PERSONAL DATA PROTECTION POLICY

In accordance with the Law No. 6698 on the Protection of Personal Data (KVKK), as the Data Controller, your personal data will be processed, recorded, stored, updated, transferred, and/or classified in connection with business purposes, as outlined below. In this context, our company takes all necessary technical and administrative measures to ensure the protection of your personal data in compliance with the Law and Regulations, which are designed to protect individuals' fundamental rights and freedoms, especially the privacy of private life, and prevent the unlawful processing, access, and retention of personal data.

This document targets all real persons whose personal data are processed by our company, except for our employees and job applicants.

As the data controller, personal data processed by our company include, but are not limited to, the following:

• First name, last name, Turkish ID number, address, phone number, email address, signature, physical space/security camera recordings, call center/service quality voice recordings, bank account number, cookie records.

Purposes and Legal Grounds for Processing Personal Data:

The personal data you share will be processed for the following purposes, including but not limited to:

• To enable you and/or the organization you represent to benefit from the products and services offered by our company,

• To determine and implement our company’s commercial and business strategies,

• To conduct marketing activities,

• To carry out business development and planning activities,

• To manage administrative operations related to communication within our company,

• To ensure the physical security and control of the locations used by our company,

• To establish relationships with business partners/customers/suppliers (authorized persons or employees),

• To ensure the contractual and financial reconciliation with business partners, suppliers, and other third parties regarding the products and services provided in cooperation with them,

• To implement our company’s human resources policies,

• To handle the use of our call center or website and/or participation in the training, seminars, or events organized by our company.

Methods of Collection and Storage of Personal Data:

Your personal data may be collected through both automatic and non-automatic means via offices, branches, call centers, websites, social media channels, mobile applications, and similar channels, either orally, in writing, or electronically. Your personal data will be stored in both electronic and/or physical environments. Necessary security measures will be implemented to prevent unauthorized access, manipulation, loss, or damage to your personal data stored in these environments.

Transfer of Personal Data:

Your personal data may be transferred, within the scope of the law, for the purposes mentioned above:

• To Türk Telekomünikasyon A.Ş. and its group companies,

• To companies and representatives authorized by our company,

• To regulatory and supervisory authorities,

• To public institutions and organizations authorized to request your personal data by applicable laws,

• To business partners, suppliers, contractors, banks, credit risk, and financial institutions, and other real or legal persons,

• To tax and similar consultants,

• To third parties from whom we receive consultancy services, including auditors and others in connection with mandatory legal processes.

Your Rights Under the KVKK (Article 11):

You have the following rights regarding your personal data:

• To learn whether your personal data is being processed,

• To request information if your data is processed,

• To learn the purpose of processing your personal data and whether it is used in accordance with that purpose,

• To know the third parties to whom your personal data has been transferred domestically or abroad,

• To request the correction of incomplete or incorrect data,

• To request the deletion or destruction of your personal data under the conditions specified in Article 7 of the KVKK,

• To request the notification of any corrections or deletions made to the third parties to whom your personal data has been transferred,

• To object to any results that may occur due to the exclusively automatic processing of your data, which affects you negatively,

• To request compensation for damages caused by unlawful processing of your personal data.

According to Article 13, paragraph 1 of the KVKK, you may submit your request to exercise your rights, either in writing or through other methods specified by the Personal Data Protection Board. To use these rights, you can deliver your request, including identity-verifying information, either in person, through notary, or via secure electronic signature.