GDPR Information Notice

1. Collection, Processing and Processing Purposes of Personal Data

Your personal data may vary depending on the services and activities provided by our Company. This data;

• Through automatic or non-automatic methods
• In one-on-one meetings by our Company employees
• Through our website, mobile application, call center, e-mail, text message, digital forms and similar electronic communication channels
• Can be collected verbally, in writing or electronically

In addition, as long as your relationship with the Company continues, your personal data may be processed by being updated and stored in electronic or physical environments for the period specified in the relevant legislation or necessary for the purposes for which they are processed.

All necessary technical and administrative measures are taken for the protection and security of your personal data.

Your personal data is processed for the following purposes:

• Fulfillment of legal obligations
• Ensuring the legal and commercial security of real or legal persons who have any commercial, business or service relationship with the Company
• Establishment and performance of contracts
• Management of internal operations, applications, processes and activities of the Company
• Creation and management of system accounts
• Improving service quality and user experience
• Conducting business partnerships
• Providing information to competent public institutions and organizations when necessary

2. Transfer of Personal Data

Your collected personal data may be transferred to the following persons and institutions in accordance with articles 8 and 9 of the GDPR for the purposes specified above:

• To our business partners
• To our shareholders
• To our subsidiaries
• To supplier and subcontractor companies from which we receive services or to which we provide services
• To banks and financial institutions
• To third parties from whom support services are received
• To public institutions and organizations for the purpose of fulfilling legal obligations, to law enforcement and judicial authorities

Data transfer abroad is possible only in the following cases pursuant to Article 9 of the GDPR:

• Being included in the list of countries with adequate protection
• In case of insufficient protection, the relevant data controllers provide written adequate protection commitment and obtain Board permission

The list of 'countries with adequate protection' determined by the Board is taken as basis. In special cases such as international agreements or public interest, overseas transfer can be made with the approval of the Board by taking the opinion of the relevant public institutions.

3. Collection Method and Legal Reason of Personal Data

Your personal data;

• Through channels such as our website, mobile application, online forms, contracts, call center calls, correspondence, social media accounts
• Verbally, in writing or electronically
• It is collected so that our Company can provide its services and fulfill its contractual and legal obligations

Your collected personal data is processed in accordance with the personal data processing conditions in articles 5 and 6 of the GDPR. In this context;

• Having explicit consent
• Being explicitly provided for in laws
• Establishment or performance of the contract
• The Company's fulfillment of its legal obligation
• The personal data being made public by the relevant person
• Establishing, using or protecting a right
• In cases such as the Company's legitimate interest and the principle of not harming fundamental rights, personal data can also be processed without seeking explicit consent

Your special category personal data can only be processed with your explicit consent. Special category data other than health can also be processed without explicit consent in cases provided by law.

4. Rights of the Data Subject (GDPR Art. 11)

As a personal data subject, you have the following rights pursuant to Article 11 of the GDPR:

• Learning whether your personal data is processed
• Requesting information about it if it has been processed
• Learning the purpose of processing and whether they are used in accordance with this purpose
• Learning the third parties to whom your personal data is transferred domestically or abroad
• Requesting correction of your incompletely or incorrectly processed data
• Requesting deletion or destruction of personal data within the conditions provided in the GDPR
• Requesting that these transactions be notified to third parties to whom your personal data has been transferred
• Objecting to a result against you arising from the analysis of processed data through automatic systems, Requesting compensation for damages in case you suffer damage due to the unlawful processing of your personal data

5. Application Method

If you want to exercise your rights within the scope of GDPR, you can contact us through one of the following communication channels:

• With written application (wet signature)
• Through Registered Electronic Mail (REM) address
• Through [email protected] email address with your email address registered in the system
• By another method determined by the Personal Data Protection Board

In your application, you must clearly state the documents that will verify your identity and your request.