Notice on the processing of personal data

This text is provided as an English translation for ease of understanding. In the event of a discrepancy, the Turkish-language text is the reference version. This does not limit your rights under applicable law.

PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

Version: 1.3 · Data controller: DLINE Teknoloji A.Ş.

1. Data controller

DLINE Teknoloji A.Ş. (the "Company")

Address: Çelebizade Köşkü, İcadiye Mahallesi, Akdarı Sokak No: 3/1, 34674 Üsküdar / İstanbul, Türkiye · Central Registry (MERSİS) no: 0302110343100001 · Tax ID (VKN): 3021103431 · Tax office: Üsküdar

E-mail: info@tesbihkar.com · Telephone: +90 212 909 34 98

The data controller for your personal data is DLINE Teknoloji A.Ş. DLINE LLC (30 N Gould St, Ste N, Sheridan, WY 82801, USA) is the data processor that processes your data on behalf of the Company and on its instructions.

2. Categories of data subjects

• Customers who are natural persons / owners of objects / persons delivering objects
• Owners of sole proprietorships
• Representatives, employees or contact persons acting on behalf of corporate customers
• Source persons who provide documents or information in an object's provenance chain (only to the extent necessary)
• Users of the customer portal
• Persons who open a shared pre-assessment report or who sign up through a share link

Purely corporate information belonging to a corporate body may not be personal data of a natural person within the meaning of the KVKK; however, the identity, contact, signature and transaction security data of representatives, employees and contact persons fall within the scope of this notice. The applicable lawful basis for each category of data subject is determined separately in the data inventory.

3. Personal data processed

The preliminary finding and device check, sharing, recipient list, invitation record and Android install source features may be made available in stages. Related records are created when the feature is enabled for the relevant user or visitor and the described use or technical operation takes place. Processing for free and paid AI preliminary findings that relies on explicit consent does not begin before the necessary consent is obtained. Operational notifications and product event logs are also processed only when the relevant features are used and the conditions explained in this notice apply.

Images of objects are treated as personal data to the extent that the Company can link them, directly or indirectly, to a natural person. Data that relates only to an object and cannot be linked to any natural person may not constitute personal data.

The purpose of the service is not to process special categories of personal data such as health, religion, political opinion or biometrics. No unnecessary copies of identity documents are taken. If identity checks are required for high-value objects, this is entered in the data inventory with a separate processing purpose and lawful basis.

4. Purposes of processing and lawful bases

For purposes that require explicit consent, not giving consent does not prevent you from receiving the core examination service. Consent scopes are marked separately in the Examination Instruction and written to the consent record.

Explicit consent for the optional free and paid AI preliminary finding is obtained with a box that is separate from the presentation of this privacy notice and from the acceptance of membership/the contract, and is not pre-ticked. A single text states clearly the scope of both uses and the difference between them. Not giving consent does not prevent membership or the paid expert assessment; in that case no new preliminary finding is generated through Gemini. A consent given earlier only for the free preliminary finding does not extend automatically to paid use; at the first paid request you are asked separately for your preference on the current scope. You can withdraw consent in the My account area; withdrawal stops further submissions to Gemini. A separate retention and disposal assessment is made for results already created lawfully.

5. Transfers of personal data

• External laboratory: where possible only the TES/sample number; identity data is not transferred if it is not needed.
• Shipping / insurance: only the necessary name, address and telephone together with insurance and object information.
• Financial service provider: data necessary for invoicing and statutory records.
• Lawyers / competent authorities: for statutory requests or for the protection of rights.
• Information technology data processors: hosting, backup, security, e-mail and similar; all are listed in the data processing inventory.
• DLINE LLC (USA): operates the technical infrastructure of the service on behalf of the Company. This is a transfer abroad; its mechanism is described in §5.1.
• Google Gemini (abroad): for the optional free and paid automatic preliminary finding, the selected object frames stripped of identity/contact and EXIF fields, together with the limited technical information required for the analysis; details are in §5.2.
• Apple and Google (device check): only a single-use check token, so that the free preliminary finding entitlement is used once per device; details are in §5.3.
• Members who open a shared report: if you share your report, members who know the link or the share code and sign in see the report and the frames you selected; your name, e-mail address, telephone number and user code are not shown. Non-members see only the blurred cover image; details are in §5.4.
• Google (push notifications): if you allow notifications, the notification token together with the title and body of the notification, the in-site path that opens when tapped (for a request result, the request's opaque internal identifier) and the notification identifier; details are in §5.6.
• Your data is not transferred or sold to third parties for marketing purposes.

