Information Notice (KVKK)

1. Identity of the Data Controller

Your personal data are processed, in the capacity of data controller, by our company — whose official registry and contact information is set out below — in accordance with the provisions of the KVKK and international data protection standards.

• Company Title: ELİF SİMGE EREN Şahıs Şirketi (sole proprietorship)
• Tax Office / Tax No: Kozyatağı Tax Office - 3530980516
• Website: www.holala.ai
• Contact Person Full Name: Att. Hande Karaman
• E-mail: av.handekaraman@gmail.com
• Phone: 05422304929

2. Your Personal Data Processed and the Purposes of Processing

When you access the Holala platform, create an account or benefit from our artificial intelligence-assisted image/video production services, the following personal data of yours are processed for the legitimate purposes indicated:

• Your Identity and Contact Data: Your first name, last name, company name, title, e-mail address and, optionally, the phone number you provide. These data are processed for the purposes of opening your account on the platform, configuring your authorizations, responding to your customer support (ticket) requests, sending informational e-mails regarding membership processes and performing the service agreement.
• Your Subscription, Credit and Financial Data: Your subscription plan, the amount of credits (tokens) you have spent/have remaining, your invoice address and your tax identification number information. These data are processed for the purposes of providing the service without interruption in the electronic environment under our B2B SaaS service model, tracking collection statuses (successful/failed) via our payment integrator (iyzico), issuing the legally mandatory e-invoices/e-archive invoices and keeping accounting records. (Important Note: Your credit card data are not stored on holala servers; they are transmitted directly to iyzico systems in encrypted form.)
• Your Platform Inputs and Digital Assets: The brand kits (logo, color palette), reference product images and prompt texts you upload to the platform for production purposes, and the final images and videos produced by the artificial intelligence. These data are processed for the purposes of performing the creative production service you request from the platform, presenting your production history to you in your user panel and optimizing service quality.
• Your Transaction Security and Analytics Data: Your IP address, device/browser characteristics, login/logout logs and in-platform click data obtained during your use of the platform. These data are processed for the purposes of fulfilling our traffic record retention obligations under Law No. 5651, preventing cyberattacks (DDoS, bots, etc.), remedying system errors and improving the user experience (UX) with tools such as PostHog/Google Analytics.

3. Processing of Your Special Categories of Personal Data (Biometric Data)

Within the scope of the features offered on the Holala platform (for example, image-to-image production, face-specific advertising creatives or brand mannequin creation modules), it is possible for you, of your own volition, to upload photographs containing a human face or body to the platform.

The geometric, physiological and algorithmic analysis of these images you upload to the system by the artificial intelligence engines operating in the background, in order to produce the new designs you request, legally constitutes a "biometric data processing" activity (Special Categories of Personal Data). Your special-category biometric data are processed only momentarily, on the basis of the "Explicit Consent" you will give when uploading the relevant images in the platform interface. These data are definitively not used for the purpose of training artificial intelligence models (model training) and are not put to any other use outside the scope of your explicit consent after production is completed.

4. Method of Collection of Personal Data and Legal Grounds

Your personal data are collected in the electronic environment, by fully or partially automated means, through your completion of the contact/demo forms on the holala.ai corporate site, your completion of the registration steps at app.holala.ai, your uploading of digital content (image/text) to the platform interface, your e-mail communications and cookies.

Your personal data are processed on the basis of the following legal grounds set out in Articles 5 and 6 of the KVKK :

• Being directly related to the establishment and performance of the Terms of Use and the Distance Service Agreement (KVKK Art. 5/2-c) ,
• Being mandatory for the fulfillment of our legal obligations under tax legislation, electronic commerce legislation and Law No. 5651 (KVKK Art. 5/2-ç) ,
• The processing being mandatory for the legitimate interests of our company in ensuring the platform's information security, preventing abuse and enhancing service quality (KVKK Art. 5/2-f) ,
• And, with respect to the processes of sending e-newsletters and marketing communications, using analytics cookies, transferring data to servers abroad and processing images containing a human face (biometric data), "the existence of your Explicit Consent" (KVKK Art. 5/1 and Art. 6/2).

5. Parties to Whom Your Personal Data Are Transferred and Purposes of Transfer

Holala works in integration with global technology infrastructures in order to provide you with an uninterrupted, fast service equipped with the most advanced artificial intelligence technologies. Observing the principle of data minimization, your data are transferred, only to the extent required by the service, to the following domestic and international recipient groups :

• Domestic Transfers: For the secure conduct of credit card collection processes, payment information and transaction references are transferred to iyzico Ödeme Hizmetleri A.Ş., which is BRSA (BDDK)-licensed and PCI-DSS certified. Transfers may also be made to our financial advisors and legal counsel for the issuance of e-invoices, statutory accounting audits and the resolution of legal disputes, as well as to legally authorized public institutions and organizations and to the judicial authorities.
• International Transfers: The platform's database, hosting, storage, security and artificial intelligence engine architecture inherently operates on servers based abroad (in the USA and the European Union). In this context, your data are transferred to service providers such as Hetzner (Finland) and Railway (Netherlands) for server hosting, Cloudflare (Global) for CDN/storage and cybersecurity, fal.ai or Google Vertex AI (USA) for the artificial intelligence production engines, and PostHog, Notion, Clerk, Google Workspace (USA) for product analytics and communication. These international transfers are carried out under legal safeguard, in accordance with Article 9 of the KVKK, through the mechanisms of executing the "Standard Contracts" stipulated by the Personal Data Protection Board or, in incidental/high-risk model uses, your "Explicit Consent" obtained via the platform.

6. Your Rights Under the KVKK as a Data Subject (Including Data Portability)

Pursuant to Article 11 of Law No. 6698 on the Protection of Personal Data (KVKK) and the harmonized international norms (principles such as the right to data portability), you may exercise the following rights by applying to holala :

1. To learn whether your personal data are being processed,

2. If your personal data have been processed, to request detailed information in that regard,

3. To learn the purpose of the processing of your personal data and whether they are being used in accordance with that purpose,

4. To know the third parties to whom your personal data are transferred, domestically or abroad (iyzico, Hetzner, Cloudflare, fal.ai, etc.),

5. If your personal data have been processed incompletely or inaccurately, to request their rectification and to request that such rectification be notified to the third parties to whom the data have been transferred,

6. To request the erasure or destruction of your personal data within the framework of the conditions set out in Article 7 of the KVKK (in cases where you close your account and the statutory retention periods have expired),

7. To object to the occurrence of a result to your detriment through the analysis of the processed data exclusively by automated systems,

8. If you suffer damage due to the unlawful processing of your personal data, to request compensation for such damage.

Method of Exercising Your Rights: You may submit your requests concerning the rights listed above, in accordance with the provisions of the "Communiqué on the Procedures and Principles of Application to the Data Controller", together with documents establishing your identity, to our Contact Person e-mail address specified in the first section (av.handekaraman@gmail.com), using a secure electronic signature, a mobile signature or the e-mail address with which you are registered on our platform. Your requests will be concluded free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of their content. If the transaction additionally requires a cost, the fee in the tariff determined by the Board may be charged.

This Policy on the Protection and Processing of Personal Data and Information Notice is deemed to have entered into force between the parties as of the moment you register on the platform. Holala reserves the right to update this text in line with changes in its technological infrastructure or updates that may occur in the KVKK legislation (particularly in the regime governing transfers abroad).