PERSONAL DATA PROTECTION POLICY

PROTECTION OF PERSONAL DATA

In accordance with the Law on the Protection of Personal Data No. 6698 (“PPD” or “Law”), we can record, store, share with third parties and process your personal data in other ways permitted by the Law, in accordance with the framework determined in the PPD. The purpose of this text is to inform you about your rights under the Law and relevant legislation.

General Information on the Legislation

KVKK No. 6698 was published in the Official Gazette dated April 7, 2016 and constitutes the secondary regulation of the Law in order to protect the fundamental rights and freedoms of individuals, especially the privacy of private life, in the processing of personal data, and to regulate the obligations and the procedures and principles to be followed by real and legal persons who process personal data. The Regulation on the Deletion, Disposal or Anonymization of Personal Data (“Regulation”) entered into force after being published in the Official Gazette dated 28 October 2017.

Data Controller Information

In the capacity of Data Controller, we will use your personal data in accordance with the relevant legislation.

How can your Personal Data be processed?

In the capacity of Data Controller, your personal data you share with our company, provided that it is part of any data recording system that is fully or partially automated or non-automatic, all kinds of operations performed on them such as obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making it available, classifying or preventing its use can be made by us.

What are the purposes and legal reasons for the processing of your personal data?

We will process the personal data you share with us in accordance with the PPD and relevant legislation in order to perform the services we provide in accordance with the requirements of the contract and technology, and to improve the products and services we offer you.

Information on the persons or organizations to whom we can transfer your personal data

For the above-mentioned purposes, our main shareholder, our direct/indirect domestic/foreign affiliates, the program partner organizations, domestic/international organizations and other third parties, from which we receive services, cooperate to carry out our activities, including the persons/organizations and their affiliates to whom your personal data you shared with us can be transferred.

How is your personal data collected?

Your personal data can be collected verbally, in writing or electronically through company visits, interviews and meetings with the Company, website, sales and marketing department and purchasing department employees, forms collected during customer visits, e-mail correspondence, personnel file data, digital channels.

What are your rights under PPD?

In accordance with Article 11 of the Law, which regulates your rights, your rights are as follows:

(1) Everyone can apply to the data controller about the followings about himself/herself:

a) Learning whether personal data is processed or not,

b) If personal data has been processed, requesting information about it,

c) Learning the purpose of processing personal data and whether they are used in accordance with its purpose,

d) To know the third parties to whom personal data is transferred in the country or abroad,

e) Requesting correction of personal data in case of incomplete or incorrect processing,

f) Requesting the deletion or disposal of personal data within the framework of the conditions stipulated in Article 7,

g) Requesting notification of the transactions made pursuant to subparagraphs (d) and (e) to third parties to whom personal data has been transferred,

h) Objecting to the emergence of a result against the person himself by analyzing the processed data exclusively through automated systems,

i) To request the compensation of the damage in case of loss due to unlawful processing of personal data.

PERSONAL DATA RETENTION AND DISPOSAL POLICY

Introduction and Purpose of Policy Preparation

In order to fulfill our obligations, this Personal Data Retention and Disposal Policy was prepared by as data controller by Özlem Karadağ Köse, to inform data owners about the principles of determining the maximum storage period required for the purpose for which your personal data is processed, and the processes of deletion, disposal and anonymization in accordance with PPD and Regulations.

Definitions

Open Consent: Consent on a specific subject, based on information and expressed with free will.

Application form: It refers to the attached application form prepared for the Data Owner to exercise their rights pursuant to Article 11 of the Law on the Protection of Personal Data and to apply to the Company for this purpose.

Audit Firm: It refers to persons who in order to obtain sufficient and appropriate independent audit evidence that will provide reasonable assurance regarding the compliance and accuracy of the company's financial statements and other financial information with financial reporting standards, by applying the necessary independent auditing techniques stipulated in the auditing standards, by auditing and evaluating over the books, records and documents, and linking them to the report; authorized by the Public Oversight, Accounting and Auditing Standards Authority, among the professionals holding the certificate of certified public accountant or certified public accountant, to conduct independent audits.

User in Relation: Except for the person or unit responsible for technical storage, protection and backup of the data, they are the persons who process personal data within the organization of the data controller or in line with the authorization and instruction received from the data controller.

Disposal: Deletion, disposal or anonymization of personal data.

Recording Media: Any environment in which personal data is processed wholly or partially automatically or by non-automatic means provided that it is a part of any data recording system.

Company in Relation: Other companies in which the shareholders of the company have sufficient direct or indirect shareholders to control the company or take part in its management.

Personal Data: Any information relating to an identified or identifiable natural person.

