GDPR

EXPLICIT CONSENT STATEMENT AND APPROVAL TEXT

04.01.2026

This Explicit Consent Statement and Approval Text is provided in accordance with the Law No. 6698 on the Protection of Personal Data (KVKK) and related legislation.www.yoursizer.comoperating at the addressve This data will be processed by our platform (website, mobile application, and widget) and shared as a result of Yoursizer Technologies' collaborations with brands, and will be processed by the websites, mobile applications, and widgets of businesses that have access to and can use these integrations/products as services.This document has been prepared to obtain your informed and free consent regarding a specific matter related to your personal data. This text is an integral part of the Privacy Policy, and you can access detailed information regarding the processing of your personal data through the Privacy Policy.

DATA SUBJECT INFORMATION

Name Surname[Please Enter Your First and Last Name]
User ID / Email Address[Please enter your User ID or Email Address]

As the data subject whose information is provided above, I declare and acknowledge that I have given my explicit consent, freely and after being fully informed, to the personal data processing activities specified below while using the services offered by the Yoursizer.com platform. In digital consent processes, your User ID or Email address mentioned above will be used as a reference confirming that your consent has been given.

CONSENT FOR PROCESSING BIOMETRIC DATA

At Yoursizer.com, in order to provide you with the most accurate size recommendations and a personalized shopping experience, we are required to process your biometric data, which falls under the category of special categories of personal data pursuant to Article 6 of the Law No. 6698 on the Protection of Personal Data (KVKK). In this context;

Biometric Data to be Processed and Their Purposes:On our platform, directly provided by youHeight, weight, and highly accurate measurements of chest, waist, and hip circumference, as well as recommended size preferences.your physical body measurements, and the algorithm that derives results from these measurements through our algorithmyour digital 3D body avatarThis data will be processed. The primary purpose of processing this data is to provide you with personalized and accurate size recommendations, which is the core function of our platform. In addition, to continuously improve our service quality, develop our algorithms, increase accuracy rates, and perform error analysis and calibration, this data, directly stripped of your identifying information (anonymized or pseudonymized), will also be used in algorithm improvement and anonymous/aggregated research activities.*This policy is applied, especially for data used in model training, if it's possible to remove the deleted user's data from the model, and the dataset is tracked through versioning processes.*

Data Minimization and Security: In accordance with the principle of "being relevant, limited and proportionate to the purpose for which they are processed" stated in Article 4 of the KVKK (Turkish Personal Data Protection Law), your biometric data will only be collected to provide the body measurement service.minimum required set of measurementsThe focus is on providing the following information: For example, while basic data such as height, weight, and chest-waist-hip measurements are mandatory, additional body measurements/ratios such as shoulder width, arm length, inside leg/inseam, and neck circumference, fit preference (tight/regular/loose), clothing usage habits/feedback, and technical usage preferences (language, interface settings) are optional. This optional data is intended to improve the accuracy of the service or enhance the user experience, and the basic functionality of the service can be maintained even without providing it.*Even if features such as camera-based scanning are introduced in the future, raw images (photos, videos, depth data, etc.) will not be permanently stored, but will only be processed temporarily and for limited purposes, specifically for measurement/3D representation production. If an improvement to the face portion of the model is considered, raw data related to the face will only be evaluated with the least amount of data possible, with explicit information and separate consent, and preferably without permanent storage (with priority given to temporary processing or on-device processing).*

Storage Period and Disposal:Your processed biometric data (body measurements and 3D avatar) will be retained for as long as you continue to use our service and require personalized size recommendations. However, body/measurement data and derived outputs (e.g., size recommendation results and similar technical outputs) may be used for purposes such as algorithm development, accuracy improvement, and error analysis.We can anonymize the data and store it for over 10 years.