5.1 Hosting abroad (KVKK art. 9)

The production infrastructure uses Contabo GmbH (Welfenstraße 22, 81541 München, Germany), located in Germany; this is a regular transfer abroad. EU membership alone does not replace an adequacy decision as regards Türkiye.

For this regular transfer, for which there is no adequacy decision, the standard contract published by the Authority was signed on 11.09.2026 and notified to the Authority on 16.09.2026. The contract type, sub-processors, backup location and onward transfers are kept up to date in the data inventory.

E-mails that the application sends you leave through MXroute, located abroad. For this regular transfer, the standard contract published by the Authority was signed on 16.09.2026 and notified to the Authority on the same date.

The Company transfers data to its data processor DLINE LLC (USA); for this transfer, the standard contract published by the Authority was signed on 16.09.2026 and notified to the Authority on the same date. The data processing agreement between the Company and DLINE LLC was also signed on 16.09.2026.

Encrypted disaster recovery backups. For service continuity, full backups of the production database and object images are encrypted on the Company's servers before they are sent to an external service provider; file names are encrypted as well. The decryption keys are under the sole control of the Company and are not given to the backup service provider. Backups are stored on the Contabo hosting infrastructure, whose contractual scope also covers backups. This processing relies on the appropriate safeguard under the standard contract signed with Contabo on 11.09.2026 and notified to the Authority on 16.09.2026. Access to backups is limited to disaster recovery needs; the retention and disposal arrangements are described in §7.

5.2 Submission to an external AI service provider

A6 - internal comparison only: Photographs of objects may be sent, without the owner's identity and contact information, to an AI service provider established abroad for analysis; the result returned from this special internal comparison flow is not a preliminary finding or report result shown to the customer. The frame sent relates only to the object: no recognisable face, identity document or contact information is sent; at the time of submission the frame is not transferred in a form linked to the owner record.

In order to keep this processing limited to object images that contain no personal data, the Company checks direct identifiers, technical identifiers, the possibility of indirect matching through the distinctive features of the object and the risks of data combination on the recipient side. Where an image can be linked to a natural person, it is treated as personal data and the transfer is subject to the appropriate safeguards under KVKK art. 9.

Free AI preliminary finding (mobile app). Separately from the internal comparison above, if you have given explicit consent to this processing, the object frames you submit for the free preliminary finding are sent to an AI service provider established abroad (Google, Gemini service; USA) without your name, e-mail address or contact information, and with the photo's metadata (EXIF), including location, deleted on your device. The returned result is shown to you as a preliminary finding; it does not enter the report or the Künye record. This regular transfer is carried out within the appropriate safeguard mechanism of the standard contract signed with Google on 12.09.2026 and notified to the Authority on 16.09.2026, which also covers the Gemini API service. The Gemini API is used on its paid service tier. If you do not consent, your frames are not sent for this purpose.

Optional automatic preliminary finding in the paid remote pre-assessment: If you have given extended explicit AI consent for your paid assessment request, the object frames you select are sent to Google Gemini with your identity/contact data and EXIF fields removed. Gemini's output, consisting of the material family, the strong/possible/weak strength level, the visual cues it relies on and a simple home test suggestion, is presented to you immediately with the label “Automatic preliminary finding - not an expert review”. Our expert later approves, corrects or rejects this automatic result; the expert result is notified separately. Not taking part in this processing does not prevent the paid expert review. The free and paid Gemini preliminary findings are carried out within the standard contract signed with Google on 12.09.2026 and notified to the Authority on 16.09.2026, which covers the Gemini API.

5.3 Device check and image digest comparison

The free preliminary finding entitlement is given once per device. For this, at the moment you request and submit the free preliminary finding, the mobile app obtains a single-use check token from Apple's DeviceCheck service on iPhone and from the Google Play Integrity service on Android. Our server forwards this token to Apple or Google only for the check; the marker showing whether the device has used the free entitlement is kept on the Apple or Google side, tied to the device. On Android this route opens after Google's approval; until then no free preliminary finding is given in the Android app. Your device's IMEI, serial number, advertising identifier or telephone number is not collected; the raw token is not stored. We keep only the result code and month of the check and the keyed digests in §3.