Processing of Personal Data: Obtaining personal data completely or partially automatically or by non-automatic means provided that it is a part of any data recording system, all kinds of operations performed on data such as recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making it available, classifying or preventing its use.

Anonymization of Personal Data: Making personal data incapable of being associated with an identified or identifiable natural person under any circumstances, even by matching with other data.

Deletion of Personal Data: Deletion of personal data, making personal data inaccessible and unusable for Relevant Users in any way.

Disposal of Personal Data: The process of making personal data inaccessible, irretrievable and unusable by anyone in any way.

Board: Personal Data Protection Board.

Special Qualified Personal Data: Data regarding race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, costume and clothing, membership to associations, foundations or unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data of individuals.

Periodic Disposal: The deletion, disposal or anonymization process, which will be carried out ex officio at repetitive intervals and specified in the personal data storage and disposal policy, in the event that all of the personal data processing conditions in the Law are eliminated.

Data Owner/Person in Relation: The natural person whose personal data is processed.

Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

Personal Data Processing Inventory: Personal data processing activities carried out by data controllers depending on their business processes; The inventory, which is created by associating the personal data processing purposes and legal reason, the data category, the transferred recipient group and the data subject group, by explaining the maximum storage period required for the purposes for which the personal data is processed, the personal data to be transferred to foreign countries and the measures taken regarding data security.

Scope and Modification of the Policy

This policy contains information in accordance with the Law and other legislation regarding personal data and will enter into force on the date of publication. The policy may be updated from time to time due to legal changes and changes in the Company's processing of Personal Data or for other reasons. Updates are valid as of the date of publication and you can always obtain the updated policy from the addresses of the Company in the application form, physically or by e-mail.

Conditions of Personal Data Processing Activity

Personal Data cannot be processed without the explicit consent of the Data Owner in accordance with Article 5 of the Law, but the exception to this situation is regulated in the same article. Accordingly, it is possible to process personal data without seeking the explicit consent of the Data Owner in the following cases:

• It is expressly provided for by the laws.
• It is necessary for the protection of life or physical integrity of the person himself/herself or of any other person, who is unable to explain his/her consent due to the physical disability or whose consent is not deemed legally valid.
• Processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract.
• It is necessary for compliance with a legal obligation to which the data controller is subject.
• Personal data have been made public by the data subject himself/herself.
• Data processing is necessary for the establishment, exercise or protection of any right.
• Processing of data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject.

Processing of Private Personal Data

Pursuant to Article 6 of the Law, it is prohibited to process Special Personal Data without the explicit consent of the person concerned. However, personal data other than health and sexual life may be processed without seeking the explicit consent of the Data Owner in cases stipulated by the laws.

Personal Data related to health and sexual life can only be used for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, without seeking the explicit consent of the person concerned, or by authorized institutions and organizations who are under the obligation to keep secrets.

In the processing of special quality Personal Data, it is also necessary to take adequate measures determined by the Board.

Purposes of Processing Personal Data

• Negotiation, conclusion and performance of contracts,
• Providing products and services,
• Customizing the offered products and services in accordance with the demands; updating, developing due to customer needs, legal and technical developments,
• Making user definitions for the systems specific to the products and services offered,
• Announcing new or existing products, services and campaigns, conducting sales and marketing activities,
• Conducting market research,
• Creating statistics and analyzing usage,
• Payment of product, service and service fees, collection, selection of collection method,
• Providing contact/communication,
• Executing commercial relations with cooperating companies, suppliers, resellers and service providers,
• Reporting within the framework of cooperation,
• Developing and planning the commercial strategies of the Company and the Group,
• Communicating for the satisfaction measurement surveys of the Company and the Group,
• Management of judicial/administrative processes, responding to requests from public institutions, fulfilling legal obligations depending on legal regulations, resolving legal disputes,
• Managing investor relations,
• Conducting job interviews, evaluating job applications,
• Establishment, execution and termination of the employment relationship/contract,
• Making the employees benefit from the basic and fringe benefits arising from the employment contracts, evaluating their performance and work,
• Opening a user account, providing company entrance-exit and catering services and issuing meal cards to the employees through the method of creating an internal identity, fingerprint reader, biometric data,
• Follow-up of company pool vehicles,
• In case of participation in an organization on behalf of the company, creating the participant registration,
• Participation of employees in trainings and creation of certificate records,
• Creating and tracking visitor records,
• Ensuring the safety of the company's internal and environmental safety and occupational safety practices,
• Creating personal data inventory,
• Evaluating and responding to all questions, requests, suggestions, complaints and applications submitted in writing, verbally or electronically, including those related to personal data.

