GDPR Clarification Text

Purposes of Processing Personal Data

The personal data processed by us may be used for the following purposes:

1. Providing and improving our services,
2. Fulfilling legal obligations,
3. Conducting communication activities,
4. Marketing and analysis activities.

Processed Personal Data

The types of personal data we process are as follows:

INTRODUCTION

This information notice has been prepared to inform you about the processing, storage, and protection of your personal data in accordance with Law No. 6698 on the Protection of Personal Data ("GDPR").

PURPOSES OF PROCESSING PERSONAL DATA

Your personal data may be processed in compliance with GDPR and relevant regulations for the following purposes:

• Fulfilling legal and contractual obligations,
• Providing services and managing operational processes,
• Evaluating and responding to requests from data subjects,
• Managing information security processes,
• Sharing necessary information with public authorities within the scope of legal regulations,
• Conducting business activities and audits,
• Managing financial and accounting processes,
• Conducting marketing and advertising activities,
• Ensuring customer satisfaction and addressing customer requests.

METHODS AND LEGAL BASES FOR COLLECTING PERSONAL DATA

Your personal data may be collected through the following methods:

• Electronic platforms (website, mobile applications, email, call centers, etc.),
• Physical forms and documents,
• Oral, written, or electronic requests and applications,
• Requests for information from official institutions and organizations.

These data are processed based on the legal grounds specified in Articles 5 and 6 of GDPR. The primary legal bases include:

• Explicitly provided by law,
• Directly related to the establishment or execution of a contract,
• Necessary for fulfilling legal obligations,
• Consent of the data subject,
• Protection of legitimate interests.

TRANSFER OF PERSONAL DATA

Your personal data may be transferred within the framework of Articles 8 and 9 of GDPR to:

• Authorized public institutions and organizations,
• Private legal entities as required by relevant legal regulations,
• Lawyers, financial advisors, audit firms, and third-party consultants for legal and financial processes,
• Service provider companies located domestically or abroad for IT infrastructure support.

RIGHTS OF THE DATA SUBJECT

Under Article 11 of GDPR, personal data subjects have the following rights:

• To learn whether their personal data is being processed,
• To request information if their personal data has been processed,
• To learn the purpose of processing and whether their data is used in accordance with that purpose,
• To know the third parties to whom personal data is transferred domestically or abroad,
• To request correction of incomplete or inaccurate personal data,
• To request deletion or destruction of personal data under the conditions specified in GDPR,
• To request notification of correction or deletion processes to third parties to whom personal data has been transferred,
• To object to a negative outcome arising from the exclusive processing of data through automated systems,
• To demand compensation for damages incurred due to unlawful processing of personal data.

DATA SECURITY AND RETENTION PERIODS

Your personal data is retained for the period specified by GDPR and relevant regulations. Upon the expiration of the retention period or the elimination of the purpose for processing, your personal data will be deleted or anonymized in accordance with legal regulations. Technical and administrative measures are taken to ensure the protection of personal data.

APPLICATION AND REQUEST METHODS

Under GDPR, you may submit all your requests and applications regarding your personal data in writing or through other methods specified in the relevant legislation. Your requests will be evaluated and concluded as soon as possible in accordance with the applicable legal regulations.

UPDATES AND CHANGES

This information notice may be updated to comply with legal regulations. Updated versions take effect from the date they are published on relevant platforms.