PERSONAL DATA PROTECTION POLICY

In accordance with the Personal Data Protection Law No. 6698 (“KVKK”), your personal data will be processed by our Association, as the Data Controller, for business purposes, within the framework described below, by means of being used, recorded, stored, updated, transferred, and/or classified. In this context, in accordance with the Law and Regulations enacted to protect the fundamental rights and freedoms of individuals, particularly the privacy of private life, and to protect personal data, our Association takes all technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of your personal data, prevent unlawful access to it, and ensure its preservation.

The target audience of this text is all individuals whose personal data is processed by our Association, excluding our Association employees or job applicants who have applied to our Association.

Personal data processed in our capacity as data controller includes, but is not limited to, the following:

Name, surname, Turkish ID number, address, telephone number, email address, signature, physical location/security camera footage, call center/service quality audio recordings, bank account number, cookie records

The purposes and legal grounds for processing personal data; Your personal data shared by you;

• To enable you and/or the institutions and organizations you represent to benefit from the products and services offered by our Association, to determine and implement our Association's commercial and business strategies, to carry out marketing activities, to conduct business development and planning activities, and to carry out other necessary work, including but not limited to these activities,

• To carry out administrative operations related to communications conducted by our Association,

• To ensure the physical security and control of locations used by our Association,

• Establishing relationships with business partners/customers/suppliers (authorized persons or employees),

• Ensuring the contractual requirements and financial reconciliation for products and services provided jointly with our business partners, suppliers, or other third parties,

• Implementing our Association's human resources policies,

• Calling our Association's call center or using our website

and/or

• Participation in training, seminars, or events organized by our association.
Method of collecting and storing personal data: The personal data you share with our Association may be collected verbally, in writing, or electronically through automated or non-automated methods, via offices, branches, call centers, websites, social media platforms, mobile applications, and similar means. Your personal data will be stored in electronic and/or physical environments. The necessary business processes and technical security infrastructure developments are implemented to ensure that your personal data provided and stored by our Association is not exposed to unauthorized access, manipulation, loss, or damage in the environments where it is stored.

Your personal data will be processed with all necessary information security measures taken, provided that it is not used for purposes and within the scope other than those notified to you, and will be stored and processed for the legal retention period or, if no such period is specified, for the period required for the purpose of processing. Upon expiration of this period, your personal data will be removed from our Association's data flows through deletion, destruction, or anonymization methods.

Transfer of Personal Data;

Your personal data will be transferred, within the scope of the Laws and other legislation and for the purposes stated, to:

• Türk Telekomünikasyon A.Ş. and Türk Telekomünikasyon group companies,

• Companies and representatives authorized by us, acting on behalf of and for the account of our Association,

• Regulatory and supervisory authorities, public institutions or organizations authorized to explicitly request your personal data under the laws to which they are subject,

• Business partners, supplier and contractor companies, banks, credit risk and financial institutions, and other real or legal persons within the scope of the stated purposes,

• Tax and similar advisors, persons required for legal follow-up processes, institutions and organizations, and third parties from whom we receive consultancy services, including auditors, and without limitation, business partners, third parties from whom services are obtained, authorized persons and organizations within and outside the country for the purposes specified above.

Your rights under Article 11 of the KVKK: By applying to our Association, you may request your personal data;

1. Determining whether your personal data has been processed,

2. Requesting information if it has been processed,

3. Determining the purpose of processing and whether it is being used for that purpose,

4. Knowing the third parties to whom it has been transferred within or outside the country,

5. Requesting correction if it has been processed incompletely or incorrectly,

6. Requesting its deletion/destruction in accordance with the conditions set forth in Article 7 of the KVKK,

7. Request notification to third parties to whom your data has been transferred regarding the actions taken in accordance with clauses (e) and (f) above,

8. Object to a result that is detrimental to you due to analysis exclusively by automated systems,

9. Request compensation for damages incurred due to unlawful processing of your data.

Pursuant to the first paragraph of Article 13 of the KVK Law, you may submit your request to exercise your rights as described above to our Association in writing or by other methods determined by the Personal Data Protection Board.

To exercise your rights mentioned above, you may personally deliver your request letter with the necessary information identifying your identity, send it through a notary public or by other methods determined by the Personal Data Protection Board, or send it securely with an electronic signature to the @ address.