Principles

Compliance with the law and honesty rules: Personal Data is not collected or processed without the knowledge of the Data Owner; Personal Data is processed in accordance with the law, the Code and the relevant legislation.

Being accurate and up-to-date when needed: The Company makes every effort to ensure that Personal Data is accurate and up-to-date. In this context, in order to ensure the accuracy and up-to-dateness of the data, it keeps the channels open to ensure this situation and ensures that the data are corrected upon the application of the Data Owner or ex officio in case of detection.

Processing for specific, explicit and legitimate purposes: Our purposes for processing Personal Data have been clearly determined as a requirement of the disclosure obligation. The Company processes Personal Data for legitimate purposes in connection with the work it does and/or the services it provides, in accordance with the Law.

Being connected, limited and proportionate to the purpose for which they are processed: The Company processes Personal Data for specific, clear and legitimate purposes and in this context, ensures that the data is collected for the purposes specified in this Policy or in the permission to be obtained from the Data Owner (Explicit Consent), and is kept for the period necessary for the purpose and avoids the processing of Personal Data that is not related to the realization of the purpose and/or is not needed.

Storage for the period required by the relevant legislation or for the purpose for which they are processed: If there is a certain period stipulated in the legislation for the storage of Personal Data, this period is complied with. If such a period has not been determined, Personal Data will only be retained for the period necessary for the purpose for which they are processed.

Explanations Regarding the Reasons Requiring Storage and Disposal

Personal data belonging to data owners must be kept securely in physical or electronic environments by the Company in order to (i) maintain commercial activities, (ii) fulfill legal obligations, (iii) plan and perform employee rights and fringe benefits, and (iv) manage customer relations. They are stored within the limits specified in the PPD and other relevant legislation.

The reasons for storing it are as follows:

a. Storing personal data as it is directly related to the establishment and performance of contracts,

b. Storing personal data for the purpose of establishing, exercising or protecting a right,

c. It is mandatory to keep personal data for our legitimate interests, provided that it does not harm the fundamental rights and freedoms of individuals,

d. Storing personal data in order to fulfill any legal obligation,

e. Explicitly stipulating the storage of personal data in the legislation,

f. Explicit consent of data owners in terms of storage activities that require the explicit consent of data owners.

In accordance with the Regulation, the personal data of the data owners are deleted, disposed of or anonymized by the Company ex officio or upon request in the following cases:

a. Changing or repealing the provisions of the relevant legislation, which is the basis for the processing or storage of personal data,

b. The disappearance of the purpose that requires the processing or storage of personal data,

c. Elimination of the conditions requiring the processing of personal data in Articles 5 and 6 of the Law.

d. In cases where the processing of personal data takes place only on the basis of explicit consent, the data subject withdraws his/her consent,

e. The data controller accepts the application made by the data subject regarding the deletion, disposal or anonymization of his/her personal data within the framework of his/her rights in subparagraphs (e) and (f) of Article 11 of the Law,

f. In cases where the data controller rejects the application made by the data subject to the request for the deletion, disposal or anonymization of his/her personal data, his/her response is found to be insufficient or he/she does not respond within the time stipulated in the Law; Complaining to the Board and approval of this request by the Board,

g. Although the maximum period for keeping personal data has passed, there are no conditions to justify keeping personal data for a longer period of time,

Storage and Disposal Periods

The following criteria are used to determine the retention and destruction periods of your personal data obtained in accordance with the provisions of the PPD and other relevant legislation:

1. If a period of time is stipulated in the legislation regarding the storage of the personal data in question, this period shall be complied with. After the expiry of the aforementioned period, the data is processed within the scope of the second paragraph.

a. Personal data is classified as personal data and sensitive personal data, based on the definition in Article 6 of the PPD. All personal data determined to be of a private nature will be disposed.

b. Compliance of data storage with the principles specified in Article 4 of the PPD, for example, is questioned whether there is a legitimate purpose in keeping the data, such as being evidence in the case. Data that are detected to be kept in violation of the principles set forth in Article 4 of the PPD are deleted, disposed or anonymized.

c. It is determined which of the exceptions stipulated in Articles 5 and 6 of the PPD that data storage can be evaluated within the scope of them. Within the framework of the detected exceptions, reasonable periods for data storage are determined. In the event that the said periods expire, the data is deleted, disposed or anonymized.

Personal data, whose storage period has expired, is destroyed in 6-month periods in accordance with the procedures set forth in this Policy.

All transactions regarding the deletion, disposal and anonymization of personal data are recorded and these records are kept for at least three years, excluding other legal obligations.