To prevent the same free entitlement from being reused with other accounts, the image digests of your free preliminary finding frames are compared with the image digests of the free preliminary finding frames of other accounts. An image digest is not the photograph itself and the photograph cannot be reproduced from it; in the event of a match, the other account's identity or request is not shown to you.

The lawful basis for these two processing activities is legitimate interest (art. 5/2-f): preventing misuse of the free entitlement and the security of the service.

5.4 Shareable pre-assessment report

If you wish, you can share your pre-assessment result or your free preliminary finding through a private link or a share code. Sharing starts only at your request.

Who sees what. A member who opens the link and signs in sees the report, watermarked copies of the frames you selected (at most four), the report number and the dates. Your name, e-mail address, telephone number and user code are not shown; the metadata (EXIF) of the frames, including location, is deleted. If someone who is not a member opens the link, they see only a blurred cover image generated on our server from one frame you selected, a title and an invitation to sign up; the result and the frames are not shown. You are shown how many times the link was opened, how many members viewed it and the last day it was opened; the identity of those who opened it is not shown.

Recipient list. A member who opens a shared report adds it to their own list (Shared with me). For this, that member's account, the way the report was added (link, app, share code, sign-in link or Android install source) and the date are recorded. The member can remove the report from their list or choose not to see shares from the person who shared it; the identity of the person who shared the report is not shown to them.

Duration, extension and closure. By default the link stays open for 30 days. You can extend the period, close the link at any time or generate a new one; when a new one is generated, the old one closes immediately. An extension cannot go beyond the report's own expiry. If the report is updated later, the link shows its current version.

Sharing rules. Before creating a link, you are asked to accept the sharing rules with a box that is not pre-ticked. The rules do not allow inappropriate content and require that no personal information such as faces, names, addresses, telephone numbers or documents be visible in the photos. The version of the rules you accepted and the time of acceptance are recorded; when the rules change, you are asked again. A share that breaches the rules may be suspended or closed.

Reports. A member who finds a shared report inappropriate can report it to us. The reason for the report, any note written and the account of the reporting member are recorded, and our team reviews the report.

Künye record application of the person who acquires the item. If you give permission with a separate box that is not pre-ticked when creating the link, the person who acquires the item can use an unwatermarked, metadata-free copy of your shared photos in their Künye record application; the copy moves into that application's file. If you do not give permission, your photos are not used for this purpose.

If you delete your account, your links close immediately, the share images are deleted and your shares no longer open in other members' lists; reports shared with you are also deleted from your list. You can request information about your shares, your recipient list, your invitation record and your install key through the channels in §13.

5.5 Invitation record

If you become a new member through a share link or a share code, the link and the way (web, app, share code or Android install source) through which you signed up and the member who created the link are recorded. The record is written at the moment you open the sign-in link sent to your e-mail; if you request the sign-in link but do not open it, no record is created. If you enter the share code within the first 7 days of your membership, the record is written at that moment. If you are already a member, no invitation record is written; the report is only added to your list. An invitation record is written only once for your account: if a record exists, another link you open later or a share code you enter does not write a new record.

This record is not shown to you or to the member who created the link. It is used to count sign-ups that come through sharing and to prevent misuse such as self-invitation; for this, irreversible keyed digests derived from your e-mail address and your network address are kept.

The record is kept for as long as your account exists; the digest derived from the network address is deleted after 90 days. If you delete your account, the record is deleted; if the member who created the link deletes their account, their link in the record is removed.

5.6 Push notifications

If you allow notifications in the mobile app, a notification token specific to your installation of the app is processed to deliver to your device transaction notifications about your request result, a request for additional photos, the publication of a Künye record, a transfer offer made to you and your shares. No marketing notifications are sent. Notifications are delivered through Google LLC's Firebase Cloud Messaging service (on iPhone via the Apple Push Notification service), which involves a transfer abroad. Together with the notification token, Google receives only the title and body of the notification, the in-site path that opens when the notification is tapped (for a request result, the request's opaque internal identifier; for a Künye record, a path that carries no identity) and a time-ordered notification identifier (UUIDv7) that does not contain the person's name and prevents the same notification from being shown twice; the content of the notification does not include your name, e-mail address, object number or assessment result. The analytics, crash reporting and performance monitoring components of Firebase are not used in the app. This regular transfer relies on the standard contract signed with Google on 12.09.2026 and notified to the Authority on 16.09.2026, within the scope of KVKK art. 9/4-c.

