records, payment notifications, refund operations, invoice information, refund IBAN (encrypted). - Transaction security data: IP address, device information, session logs, misuse pattern records (for rate-limit, cooldown and strike protection). - Location data: only for LIQAVO Drive, the pickup and dropoff coordinates. - Visual and audio data: optional profile photo. - Marketing data: notification and campaign preferences for users who have given explicit consent. - Account management: language preference, notification settings, in-app preferences.

Purposes of Processing

Your personal data is processed for the following purposes: - Creating your membership account and managing the account, - Enforcing the 18+ age requirement, - Receiving and confirming venue, event and transfer reservations and forwarding them to the relevant service provider, - Tracking IBAN bank-transfer deposit payments and handling refund operations, - Issuing e-archive invoices and fulfilling accounting and tax obligations, - Providing customer support, managing complaints and disputes, - Ensuring app security and detecting and preventing fraud, automated bots, misuse and threats to account security, - Verifying passenger identity and matching driver and passenger within the scope of LIQAVO Drive, - Improving the service, enhancing user experience and performing statistical analysis, - Carrying out marketing, campaign and notification activities, provided that explicit consent has been obtained, - Responding to lawful requests of authorised bodies and fulfilling obligations arising from legislation.

Legal Grounds for Processing

Your personal data is processed in reliance on the following legal grounds set out in Articles 5 and 6 of the KVKK: - Where processing is directly related to the establishment or performance of a contract (Article 5(2)(c) of the KVKK): membership, reservation, payment notifications, provision of the transfer service and refund processes, - Fulfilment of a legal obligation (Article 5(2)(ç) of the KVKK): retention, invoicing and reporting obligations under the Turkish Tax Procedure Law, Turkish Commercial Code, Law No. 6502 and the KVKK, - Establishment, exercise or protection of a right (Article 5(2)(e) of the KVKK): managing complaints, disputes and legal processes, - The legitimate interests of the data controller (Article 5(2)(f) of the KVKK): app security, fraud prevention, protection mechanisms and measuring service quality, - Explicit consent (Article 5(1) of the KVKK): marketing notifications, sharing of LIQAVO Drive passenger identity (transfer_passenger_data), location sharing (transfer_location_share) and analytics cookies on the site.

Transfer of Personal Data

Your personal data is only shared with the parties listed below, to the extent necessary and pursuant to Article 8 of the KVKK: - Venue partners: When you make a venue reservation, your first and last name, party size, reservation date and time, any note, payment status and invoice information are shared for the purpose of fulfilling the reservation. - Transfer companies (LIQAVO Drive): The passenger's full name, phone number, pickup and dropoff locations and the journey QR code are transferred to the relevant transfer company and the assigned driver, in order for the transfer to be carried out. - Hotel partners (coupon system): The hotel partner only sees anonymous aggregate statistics (total number of code uses, total commission earned). The identity of the user who used the coupon, the venue where it was used, or the amount, is in no case transmitted to the hotel. - Legal authorities: Transfers may be made within legal limits to the extent of the authorised requests of judicial, administrative and regulatory bodies. - Service providers (operational): Information may be shared with data processors providing supporting services such as cloud infrastructure, e-archive invoice services, e-mail delivery infrastructure and customer support tools, subject to confidentiality agreements. - Site analytics services: On liqavo.com, cookie-based data is processed via Google Analytics, Microsoft Clarity and Vercel Analytics only if you have given consent to the analytics cookie category. Payment process: As LIQAVO does not use a third-party payment service provider and all payment and refund operations take place via IBAN bank transfer directly between the BUYER and the venue partner, no card or payment data passes through LIQAVO systems and no transfer is made to a payment counterparty.

Transfer of Personal Data Abroad

LIQAVO may use certain service providers (such as Vercel Inc., Google LLC, Microsoft Corporation and Cloudflare Inc.) that have servers abroad for cloud hosting, analytics and security services. In this context, pursuant to Article 9 of the KVKK, your personal data may be transferred abroad, subject to the privacy and data protection commitments of the relevant providers and within the framework of encrypted and secure transfer protocols. Transfers abroad are only carried out where you have given explicit consent for the transfer or where one of the other legal conditions set out in Article 9 of the KVKK applies. You may withdraw the relevant consents at any time from the account settings and the cookie preferences panel on the site.

