KVKK CLARIFICATION TEXT

MARCH 11, 2026

1. Data Controller

In accordance with the Personal Data Protection Law No. 6698 (“KVKK”), your personal data; It may be processed by FONMUSIC LIMITED, as the data controller, within the scope explained below.

Title: FONMUSIC LIMITED
Company Number: 17006529
Address: 102 Rookery Court, 80 Ruckholt Road, Mainyard Studios Office C05 Suite G1187, London, E10 5FA, United Kingdom
Website: `fonmusicapp.com`
Email: `support@fonmusicapp.com`

2. Processed Personal Data

Within the scope of FonMusic services, your following personal data may be processed:

identity and contact data: e-mail address, name-surname and message content you submit in support requests

membership and account data: user ID, login/logout, password reset and account verification records

subscription and transaction data: subscription plan, subscription status, subscription end date, subscription source, renewal/cancellation records, transaction references

usage and security data: music listening, play/pause, offline downloads, error and security logs, media access and system logs

technical data: IP address or approximate country information derived from IP, browser, operating system, platform, application version

data stored locally on the device: contents and their technical metadata stored in encrypted form on the device for offline use

FonMusic aims not to store full payment data, such as payment card number, directly in its systems. Such data is processed by the relevant payment and app store infrastructures.

3. Purposes of Processing Personal Data

Your personal data may be processed for the following purposes:

creating membership and managing user account

ensuring authentication, session management and account security

offering access to music content, subscription features and premium rights

execution of subscription, renewal, cancellation, return, restore and customer portal processes

offline access, license protection and implementation of technical security measures

receiving and responding to support requests

preventing abuse, carrying out information security processes and protecting system integrity

execution of error management, performance monitoring and service development processes

fulfillment of legal obligations

Creating evidence and protecting rights in possible disputes

Sending campaigns, announcements, promotions and marketing communications if you give explicit consent

4. Method and Legal Reason for Collection of Personal Data

Your personal data; It can be collected automatically or partially automatically through the website, mobile application, membership forms, login processes, payment and subscription integrations, support form, e-mail communication, log records, cookies and similar technologies.

Your personal data may be processed based on the following legal reasons included in Article 5 of the KVKK:

being directly related to the conclusion or performance of a contract

Ability of the data controller to fulfill its legal obligation

data processing is mandatory for the establishment, exercise or protection of a right

It is mandatory to process data for the legitimate interest of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

You have express consent for sending commercial electronic messages and non-essential cookies

5. Parties to which Personal Data Can Be Transferred and Purposes of Transfer

Your personal data may be transferred to the following recipient groups on a limited basis to provide the service and fulfill the above purposes:

`Supabase`: hosting of authentication, database, profile and application data

`Cloudflare`: domain name, CDN, security, edge operations, traffic management and rate limiting processes

`Paddle`: web subscription payments, collection, customer portal, cancellation and billing processes

`RevenueCat`: subscription management, subscription verification and cross-platform synchronization processes

`Apple App Store` and `Google Play`: in-app subscription, renewal, cancellation and return processes

authorized public institutions and organizations: for the purpose of fulfilling obligations arising from the legislation

consultants or competent authorities from whom services are received within the scope of law, audit and dispute management: to the extent necessary

6. Transfer of Personal Data Abroad

This transfer; It can be carried out to carry out account management, database, content presentation, security, payment, subscription management and support processes.

FonMusic aims to carry out international transfer processes in accordance with the mechanisms foreseen in the secondary regulations regarding Articles 5 and 9 of the KVKK.

7. Your Rights Under Article 11 of KVKK

As a data owner in accordance with Article 11 of the KVKK:

learning whether your personal data is being processed or not

Request information about this if it has been processed

learning the purpose of processing and whether they are used for their intended purpose

knowing the third parties to whom it is transferred domestically or abroad

Request correction if it is incomplete or incorrectly processed

Requesting deletion or destruction within the framework of the conditions stipulated in KVKK

requesting notification of correction, deletion or destruction to third parties to whom it has been transferred

object to the emergence of a result against you by analyzing the processed data exclusively through automatic systems

Request compensation for the damage if you suffer damage due to illegal processing

You have the rights.

8. Application Procedure

You can forward your requests within the scope of KVKK to `support@fonmusicapp.com` or the company address above, along with information and documents confirming your identity.

FonMusic will finalize your applications free of charge as soon as possible and within 30 days at the latest, depending on the nature of the request, in accordance with Article 13 of the KVKK. If the transaction requires additional costs, a fee at the tariff determined by the Personal Data Protection Board may be requested.