The token is kept for as long as your session remains open (at most 30 days, even if you do not use the app). The token is deleted when you sign out, when your session is closed and when you delete your account; the token of a session that expires on its own is not used for notifications and is deleted in the hourly clean-up. You can turn off notifications at any time from the Notification preferences screen in the app or from your device settings.

5.7 Android install source

If you install the app on Android with the Google Play button on a share page, the page adds a single-use install key to the Google Play address. The app attempts to read the Google Play Install Referrer information only once, at the first suitable app opening after this feature has been enabled for your account and you have signed in or created an account. If a valid install key is obtained, it is sent to the Tesbihkâr server and the shared report is added to your list. Once the server has returned an acceptance or rejection response, the pending key is deleted from the device; if there is a connection problem, sending a previously read key may be retried the next time the app opens. If you sign out or request deletion of your account, any pending key is deleted, and the install source information is not read again for another account. For a new user, an invitation record is created if the conditions in §5.5 are met; no invitation record is created for a user who is already a member. The key contains no name, e-mail or advertising identifier; it stays usable for seven days and can be used only once. Install source information without a key is not processed. Possible technical data processing in the Google Play redirection process is assessed separately. This route does not exist on iPhone; you can enter the share code manually or sign up on the web.

6. Method of collection

Through physical delivery and the delivery form, the customer portal, the mobile app (including the Apple and Google device check services, the push notification service and, on Android, the Google Play install source information), share links and the share page, e-mail/telephone, the payment and invoicing system, the examination station, electronic consent records and security logs; in written and electronic form.

7. Retention and disposal

Each data category is kept for the period necessary for its purpose and lawful basis; a single "10 years" assumption is not used for all data.

7.1 Cookies

The site has no cookie consent banner: all cookies used are strictly necessary for the service to work. Advertising, marketing, analytics and third-party cookies are not used; no profiling is carried out with cookies.

The tesbih_session and tesbih_kunye cookies are written so that scripts cannot read them (HttpOnly) and only over HTTPS; tesbih_kunye applies only on the Künye summary address (/k). As the protection requires, tesbih_csrf can be read by the browser; on its own it does not open any record.

7.2 First-party product event log

To measure how the sharing and invitation features work and to prevent misuse, only a limited set of events created on our server as a result of a user action are recorded. The events are on a closed list (for example creating a share, opening a link, sign-ups and store install counts). No third-party tracking tool is run for this purpose in the app or on the site. In the first 90 days the event name, the time of the action, the related account (if any) and a keyed digest derived from the network address may be present. After that, the account link and the network digest are removed; the raw entry is deleted and only anonymous aggregated counts are kept. Small groups that could reveal individuals are combined over longer periods or suppressed before being published or stored. It is ensured that anonymous counts are deleted at the end of a maximum total retention period of 13 months from the event date. The lawful basis for the processing is KVKK art. 5/2-f, subject to a balancing of interests. For visitors who are not members, no account field is kept; information is given through the short notice on the share page and through this privacy notice.

8. Anonymisation

Deleting only the name and surname is not anonymisation. An irreversible breaking of links is required so that the data subject can no longer be identified, including by matching with other records held by the Company or the relevant recipients. As long as a link to the owner record or another source link remains, the data is regarded as pseudonymous.

Anonymisation steps: irreversible removal of the link → removal of personal data from provenance records → scan for external identifiers → assessment of the re-identification risk.

9. Reference archive, withdrawal of consent and artificial intelligence

You can withdraw at any time the explicit consent you gave for the reference archive and method development. From the moment it reaches the Company, the withdrawal stops future processing activities based on this consent. The Company deletes, destroys or anonymises source data and derived data that can be linked to a person for which there is no other lawful basis.

As regards model versions created earlier, whether the relevant data remains personal data within the model, the risk of memorisation and re-identification, and technical reproducibility are assessed separately. Where necessary, the model is retrained (retraining/unlearning) or other appropriate technical measures are applied. The lineage of data sets and models (origin of data sets and model versions) is kept on record. Statutory retention obligations are reserved.

KVKK explicit consent and the intellectual property rights/image use licence are recorded separately; withdrawing one does not automatically remove the other.

10. Automated analysis (KVKK art. 11/g)

Object examination results may be prepared with AI-assisted analysis; the final result to be published is reviewed by an expert. The results concern the Object; they contain no credit, behaviour, health or similar profiling decision about a person.