Retention Periods

Your personal data is retained for as long as the purpose of processing requires, or as long as the statutory retention obligation prescribes. - Membership data: for as long as the account is active. When the account is deleted, data not subject to a statutory retention obligation is deleted or anonymised within no later than 30 days. - Financial records (reservation and invoice): 5 years pursuant to the Turkish Tax Procedure Law, 10 years pursuant to the Turkish Commercial Code. - Support correspondence: 3 years from the closure of the request. - LIQAVO Drive location data: anonymised after the journey is completed or deleted within 1 year. - Log, IP and session records: a maximum of 2 years for security purposes. - Encrypted data (refund IBAN, passenger identity, phone): deleted after the relevant service is closed or the account is deleted, once the statutory retention period has expired.

Rights of the Data Subject (Article 11 of the KVKK)

Pursuant to Article 11 of the KVKK, as a data subject you have the following rights: - To learn whether your personal data is processed, - If it has been processed, to request information about it, - To learn the purpose of processing and whether the data is used in line with that purpose, - To know the third parties to whom your data has been transferred, in Turkey or abroad, - To request correction if your data has been processed incompletely or incorrectly, - To request deletion or destruction of your data within the framework of the conditions set out in Article 7 of the KVKK, - To request that correction, deletion or destruction be notified to the third parties to whom the data has been transferred, - To object to a result arising against you from analysis carried out exclusively by automated systems, - To claim compensation if you suffer loss as a result of the unlawful processing of your personal data.

Application Procedure

You may submit your requests regarding your rights as a data subject by one of the following methods, in accordance with the Communiqué on the Procedures and Principles for Application to the Data Controller: - In writing: with a wet-signed petition delivered to İsmet İnönü Mah. 2062 Sok. Çeşme/İzmir, - By e-mail: from your registered e-mail account to legal@liqavo.com, - Via the in-app support channel: from Account > Help and Support. Your application must clearly state your first and last name, Turkish ID number (or passport or identity number if you are a foreign national), residence or business address for service, e-mail address, phone number and the subject of the request. LIQAVO will conclude your application free of charge within no later than 30 days, depending on its nature. However, if the transaction requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.

Recruitment and Job Applications

LIQAVO processes the following personal data within the scope of applications made to open positions via liqavo.com/kariyer: - Identity data: First and last name. - Contact data: E-mail address, phone number, city of residence. - Resume and qualification data: CV file, motivation statements, education and work experience, LinkedIn and portfolio links. - Process data: Application date, application status, internal evaluation notes (if any), salary expectation and preferred start date. Processing purposes: - Evaluating candidates for the relevant open position and conducting interview processes, - Communicating with the candidate and providing information on the process, - Reaching a hiring decision and preparing the employment contract, - Subject to the candidate's explicit consent, retaining the application in a talent pool for similar future positions. Legal basis: The candidate's explicit statement on the application form that they have read this Disclosure Notice and consent to the processing of their data in the recruitment process (KVKK Article 5(1) explicit consent); and direct relevance to the establishment or performance of a contract (KVKK Article 5(2)(c)). Transfer: Candidate data is not shared with third parties other than the LIQAVO internal teams running recruitment and interviews. Transfer abroad pursuant to KVKK Article 9 may take place via cloud infrastructure providers (including the object storage service where the CV file is stored). Retention periods: - Hired candidates: Throughout the employment relationship and afterwards within the framework of statutory retention obligations, - Non-hired candidates: For a maximum of 2 years from the conclusion of the application. After this period, CVs and application records are deleted or anonymised. - Talent pool retention: Only if explicit consent has been given, for a maximum of 2 years. Exercising candidate rights: Candidates may exercise their rights under KVKK Article 11 (access, correction, deletion, objection to processing, etc.) by applying to legal@liqavo.com. Consent may be withdrawn at any time; upon withdrawal, application records are deleted.

Contact

For all questions, requests and applications under the KVKK: E-mail (KVKK and legal): legal@liqavo.com E-mail (support): support@liqavo.com In-app support: Account > Help and Support Data controller legal information: Legal title: Kartal Mesuthan Demyen Tax ID: 2900601530 Address: İsmet İnönü Mah. 2062 Sok. Çeşme/İzmir