Personal Data Protection Notice

01 / 14

Data Controller

The party acting as data controller under the KVKK is:

For services and customer interactions outside Türkiye, certain processing activities are also carried out by ARCH Innovation Corp. (Delaware, USA). Under shared processing practices, both companies are bound by the same protection standards.

02 / 14

About ARCH

ARCH is a consumer wearable technology company that develops the ARCH V1 Walking Simulator, a wearable worn below the knee. The device simulates the mechanical effect of the calf muscle pump to sustain mechanical movement in the legs during periods of inactivity. It is not a compression device and does not use electrical stimulation.

Sensors on the device take readings of pulse, tissue oxygenation and fluid balance. These readings are used to determine the device's own activation timing and to display your session data in the application; they provide no health assessment, diagnosis, alert or risk evaluation.

ARCH V1 is positioned as a consumer wellness product. It is not a medical device, is not intended to diagnose, treat, cure or prevent any disease, and is not subject to medical device regulation. Sensor readings are not medical measurements and must not be used as a basis for any diagnostic or treatment decision.

03 / 14

Categories of Personal Data Processed

Depending on the nature of our relationship with you, we process the following categories of personal data:

Identity Data: First name, last name

Contact Data: E-mail address, telephone number (where shipping requires it), postal address

Customer Transaction Data: Order details, payment confirmation records, shipping information, product configuration preferences (for example calf measurement, colour selection)

Marketing Data: Your newsletter subscription preference

Special Categories of Personal Data: Pulse, tissue oxygenation (SpO2), bioimpedance and movement data measured by the ARCH V1 device may be treated as a special category of personal data (health data) under Article 6 of the KVKK, independently of how the product is positioned. The level of protection applied to this data is therefore higher than for other personal data. By design, this data remains on your device and on your paired phone; it is not transferred to ARCH's central servers.

Transaction Security Data: IP address, log records, cookie data, session information

Professional Data: Professional context such as occupation, company name and position for those who contact us as a distributor, partner, member of the press or investor

ARCH does not request, collect or store your medical history, the medication you use, your pregnancy status or any diagnosed health condition.

04 / 14

Purposes of Processing

Your personal data is processed for the following purposes:

• Delivering the products you order and providing our services
• Operating your ARCH V1 device and managing your mobile application account
• Responding to customer support requests
• Sending newsletters and product updates (only where you have chosen to receive them)
• Meeting tax, accounting and statutory record-keeping obligations arising from legislation
• Analysing anonymised and statistical data only, for the purpose of improving products and services
• Protecting rights in the event of a potential legal dispute
• Conducting commercial relationships with distributors, partners and business stakeholders

05 / 14

Legal Grounds for Processing

Under Articles 5 and 6 of the KVKK, your personal data is processed on the following legal grounds:

Necessary for the conclusion or performance of a contract (Art. 5/2-c): Processing your basic contact and shipping data in order to deliver the device you ordered, provide mobile application services and offer customer support.

Compliance with a legal obligation (Art. 5/2-ç): Retention obligations arising from the Tax Procedure Law, the Turkish Commercial Code and other legislation.

Establishment, exercise or protection of a right (Art. 5/2-e): Keeping records that may be used as legal evidence in the event of a potential dispute or claim.

Legitimate interest (Art. 5/2-f): Securing our website, detecting fraud, analysing anonymised data to improve our products, and communicating with B2B stakeholders.

Explicit consent (Art. 5/1 and Art. 6/2): Processing of sensor data (pulse, oxygenation, bioimpedance) by the device and the application, which may fall within the special categories of personal data under Article 6 of the KVKK, is only possible with your explicit consent. Explicit consent is also obtained for newsletter subscription, cookie use and optional profile data that may be added to the application in future (for example gender, weight).