Internal comparison (A6): Part of the analysis may be carried out by an AI service provider established abroad (§5.2). In this internal comparison only the object frame is sent; the internal comparison output returned is not carried over into the preliminary finding or report presented to the customer. The free and paid Gemini preliminary findings are separate from this internal comparison provision. In the expert-approved assessment, the final expert decision is given separately.

The result of the remote pre-assessment is generated automatically from the photographs and the declaration you submit and is shown to you without an expert having seen it. The result concerns the object and is not made public. To object to this result, you can apply to us through the channels in §13, stating your request number; an expert assesses your objection and we notify you of the outcome in writing. You can also open a Künye record application for a physical examination of the object.

The material type you select at submission and your optional declaration of how you came by this information do not take part in calculating the automatic result; they are used only to order the suggested tests and to explain how the result and your declaration agree. In optional Simichrome test frames, an expert assesses the cotton trace; this observation can affect the automatic result only in the direction of incompatibility with natural amber and does not raise the result in a positive direction. Images of the imame underside, hitame and spacer pieces may be used in the technical and workmanship assessment of the current object; their future use in a separate reference archive depends on the conditions in §9.

The free AI preliminary finding in the mobile app is also generated automatically from your photos and shown to you without an expert having seen it; it contains no expert approval and is not binding. You can ask once per request, free of charge, for an expert to review the preliminary finding with the same frames, from the preliminary finding screen or through the channels in §13; we notify you of the outcome. The expert-approved full assessment is a separate service.

Automatic preliminary finding in a paid request: If you have given extended explicit consent, the Google Gemini output may be shown as an automatic and temporary preliminary finding before the expert review. This output is not a final expert opinion. The expert approves, corrects or rejects the output; a different expert decision is notified as a separate result. If you do not consent or withdraw consent, only the expert assessment continues, without any new transfer to Gemini.

10.1 Home test safety and risk awareness

Simichrome is a metal polishing paste; using it on delicate objects can leave marks and cause permanent surface changes. The test is not mandatory. A short safety warning about the test and an optional preference box are shown; the warning version and the record of the preference may be kept for the period in §7. This record does not replace KVKK explicit consent and does not amount to a waiver that removes the Company's statutory liability.

11. VERBİS

The Company reassesses its obligation to register with the Data Controllers' Registry for each financial period, taking into account current Board decisions, the annual number of employees, the annual balance sheet total and its main field of activity. As of 06.09.2026, there is a registration exemption for data controllers whose main activity is not the processing of special categories of personal data if the annual number of employees is fewer than 50 and the annual balance sheet total is less than TRY 100 million; for those whose main activity is processing special categories of data, a separate criterion of 10 employees / TRY 10 million applies. The registry exemption does not remove the other obligations under the KVKK. The statement "registered with VERBİS" is written only if registration has actually been made.

12. Your rights (KVKK art. 11)

By applying to the Company, you have the right to learn whether your data is processed, to request information if it has been processed, to learn the purpose of processing and whether it is used in accordance with its purpose, to know the third parties to whom it is transferred in Türkiye or abroad, to request correction if it has been processed incompletely or incorrectly, to request deletion or destruction under the conditions of KVKK art. 7, to request that these operations be notified to the third parties to whom the data was transferred, to object to a result to your detriment arising from analysis exclusively by automated systems, and to request compensation for damage caused by unlawful processing. Your applications concerning the identity of recipients of a shared report are assessed separately in each application, taking into account both the scope of your right and the privacy of other persons; where necessary, unrelated information belonging to third parties is masked.

13. Applications

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can send your applications

• in writing to Çelebizade Köşkü, İcadiye Mahallesi, Akdarı Sokak No: 3/1, 34674 Üsküdar / İstanbul, Türkiye,
• from the e-mail address registered in our system to kvkk@tesbihkar.com.

Applications are concluded within the period laid down by the legislation.

14. Separate activities not covered by this notice

The following activities are outside the scope of this privacy notice and are subject to separate policies/privacy notices:

• Recording and analysis of third-party Mezat Intelligence broadcasts → separate privacy notice (auction privacy notice v0.2)
• Public profiles of living masters → separate Masters Archive Privacy Notice (v1.0; in preparation for publication). Data controller decision (2026-09-07): the names and own signed works of living masters are published under KVKK art. 5/2-f (legitimate interest) without obtaining separate consent; the master concerned can object under KVKK art. 11 through the §13 contact channels above, and on request the profile is removed from publication immediately.
• Future commerce / consignment / marketplace activities → marketplace payment policy v0.2 and the Phase C contract set