KVKK Privacy Notice

Privacy Notice Pursuant to the Personal Data Protection Law No. 6698

Pursuant to the Personal Data Protection Law No. 6698 (“KVKK”), our Company, in its capacity as the Data Controller, will process your personal data—for business purposes—by using, recording, storing, updating, transferring, and/or classifying it within the framework described below. In this context, in accordance with the Law and Regulations enacted to protect individuals’ fundamental rights and freedoms—particularly the right to privacy—and to ensure the protection of personal data, our Company takes all necessary technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of your personal data, prevent unauthorized access to such data, and ensure its secure retention. The target audience of this document includes all natural persons whose personal data is processed by our Company, excluding our Company’s employees or job applicants who have applied to our Company. The personal data processed in our capacity as the data controller is listed below, though this list is not limited to the items specified here: First name, last name, Turkish ID number, address, phone number, email address, signature, physical location/security video recordings, call center/service quality audio recordings, bank account number, cookie records.

Purposes and legal grounds for processing personal data; Personal data shared by you;

• To enable you and/or the institutions and organizations you represent to benefit from the products and services offered by our Company; to determine and implement our Company’s commercial and business strategies; to conduct marketing activities; and to carry out necessary work, including but not limited to business development and planning activities;

• To carry out administrative operations related to communication conducted by our company,

• To ensure the physical security and oversight of the Company’s facilities,

• Establishing relationships with business partners, customers, and suppliers (including their authorized representatives or employees),

• Ensuring compliance with contractual requirements and financial agreements regarding products and services provided in collaboration with our business partners, suppliers, or other third parties,

• Implementation of our company’s human resources policies,

• Calls to our company’s call center or use of our website,

• Participation in training sessions, seminars, or events organized by our company

will be processed for these purposes.

Methods of collecting and storing personal data: The personal data you share with our company may be collected verbally, in writing, or electronically—using automated or non-automated methods—through offices, branches, the call center, the website, social media platforms, mobile applications, and similar channels. Your personal data will be stored in electronic and/or physical environments. To ensure that your personal data, which is obtained and stored by our Company, is not exposed to unauthorized access, manipulated, lost, or damaged in the environments where it is stored, we implement the necessary business process designs and technical security infrastructure enhancements.

Your personal data will be processed in accordance with all necessary information security measures, provided that it is not used beyond the purposes and scope disclosed to you, and will be stored and processed for the duration of the statutory retention period or, if no such period is specified, for as long as required by the purpose of processing. Upon the expiration of this period, your personal data will be removed from our Company’s data flows through methods such as deletion, destruction, or anonymization.

Transfer of Personal Data;

Your personal data will be transferred, within the scope of the Laws and other applicable regulations and for the purposes disclosed, to:

• To companies and representatives authorized by us to act on behalf of and for the account of our Company,

• Regulatory and supervisory authorities, as well as public institutions or organizations explicitly authorized by the laws governing your personal data to request such information;

• Business partners, suppliers, and contractors; banks; credit risk and financial institutions; and other natural or legal persons, within the scope of the specified purposes;

• Tax and similar advisors, persons, institutions, and organizations required to participate in legal proceedings, and third parties from whom we receive consulting services—including auditors—and, without limitation, both domestically and internationally, may be transferred to business partners, third-party service providers, authorized individuals, and organizations for the purposes specified above.

Your rights under Article 11 of the KVKK:

By contacting our company, you have the right to:

1. whether it has been processed or not,

1. If processed, to request information,

1. To learn the purpose of the processing and whether it is being used in accordance with that purpose,

1. To know the third parties to whom your data has been transferred within or outside the country,

1. Request that it be corrected if it has been processed incompletely or incorrectly,

1. Requesting that the data be erased or destroyed in accordance with the conditions set forth in Article 7 of the KVKK,

1. To request that the third parties to whom your data has been transferred be notified of the actions taken pursuant to subparagraphs (e) and (f) above,

1. To object to a decision made solely through automated processing that results in adverse consequences for you,

1. You have the right to request compensation for damages if you have suffered harm due to the unlawful processing of your personal data.

Pursuant to the first paragraph of Article 13 of the Personal Data Protection Law, you may submit your request to exercise the rights listed above to our Company in writing or through other methods determined by the Personal Data Protection Board. To exercise the rights listed above, you may submit your request in person along with the necessary information to verify your identity, send it via a notary public or through other methods determined by the Personal Data Protection Board, or submit it with a secure electronic signature to [email protected].