Procedures for Storage and Disposal of Personal Data

I. Recording Media

The personal data of the data owners are safely stored by the Company in the environments listed in the table below, in accordance with the relevant legislation, especially the provisions of the PPD, and within the framework of international data security principles:

Electronic media:	Physical environments:
EXCHANGE SERVER (cloud), FILE SERVER, CRM SERVER Servers Softwares Printer, scanner, copier Personal computers Mobile devices Removable memories	Unit Cabinets ARCHIVE

II. Technical and Administrative Measures

All the administrative and technical measures taken by the Company within the framework of the principles in Article 12 of the PPD in order to keep your personal data safe, to process it unlawfully, to prevent its access and to destroy the data in accordance with the law are listed below:

a. Administrative Measures:

Within the scope of administrative measures;

a. Internal access to the stored personal data is limited to the personnel required to access it as per the job description. In limiting access, whether the data is of special nature and its importance are also taken into account.

b. In case the processed personal data is obtained by others unlawfully, this situation is notified to the relevant person and the Board as soon as possible.

c. With regard to the sharing of personal data, a framework agreement is signed with the persons to whom personal data is shared and data security is ensured by the provisions added to the existing agreement regarding the protection of personal data and data security.

d. Personnel who are knowledgeable and experienced about the processing of personal data are employed and necessary trainings are given to the personnel within the scope of personal data protection legislation and data security.

e. In order to ensure the implementation of the provisions of the Law, necessary inspections are made. Confidentiality and security vulnerabilities revealed as a result of audits are resolved.

f. In case of receiving custody service outside its own legal entity, it is ensured by making contractual provisions that those who provide storage and destruction services will also provide services subject to both the regulations specified in this Policy and the provisions of all legislation in general.

b. Technical Measures:

Within the scope of technical measures;

a. Kurulan sistemler kapsamında gerekli iç kontrolleri yapar.

b. Information technology risk assessment and business impact analysis processes are carried out within the scope of established systems.

c. It is ensured that the technical infrastructure is provided to prevent or monitor the leakage of data outside the institution and the relevant matrices are created.

d. System vulnerabilities are checked by receiving penetration testing service regularly and when needed.

e. It is ensured that the access authorizations of the employees in the information technology units are kept under control.

f. The disposal of personal data is ensured in a way that cannot be recycled and leaves no audit trail.

g. Pursuant to Article 12 of the Law, all kinds of digital media where personal data are stored are protected by encrypted or cryptographic methods to meet information security requirements.

III. Personnel

You can reach the titles, units and job descriptions of the personnel involved in the personal data storage and destruction process by requesting them via the Application Form.

IV. Disposal Procedures of Personal Data

Personal data obtained in accordance with the PPD and other relevant legislation will be dipsosed by the following techniques in accordance with the provisions of the Law and relevant legislation, ex officio or upon the application of the Relevant Person, in case the personal data processing purposes listed in the Law and Regulation are no longer valid.

a. Deletion and Disposal Techniques of Personal Data:

Safely Delete from Software: In case of agreement with the system administrator or an expert for the deletion of personal data, the data processed by the said expert through fully or partially automated means and stored in digital media are deleted, while the access right defined for the Relevant Users is also removed.

However, if the deletion of personal data will result in the inaccessibility of other data within the system and the inability to use this data, the personal data will also be deemed deleted if the personal data is archived in a way that cannot be associated with the data subject, provided that the following conditions are met.

• It is closed to the access of any other institution, organization or natural person,

• Taking all necessary technical and administrative measures to ensure that personal data can only be accessed by authorized persons.

Blackening of Personal Data in Paper Media: It is a method of removing the personal data from the document by physically cutting it or making it invisible by using fixed ink in a way that cannot be recovered and read with technological solutions in order to prevent the use of personal data for non-purpose or to delete the data requested to be deleted, or to blacken it by scratching, painting or deleting.

Disposal of Personal Data:

De-magnetizing: It is a method of corrupting the data on it in an unreadable way by passing the magnetic media through special devices where it will be exposed to high magnetic fields. It should be noted that if disposal with this method is not successful, only the physical destruction of the media will be able to complete the disposal.

Physical Disposal: Provided that it is a part of the data recording system, personal data processed by non-automatic means are destroyed, while the system of physical disposal of the data is applied so that it cannot be used later.

Overwrite: The overwrite method is a data disposal method that makes it impossible to read and recover old data by writing random data over magnetic media and rewritable optical media by means of special software.

b. Techniques for Anonymization of Personal Data:

Anonymization of personal data means that personal data cannot be associated with an identified or identifiable natural person under any circumstances, even if it is matched with other data. In order for personal data to be anonymized, personal data must be rendered unrelated to an identified or identifiable natural person, even by using appropriate techniques for the recording medium and the relevant field of activity, such as returning the personal data by the data controller or third parties and/or matching the data with other data.

