IRISLAND PERSONAL DATA PROCESSING INFORMATION NOTICE

1. Data Controller

Within the scope of Turkish Personal Data Protection Law No. 6698 (“KVKK”), your personal data is processed by the following entity acting as the Data Controller:

IRISLAND BÜYÜKADA
Tax No.: 27772910948
Address: Mimarsinan Mah. Atatürk Blv. No:1 Atakum / Samsun, Türkiye
Phone: +90 507 645 55 34
E-mail: irisland.info@gmail.com
Website: www.irislandtr.com

This Information Notice has been prepared for customers who have iris/eye photographs taken at IRISLAND stores or service points, place orders, purchase products, place repeat orders, use our website or benefit from after-sales services.

2. Personal Data We Process

Depending on the nature of the service provided, the following personal data may be processed:

• Name and surname,

• Telephone number and e-mail address,

• Billing and delivery address,

• Order, product, model, size, colour and personalisation information,

• Payment and invoicing information,

• Delivery and shipping information,

• Customer requests, complaints and after-sales support records,

• Iris/eye photographs,

• Artistic designs and production files created from iris/eye photographs,

• Photographs, videos and similar visual content voluntarily provided by the customer,

• Information relating to customer interactions with IRISLAND through telephone, WhatsApp, e-mail, the website or other communication channels.

3. Purposes of Processing Personal Data

Your personal data may be processed for the following purposes:

• Creating customer and order records,

• Performing iris/eye photography,

• Creating personalised designs from iris images,

• Preparing and producing personalised rings, necklaces, bracelets, earrings, wall art and other products,

• Carrying out payment and invoicing procedures,

• Delivering products,

• Communicating with customers regarding their orders,

• Carrying out warranty, correction, reproduction and after-sales support procedures,

• Enabling customers who provide separate explicit consent to place repeat orders in the future without having a new iris photograph taken,

• Using iris designs, photographs or videos in advertising and promotional activities where the customer has separately provided explicit consent,

• Fulfilling legal and financial obligations,

• Establishing, exercising or protecting legal rights.

4. Use of Iris/Eye Images

As part of the IRISLAND service, an iris/eye photograph of the customer is taken and converted into a personalised artistic iris design.

Iris/eye images are primarily used to design, prepare and manufacture the product ordered by the customer.

The use of iris/eye images for advertising, social media, website content, campaigns or promotional activities is not a mandatory condition for placing an order.

Such use will only take place if the customer voluntarily selects the separate explicit consent option provided below.

5. Storage Within the Two-Year Warranty Period

IRISLAND products are covered by a 2 (two) year warranty.

Iris/eye images and related design files may be retained, to the extent necessary, for a maximum period of 2 (two) years for the purpose of preparing and delivering the order and handling possible errors, corrections, reproduction requirements or other after-sales requests that may arise during the warranty period.

Iris/eye images retained for this purpose will only be used for order fulfilment, warranty and after-sales services.

6. Storage for Up to Five Years for Repeat Orders

Customers may wish to place new orders at a later date using their previously captured iris/eye image without having another iris photograph taken.

Where the customer selects the separate explicit consent option below, the iris/eye image and the design file created from that image may be retained for the purpose of repeat orders for a maximum period of 5 (five) years from the date of the iris photograph.

This use is entirely optional.

Refusing to provide explicit consent for five-year storage for repeat orders will not prevent the customer from placing an order, receiving IRISLAND services or benefiting from the 2-year product warranty.

The customer may withdraw this explicit consent at any time.

Upon withdrawal of consent, processing for repeat-order purposes will cease, without prejudice to any data that must continue to be retained for warranty purposes or on another valid legal basis.

At the end of the maximum five-year period, where there is no other legal basis requiring retention, the relevant iris/eye images will be deleted or destroyed.

7. Storage Environment

Iris/eye images and related design files are stored electronically on Google Drive, with access restricted to persons authorised to perform the relevant business operations.

Access is limited to persons who require the data for order processing, design, production, warranty, after-sales support and, where the customer has separately provided explicit consent, repeat-order procedures.

Appropriate technical and administrative measures are taken to prevent unauthorised access, misuse, alteration or disclosure of personal data.

Where the use of Google Drive infrastructure results in the transfer of personal data abroad, such transfers will be handled in accordance with the provisions of KVKK concerning international transfers of personal data.

8. Methods of Collecting Personal Data

Your personal data may be collected through:

• Iris/eye photography performed at a store or service point,

• Order procedures,

• Our website,

• Telephone,

• WhatsApp,

• E-mail,

• Payment and invoicing procedures,

• Shipping and delivery procedures,

• Warranty and after-sales support processes.

Personal data may be processed by fully or partially automated means or by non-automated means provided that such processing forms part of a data filing system.

9. Legal Grounds for Processing Personal Data

Identity, contact, order and other personal data necessary for receiving, preparing, producing and delivering an order may be processed on the legal basis that such processing is directly related to the establishment or performance of a contract, as provided under KVKK.

Invoice, accounting and other records required by applicable legislation may be processed where such processing is necessary for the Data Controller to fulfil its legal obligations.

