Informational translation — the Turkish original (Açık Rıza Metni) governs.

UrClimate Tailor — Explicit Consent Form

Data Controller: Alkazar Teknoloji A.Ş. Product: UrClimate Tailor (SaaS Platform) Contact: destek@urclimate.com Effective Date: 04.05.2026 Version: 1.0

1. Introduction: What Is Explicit Consent, and What Is Its Scope?

Pursuant to Art. 3/1-(a) of Law No. 6698 on the Protection of Personal Data ("KVKK"), explicit consent is defined as "consent relating to a specific subject, based on information, and disclosed with free will." According to the established practice and guidelines of the Personal Data Protection Board (the KVKK Board), a valid explicit consent has three constituent elements:

1. Specific: Consent must be made concrete in such a way that it is clearly understood to which data processing activity it relates. General/blanket consent statements such as "I consent to all processing activities" are invalid (Board decisions No. 2019/165, No. 2020/286). Separate consent must be obtained for each distinct purpose (prohibition of aggregation).
2. Informed: The data subject must have been informed in advance — through the Disclosure Notice under Art. 10 of the KVKK — about the purpose of the processing, the types of data processed, transfers, the retention period, and their rights. Explicit consent does not eliminate the Disclosure Obligation; the two documents complement each other.
3. Freely given: Consent cannot be obtained under pressure, disadvantage, or compulsion. Conditioning consent (e.g., "if you do not consent, you cannot receive the service") — with respect to processing not directly related to the service — vitiates the consent. In addition, passive methods such as pre-ticked boxes, default-on settings, and scroll-to-consent are deemed invalid by the Board (Board 2019/51).

In UrClimate Tailor, the provision of the main service (user account, site forecast data, daily operational alert emails, support) does not require explicit consent; this processing relies on the legal grounds under Art. 5(2) of the KVKK (establishment/performance of the contract, legal obligation, legitimate interest) and is notified to the data subject through the Disclosure Notice (see aydinlatma-metni.md).

This Explicit Consent Form covers only optional data processing activities that are not necessary for the performance of the main service. Not consenting to these activities does not prevent you from benefiting from the main functions of UrClimate Tailor.

2. Purpose 1 — Commercial Electronic Message (Marketing Emails)

2.1 Checkbox Text (statement to be displayed on the form)

☐ I give my explicit consent to receive commercial electronic messages by email from Alkazar Teknoloji regarding the UrClimate Tailor product, concerning new features, version updates, sectoral climate risk analyses, training/webinar announcements, and reference case studies.

(Default state: NOT CHECKED)

2.2 Legal Framework

This processing activity is subject to two separate legislative regimes:

• Art. 5(1) of the KVKK — With respect to processing the email address for marketing purposes, it relies on the explicit consent legal ground.
• Art. 6 of Law No. 6563 on the Regulation of Electronic Commerce (ETK) — With respect to sending the commercial electronic message, it is subject to the requirement of prior approval.
• Pursuant to the Regulation on Commercial Communication and Commercial Electronic Messages, the approval must be recorded through the Message Management System (İYS).

Both regimes are satisfied by the same single checkbox; when you give your approval, your email address and the approval record are transmitted to İYS.

Note: Operational emails sent within the scope of the contract (daily forecast bulletin, lightning alert, threshold-exceedance alert, planned-maintenance announcement) are independent of this consent; such messages fall under Art. 5(2)-c of the KVKK (performance of the contract) and are subject to the exception in Art. 6(3) of the ETK, and they continue to be sent throughout the subscription.

2.3 Data Processed

Name and surname, email address, company name, approval date-and-time information, approval channel (web form), IP address (for the purpose of approval proof).

2.4 Retention Period

Until the approval is withdrawn; after withdrawal, the approval record is retained for 3 years as required by the burden of proof (Art. 13 of the ETK Regulation).

2.5 Withdrawal (Right of Refusal)

• The "Unsubscribe / Leave the Bulletin List" link located at the bottom of every commercial electronic message,
• Within the UrClimate Tailor platform, Account Settings → Communication Preferences → Marketing Emails (turn off),
• A refusal record for "UrClimate Tailor / Alkazar Teknoloji" through İYS (iys.org.tr),
• An email with the subject "Bulletin cancellation" to destek@urclimate.com.

Your refusal request is processed within a maximum of 3 business days (Art. 8 of the ETK).

3. Purpose 2 — Anonymous/Pseudonymous Usage Analytics for Product Improvement

3.1 Checkbox Text

☐ I give my explicit consent for my navigation and feature-usage data on the UrClimate Tailor platform to be processed — with my IP address masked (last octet zeroed) and with a pseudonym — through the product analytics infrastructure for the purposes of product improvement, error detection, and usability analysis.

(Default state: NOT CHECKED)

3.2 Legal Framework — Dual Justification Approach

For this processing, Alkazar Teknoloji establishes two legal grounds together:

• Art. 5(2)-(f) of the KVKK — Legitimate Interest: The data controller's interest in improving its product and debugging; because the data are masked/pseudonymous, this is at a level that will not harm the fundamental rights and freedoms of the data subject. This assessment (legitimate interest balancing test — LIA) has been carried out internally.
• Art. 5(1) of the KVKK — Explicit Consent: As an additional safeguard, explicit consent is also obtained separately from the user. This "defence-in-depth" approach provides protection against future Board decisions that may arise concerning the interpretation of legitimate interest.