Anonymization Methods That Do Not Provide Value Distortion: These are the methods of anonymization applied by generalizing any personal data group, replacing each other or removing a certain data or sub-data group from the group without any change or addition/removal of the personal data being stored.

Anonymization Methods That Provide Value Distortion

Variable Subtraction: The existing data set is anonymized by subtracting the "high degree descriptive" variables from the variables in the data set created after the data collected through the extraction method of descriptive data.

Records Subtraction: The data line containing singularity among the data is removed from the records and the stored data is anonymized. For example, if there is only one senior manager in a company, the remaining data can be anonymized by removing the data belonging to this person from the records where the seniority, salary and gender data of the employees at the same level are kept.

Regional Hiding: Since a single data creates a barely visible combination, hiding the relevant data (for example, writing "unknown") provides anonymization if it has a determinative quality.

Lower and Upper Limit Coding: It is anonymized by combining the values in a data group with predefined categories by determining a certain criterion.

Generalization: With the data aggregation method, many data are aggregated and personal data is rendered unrelated to any person.

Global Coding: With the data derivation method, a more general content than the content of the personal data is created and the personal data is rendered incapable of being associated with any person.

Noise Adding: The method of noise adding to the data is anonymized by adding some positive or negative deviations to the existing data at a determined rate, especially in a data set where numerical data are predominant. For example, in a data set with weight values (+/−) 3 kg deviation is used to prevent the real values from being displayed and the data is anonymized. The deviation applies equally to each value.

Micro Aggregation: In the micro-aggregation method, all data will first be grouped in a meaningful order (from large to small) and the value obtained by taking the average of the groups will be written instead of the relevant data in the current group, thus providing anonymity. For example, for salary information; If two groups are made with a salary of less than or equal to 10,000 TL, the sum of the salaries of the people with a salary of 10,000 or less is divided by the number of people, and this value obtained is written in the salary set of everyone with a salary of less than 10,000 TL.

Data Exchange: In the data exchange method, the values of a variable are exchanged between the pairs selected from the stored data. In this method, which is used for data that can be categorized in general, the aim is to transform the database by interchanging the data of the data owners.

Pursuant to Article 28 of the PPD, if personal data is processed for purposes such as research, planning and statistics by anonymizing with official statistics, this situation will be outside the scope of the Law and express consent will not be required.

Transfer of Personal Data

Transfer of Personal Data Domestic

Pursuant to Article 8 of the Law, as a rule, Personal Data cannot be transferred to third parties without the explicit consent of the Data Owner. However, in the same article of the Law, in case of one of the situations in which the explicit consent of the Data Owner is not required, it is possible to transfer the Personal Data to third parties in the country without the explicit consent of the Data Owner.

Transfer of Personal Data Abroad

Pursuant to Article 9 of the Law, as a rule, Personal Data cannot be transferred abroad without the explicit consent of the Data Owner. However, if one of the following conditions exists, it is possible to transfer the Personal Data to third parties abroad without seeking the explicit consent of the Data Owner:

• In cases where it is stated in this Policy that the consent of the Data Owner will not be sought

• Having adequate protection in the foreign country where Personal Data will be transferred,

• In the absence of adequate protection, data controllers in Turkey and in the relevant foreign country undertake in writing to provide adequate protection and the Board has permission.

Countries with adequate protection are determined and announced by the Board. Personal Data may be transferred abroad with the permission of the Board, only after obtaining the opinion of the relevant public institution or organization, in cases where the interests of Turkey or the Data Owner will be seriously harmed, without prejudice to the provisions of international agreements.

Third Parties to whom Personal Data may be Transferred

Personal Data may be transferred to the following third parties, who may be natural or legal persons, in Turkey or abroad, in accordance with Articles 8 and 9 of the Law, in order to realize the purposes set forth in this Policy:

• Consultants
• Audit Firms
• Service Provider Companies
• Collaborating Companies
• Customers
• Shareholders and affiliates and subsidiaries
• Suppliers
• Banks and Financial Institutions
• Judicial and Public Authorities

Other Considerations

In case of inconsistency between PPD and other relevant legislation provisions and this Policy, PPD and other relevant legislation provisions will be applied first.

Requests sent to the Company with the Application Form regarding the above issues will be answered free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, the fee in the tariff determined by the Board may be charged. In case the data subject to the request has been transferred to third parties, this situation is notified to the third party to which the data is transferred and necessary actions are taken before the third parties.