Research and Development Through Anonymization: Article 28/1-b of the KVKK (Personal Data Protection Law) offers an important exception: The provisions of the Law do not apply in cases where "personal data is processed for purposes such as research, planning and statistics by anonymizing it through official statistics". This is a critical point, especially for algorithm-based services like Yoursizer. When biometric data is used within the scope of algorithm development, machine learning training and R\&D activities, and this data is irreversibly anonymized, it is not subject to the retention period restrictions of the KVKK.Without prejudice to mandatory retention obligations arising from relevant legislation, at the end of this period or when the processing purpose ceases to exist, your data will be destroyed or anonymized in accordance with the provisions of the Regulation on the Deletion, Destruction or Anonymization of Personal Data, through secure deletion, cryptographic destruction in encrypted storage structures (destruction of keys), and, where necessary, irreversible anonymization/aggregation methods. Destruction processes are planned to cover not only live systems but also backup media and are carried out with periodic checks.*Backups of biometric data sets in backup media are maintained for 30-90 days on a daily/weekly rotation basis and managed in a way that does not exceed the retention periods in the live system.*Techniques such as aggregation, bucketing, masking/rounding, noise injection, and k-anonymity are used in anonymization processes for algorithm development.

I hereby give my explicit consent to the processing and storage of my biometric data (my body measurements and the 3D avatar derived from them) for the purposes detailed above.

COMMERCIAL ELECTRONIC COMMUNICATION AND MARKETING PERMIT

Yoursizer.com wishes to send you commercial electronic messages to inform you about special offers, new products, campaigns, announcements, and updates to our services. In accordance with Law No. 6563 on the Regulation of Electronic Commerce and related legislation, your explicit consent is required for us to send you such messages.

Communication Channels and Content:You may receive commercial communications via electronic communication channels such as email, SMS, phone calls, and push notifications (via our mobile application). These communications may include information about new features on our platform, exclusive discounts, campaigns from our partner brands, and general information.

Using Data in Marketing Personalization:Personalizing marketing content is, in principle, based on the use of minimal data. This may include evaluating your communication preferences (which channel you prefer), general usage information (e.g., which features you use), basic segment information (e.g., your interest in product categories), and campaign interactions (e.g., email open/click-through rates).It is important to note that your biometric data, such as your body measurements, 3D avatar, and

any facial-related data, will not, as a rule, be used for marketing personalization.If an exceptional need for use arises, this will only be evaluated separately with explicit consent and clear information.

Right to Refuse and IYS:This consent to receive commercial electronic communications is not a mandatory part of the Yoursizer.com service, and you do not need to grant this consent to continue using our services. You have the right to refuse to receive commercial electronic communications at any time without giving any reason. Your refusal can be easily and freely communicated via electronic means (e.g., the "unsubscribe" link in emails or the "reject" option in SMS messages). We will stop sending you electronic communications within three business days of receiving your request. Your commercial electronic communication consents can also be managed through the Message Management System (MMS).

I hereby give my explicit consent to receive the commercial electronic messages detailed above and to the use of my personal data (excluding biometric data) in marketing activities.

CONSENT FOR TRANSFERRING PERSONAL DATA ABROAD

At Yoursizer.com, in order to provide you with uninterrupted and high-quality service, it may be necessary to share some of your personal data with third-party service providers located abroad. In accordance with Article 9 of the Law No. 6698 on the Protection of Personal Data (KVKK), your explicit consent is required for the transfer of personal data to countries where adequacy decisions have not been made.

Purpose of Transmission and Recipient Groups:The transfer of your personal data abroad may only occur when it is necessary for the provision of the service and usually because third-party service providers such as cloud infrastructure (hosting), email transmission, analytical services, customer support platforms, and payment service providers are located abroad. These transfers are carried out to ensure the technical operation of our platform, optimize its performance, improve user experience, and provide you with effective support.

Countries of Transfer and Legal Guarantees:If data transfer occurs, your personal data may be processed primarily within or outside the European Economic Area (EEA) (depending on the service provider's data center). Information on the country/region to which data will be transferred and the provider is also announced in our current "sub-processor/provider list" and relevant policy documents.