Note: UrClimate Tailor has not yet deployed a third-party analytics infrastructure (such as PostHog) within the scope of Phase 1. This consent is obtained in advance so as to apply when this infrastructure is added in the future; the activation date and the identity of the sub-processor to be used will be incorporated into this text upon deployment and will be notified to your registered email address. In any event, the transfer infrastructure is kept within the European Union region, and a standard contract (SCC) is signed under Art. 9 of the KVKK.

3.3 Data Processed

Page views, click events, feature-usage frequency, session duration, device/browser type, masked IP (e.g., 192.168.1.0), pseudonym (random ID), error/crash traces. Direct identifiers such as name and surname, email, and company name are not included in this stream.

3.4 Retention Period

A maximum of 13 months from the moment of collection. At the end of the period, it is aggregated/made statistical, and individual records are deleted.

3.5 Withdrawal

• The Account Settings → Privacy → Product Analytics (turn off) option,
• A written request to destek@urclimate.com,
• After withdrawal, the collected data are anonymized or deleted within 30 days.

4. How Do I Withdraw My Explicit Consent?

Pursuant to Art. 5(1) of the KVKK, explicit consent may be withdrawn at any time, without giving any reason, free of charge. Withdrawal has prospective effect; it does not affect the lawfulness of processing carried out on the basis of consent before the withdrawal.

4.1 Main Channel: In-Platform Communication Preferences

1. Log in to UrClimate Tailor.
2. From the user menu at the top right, go to the "Account Settings" section.
3. Open the "Communication Preferences" tab.
4. There is a separate toggle for each purpose:
   • Marketing Emails (Purpose 1)
   • Product Analytics (Purpose 2)
5. Save the change by turning off the relevant toggle. The system records the withdrawal instantly and forwards it to the relevant business unit.

4.2 Backup Channels

4.3 After Withdrawal

• The marketing bulletin subscription is deactivated the same day.
• Analytics data are anonymized within 30 days.
• The approval record kept for proof purposes is retained for the period prescribed by the relevant legislation, as required by Art. 6 of the ETK and Art. 12 of the KVKK.

5. Contact and Data Subject Rights

To exercise your rights under Art. 11 of the KVKK (requesting information, rectification, erasure, objecting to processing, etc.):

• Data Controller: Alkazar Teknoloji A.Ş.
• Email: destek@urclimate.com
• Phone: 0212 270 40 57
• Web Form: UrClimate Tailor → Account Settings → Privacy → KVKK Application Form
• Mail: Reşitpaşa Mh. Katar Cd. No:2/50/6 İTÜ ARI Teknokent Sarıyer/İstanbul

Your application is answered free of charge within 30 days at the latest (Art. 6 of the Communiqué on the Procedures and Principles of Application to the Data Controller). If your request is rejected or the response is found insufficient, your right to lodge a complaint with the Personal Data Protection Board (kvkk.gov.tr) within 60 days is reserved.

ANNEX A — Short Texts to Be Displayed on the Registration Form

The short texts below are displayed next to the checkboxes on the registration form for users who do not wish to read the long explicit consent text. Each text is in the range of 30–60 words and contains a "Detailed information" link to this main text.

A.1 — Marketing Emails (43 words)

I would like to receive emails about UrClimate Tailor's new features, sectoral climate risk analyses, and webinar announcements. This is a preference separate from the daily operational alerts under the contract. I can withdraw my approval via the "unsubscribe" link in every message or from my account settings. [For detailed information, Explicit Consent Form — Purpose 1]

A.2 — Product Analytics (51 words)

I consent to my usage data on the platform being analyzed — with my IP address masked and with a pseudonym, through the product analytics infrastructure — for the purposes of product improvement and error detection. My name and surname, email, and company name are not linked to these data. I can withdraw my approval from my account settings at any time. [For detailed information, Explicit Consent Form — Purpose 2]

ANNEX B — UX/UI Implementation Rules (Developer Note)

These rules arise from the Board's established practice regarding the validity of explicit consent and are binding:

1. A SEPARATE checkbox for each purpose — combining into a single box (aggregation) is prohibited.
2. Default state: UNCHECKED — being pre-ticked is prohibited (Board 2019/51).
3. "Accept" ≠ "I have read" — Explicit consent is separate from the confirmation that the Disclosure Notice has been read; the two confirmations must be on separate lines.
4. Refusing must not be made difficult — If there is an "Accept All" button, there must be a "Reject All" button on the same line and with the same visual weight.
5. Approval record — the timestamp, IP, text version, approval method (web/mobile), and user ID must be kept in the database (burden of proof under Art. 12 of the KVKK).
6. Prohibition of conditioning on the main service — In the registration flow, registration must be able to be completed even if these checkboxes are left blank. (Only the Disclosure Notice and Terms of Use approvals are mandatory.)
7. Text versioning — when a substantive change is made to this document, re-approval must be obtained from the user; the old approval record must be archived in association with the previous version.

Last Updated: 04.05.2026 Responsible Unit: Alkazar Teknoloji — Legal & Compliance Next Review: 04.11.2026 (6 months) or immediately in the event of a legislative change.