06 / 14

Transfer of Personal Data

Domestic Transfers

Under Article 8 of the KVKK, your personal data may be transferred to the following parties for the purposes and on the legal grounds set out above:

• Payment service provider: To carry out the payment transaction for sales within Türkiye. This is a payment service provider subject to the legislation of the Republic of Türkiye and supervised by the BRSA (BDDK). Your payment data is processed domestically within this scope.
• Contracted courier company: To deliver the product
• Financial advisory and accounting service provider: To keep invoice and accounting records
• Authorised public institutions and bodies: Where required by a legal obligation
• Courts and lawyers: Where the establishment, exercise or protection of a right requires it

Your credit card number, expiry date and security code are never seen, recorded or stored by ARCH at any stage. This information is processed directly through the secure infrastructure of the payment service provider. International transaction traffic passing through card schemes (Visa, Mastercard and similar) falls within the payment service provider's own regulatory responsibility.

Transfers Abroad

Some of our service providers (Stripe, Netlify, Google, Apple, PledgeBox) are based in the United States. Your personal data is therefore transferred abroad within the scope of Article 9 of the KVKK.

Transfers abroad are carried out either on the basis of your explicit consent, or where they are necessary and unavoidable for the performance of the contract. Confidentiality agreements have been signed with the relevant suppliers to secure such transfers, and the data security practices of recipient organisations are assessed.

The main parties to whom transfers are made:

• Stripe Inc. (USA): Payment infrastructure
• PledgeBox (USA): Kickstarter backer survey and shipping logistics
• Netlify Inc. (USA): Website hosting and form data storage
• Google LLC (USA): Google Analytics, Google Sign-In
• Apple Inc. (USA): Apple Sign-In

07 / 14

Method of Collection

Your personal data is collected through our website (archtechnology.co), the ARCH mobile application, the ARCH V1 device, e-mail, telephone, our social media accounts and direct contact, by automated or partly automated means.

08 / 14

Retention Periods

Your personal data is retained for as long as the purpose of processing requires and in compliance with the minimum periods prescribed by the relevant legislation. General retention periods:

Once the retention period expires, the data is securely erased, destroyed or anonymised.

09 / 14

Rights of the Data Subject (KVKK Article 11)

Under Article 11 of the KVKK, as a data subject you have the right to:

• Learn whether your personal data is being processed
• Request information if your personal data has been processed
• Learn the purpose of processing and whether the data is used in accordance with that purpose
• Know the third parties in Türkiye or abroad to whom your personal data has been transferred
• Request rectification where your personal data has been processed incompletely or inaccurately
• Request the erasure or destruction of your personal data
• Request that any rectification, erasure or destruction be notified to third parties to whom your data was transferred
• Object to a result against you arising from the analysis of your processed data solely by automated systems
• Claim compensation where you suffer damage due to unlawful processing of your personal data

To exercise these rights, you may send your written request to privacy@archtechnology.co. Your request will be concluded within 30 days at the latest. We may request additional information to verify your identity.

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may also submit your request in writing or by the other methods determined by the Board.

If you are not satisfied with the response to your application, or if you receive no response, you have the right to lodge a complaint with the Personal Data Protection Board.

10 / 14

Data Security

ARCH takes technical and administrative measures to prevent the unlawful processing of, access to and transfer of your personal data. These measures include encryption in communication and storage infrastructure, access controls, careful selection of suppliers and regular review of security practices.

In the event of a personal data breach, notification will be made to the Personal Data Protection Board as soon as possible and within 72 hours at the latest under Article 12/5 of the KVKK, and affected data subjects will also be informed.

11 / 14

Important Safety Warning

The ARCH V1 device measures tissue resistance by passing a low-intensity electrical current across the skin through its bioimpedance sensor. The following safety warnings therefore apply.

When you must not use the product

Anyone with any of the following conditions must not use the ARCH V1 device:

When you must not use the product without medical approval

In the following situations, the device must not be used without first consulting your doctor:

These warnings do not relate to our personal data processing practices; they are product safety notices that apply to all users.

12 / 14

Children

ARCH products and services are not directed at persons under the age of 18. We do not knowingly collect personal data from persons under 18. If you become aware that a person under 18 has provided us with personal data, please contact us at privacy@archtechnology.co and we will carry out the necessary deletion.

13 / 14

Updates to This Notice

This notice may be updated where necessary. Updates are published on this page and the "Last updated" date is changed. Separate notification may also be given about significant changes.

14 / 14

Governing Law and Jurisdiction

This notice is governed by the laws of the Republic of Türkiye. The Istanbul Çağlayan Courts and Enforcement Offices have jurisdiction over any disputes arising.