Personal data required for warranty procedures and potential disputes may, where the relevant conditions are satisfied, be processed where processing is necessary for the establishment, exercise or protection of a legal right.

Storage of an iris/eye image for up to 5 years solely for the convenience of placing future repeat orders, beyond the existing order and warranty processes, is based on the customer's separate explicit consent for that specific purpose.

The use of iris/eye designs or customer photographs/videos for advertising, social media, campaigns or promotional purposes is also based on separate explicit consent given by the customer for that purpose.

10. Transfer of Personal Data

Your personal data may be transferred, only to the extent necessary for the relevant purpose, to:

• Shipping and logistics service providers for product delivery,

• Banks and payment service providers for payment transactions,

• Accountants and relevant service providers for invoicing and accounting procedures,

• Relevant technology and storage service providers for IT and data storage services,

• Lawyers, competent public authorities, courts and enforcement offices where required by law or in connection with a legal dispute.

Iris/eye images will not be transferred to unrelated third parties for purposes that are incompatible with those explained above.

11. Retention Periods

The following retention periods apply to iris/eye images:

Orders, warranty and after-sales services: to the extent necessary, for a maximum of 2 years.

Repeat-order purposes: where the customer separately provides explicit consent, for a maximum of 5 years.

Invoices, accounting, tax, payment and legal transaction records may be retained for the periods required under applicable legislation.

When the relevant retention period expires and there is no other legal basis requiring continued processing, the relevant personal data will be deleted, destroyed or otherwise disposed of in accordance with applicable legislation.

12. Rights of the Data Subject

Under Article 11 of KVKK, data subjects have the right to:

• Learn whether their personal data is being processed,

• Request information if their personal data has been processed,

• Learn the purpose of processing and whether the data is being used in accordance with that purpose,

• Learn the third parties to whom their personal data has been transferred,

• Request correction of incomplete or inaccurate personal data,

• Request deletion or destruction of personal data where the conditions provided by law are satisfied,

• Request that correction or deletion procedures be communicated to relevant third parties,

• Exercise their other rights provided under KVKK.

13. Applications and Requests

Requests concerning your rights under KVKK may be submitted to:

IRISLAND BÜYÜKADA
Mimarsinan Mah. Atatürk Blv. No:1 Atakum / Samsun, Türkiye

or, using application methods permitted by applicable legislation, by e-mail to:

irisland.info@gmail.com

Applications must include sufficient information to verify the applicant's identity and must clearly describe the request.

Applications will be assessed and answered in accordance with the procedures and time limits prescribed under KVKK and applicable legislation.

Last Updated: 16 August 2026

IRISLAND

EXPLICIT CONSENT PREFERENCES

The explicit consent options below are independent from one another and entirely optional.

Refusing to select any of these options will not prevent the customer from placing an order, receiving IRISLAND services or benefiting from the 2-year product warranty.

None of the boxes below should be pre-selected.

1. Five-Year Storage for Repeat Orders

I explicitly consent to my iris/eye image and the design file created from that image being stored for a maximum period of 5 (five) years from the date of the iris photograph, so that I may place future IRISLAND orders without having another iris photograph taken, and to the use of such image for repeat orders placed by me during that period.

☐ I GIVE MY EXPLICIT CONSENT

2. Use of Iris Image and Iris Design for Social Media, Advertising and Promotional Purposes

I explicitly consent to my iris/eye image and the artistic iris design created from that image being used for the promotion of IRISLAND products and services through:

• IRISLAND social media accounts,

• www.irislandtr.com,

• Digital advertising,

• Promotional materials,

• Campaigns and marketing activities,

• Visual content created for the promotion of IRISLAND products and services.

I understand that this consent is entirely optional and that refusing to provide it will not affect my order, the services I receive or my warranty rights.

☐ I GIVE MY EXPLICIT CONSENT FOR MY IRIS/EYE IMAGE AND IRIS DESIGN TO BE USED FOR SOCIAL MEDIA, ADVERTISING AND PROMOTIONAL PURPOSES

3. Use of Photographs and Videos Showing the Customer for Social Media and Advertising

I explicitly consent to photographs and videos in which I/my face appear, whether recorded during an IRISLAND service or separately provided by me, being used for the promotion of the IRISLAND brand, products and services through:

• IRISLAND social media accounts,

• www.irislandtr.com,

• Advertising and promotional activities,

• Campaign content,

• Digital or printed marketing materials.

I understand that this permission is separate from any permission I may provide for the use of my iris design, and that refusing to allow my photograph, face or video to be used will not affect my order, services or warranty rights.

☐ I GIVE MY EXPLICIT CONSENT FOR PHOTOGRAPHS / VIDEOS SHOWING ME OR MY FACE TO BE USED FOR SOCIAL MEDIA, ADVERTISING AND PROMOTIONAL PURPOSES

Withdrawal of Explicit Consent

Any of the explicit consents provided above may be withdrawn at any time.

Requests to withdraw explicit consent may be submitted to irisland.info@gmail.com or through other application methods permitted under applicable legislation.

Following withdrawal, future processing activities based solely on the relevant explicit consent will cease. Withdrawal will not affect processing that was lawfully carried out prior to the withdrawal request.