In such transfers, within the framework of KVKK and, where applicable, GDPR;

  • •Firstly, data transfer is preferably made to countries that have been deemed competent by the Personal Data Protection Board.
  • •In cases where a decision of adequacy is not available, one of the appropriate legal safeguards specified in Article 9 of the KVKK (Personal Data Protection Law) is...Standard contract clauses (SCC) announced by the BoardThese agreements contain strong commitments to the protection of transmitted data and guarantee the technical and administrative measures to be taken by the data recipient.
  • •In addition, extra technical and administrative security measures such as encryption, access restrictions, role-based authorization, and logging are implemented in transmission processes. Contractual obligations are enforced to ensure that downstream processors are also subject to the same level of protection, and transmission processes are reviewed periodically.*In this context, technical and administrative measures to be taken by the data recipient, as well as additional precautions taken for special categories of personal data, are clearly stated in standard contracts.*

I hereby give my explicit consent to the transfer of my personal data, detailed above, abroad for the stated purposes and within the framework of legal safeguards.

WITHDRAWAL OF CONSENT AND DATA DESTRUCTION

As a data subject, you have the right to withdraw the explicit consent you have given above at any time. You can submit your request to withdraw your consent to us through the communication channels specified in the Data Controller's Privacy Notice.

Consequences of Withdrawing Consent:The withdrawal of explicit consent has prospective effect from the date of withdrawal and halts all data processing activities based on that consent. The lawfulness of data processing activities carried out before the withdrawal of consent remains unaffected.

Data Destruction Processes:If your consent is withdrawn or the reasons requiring the processing of your personal data cease to exist, your data will be deleted, destroyed, or anonymized in accordance with Article 7 of Law No. 6698 on the Protection of Personal Data and the provisions of the Regulation on the Deletion, Destruction, or Anonymization of Personal Data.

  • •Biometric Data:Your biometric data (body measurements and 3D avatar) will be destroyed by secure deletion, cryptographic destruction, or irreversible anonymization methods, subject to legal retention obligations, upon withdrawal of your consent or termination of your use of the service. This data is not used for algorithm development purposes.We can anonymize the data and store it for over 10 years.
  • •Research and Development Through Anonymization: Article 28/1-b of the KVKK (Personal Data Protection Law) offers an important exception: The provisions of the Law do not apply in cases where "personal data is processed for purposes such as research, planning and statistics by anonymizing it through official statistics". This is a critical point, especially for algorithm-based services like Yoursizer. When biometric data is used within the scope of algorithm development, machine learning training and R\&D activities, and this data is irreversibly anonymized, it is not subject to the retention period restrictions of the KVKK.,If consent is withdrawn, the process continues by anonymizing or aggregateing the relevant data to prevent identification. Even if it is not technically possible to extract individual records retrospectively from the model, datasets are anonymized in a way that makes it impossible to identify the individual (using techniques such as aggregation, spacing, masking, and noise injection).
  • •Marketing Communication Data:If you withdraw your marketing consent, we will stop sending you commercial electronic communications and your data processed for this purpose will be destroyed.
  • •International Transfer Data:If you withdraw your consent for international data transfer, consent-based transfer activities will cease and the relevant data will be destroyed.

You can also use the application methods specified in the Disclosure Statement to exercise your other rights listed in Article 11 of the KVKK (correction of your personal data, notification to third parties to whom it has been transferred, objection to the analysis results of automated systems, requesting compensation for damages, etc.). As the data controller, even if your consent is withdrawn, we reserve the right to retain certain data for the periods stipulated in the legislation in order to fulfill our legal obligations (e.g., tax legislation, legal disputes).

DECLARATION AND CONFIRMATION

I, the data subject whose information is provided above, declare that I have carefully read, understood, and been informed about all the details of the Privacy Notice and this Explicit Consent Statement prepared by Yoursizer.com platform.

In this context, for each category I have marked below, I freely and explicitly consent to the processing and transfer of my personal data within the framework of the stated purposes and conditions.

I explicitly consent to the processing and storage of my biometric data (my body measurements and the 3D avatar derived from them) for the purposes described above.

I hereby explicitly consent to receiving commercial electronic communications (email, SMS, telephone, push notifications) and to the use of my personal data (excluding biometric data) in marketing activities.

I explicitly consent to the transfer of my personal data abroad for the purposes described above and within the framework of legal safeguards.

History: 04.01.2026

Name and Surname:

Signature: