PERSONAL DATA PROTECTION POLICY

In accordance with Law No. 6698 on the Protection of Personal Data ("KVKK"), our Company, as the Data Controller, will process your personal data within the framework described below for business-related purposes, including but not limited to use, recording, storage, updating, transfer, and/or classification.

Our Company takes all necessary technical and administrative measures to ensure an appropriate level of security to:

• Prevent unlawful processing of personal data,
• Prevent unauthorized access, and
• Safeguard data integrity.

This policy applies to:

• Individuals who apply through Facebook/Instagram ads or directly via our Website.
• Trained individuals whose personal data is processed by our Company.

Processed Personal Data (Non-Exhaustive List)

As the Data Controller, we process the following personal data:

• Name, Surname
• Turkish ID Number
• Address, Phone Number, Email
• Signature
• Physical Space/Security Camera Recordings
• Call Center/Service Quality Voice Recordings
• Bank Account Number
• Cookie Records

Purposes & Legal Basis for Processing

Your personal data will be processed for the following purposes:

• Providing products/services to you or the institutions you represent.
• Determining and implementing business strategies, marketing activities, and development plans.
• Managing administrative operations and communications.
• Ensuring physical security and supervision of Company premises.
• Establishing business partner/customer/supplier relationships.
• Fulfilling contractual and financial reconciliation obligations with third parties.
• Executing human resources policies.
• Handling call center requests or website usage.
• Organizing trainings, seminars, or events.

Collection & Storage Methods

Your personal data may be collected via:

• Automatic or non-automatic methods (offices, branches, call centers, websites, social media, mobile apps, etc.).
• Verbal, written, or electronic means.

Data is stored in electronic and/or physical environments with strict security measures to prevent unauthorized access, manipulation, loss, or damage.

Retention Period
Your data will be:

Processed only for stated purposes.

Stored for the legal retention period or as long as necessary for processing purposes.

Deleted, destroyed, or anonymized upon expiry of the retention period.

Data Transfer

Your personal data may be shared with:

• Türk Telekomünikasyon A.Ş. and its affiliates.
• Authorized representatives, business partners, and subcontractors.
• Regulatory and supervisory authorities (where legally required).
• Banks, credit risk/financial institutions, tax advisors, auditors, and legal consultants.
• Domestic and international third parties for business purposes.

Your Rights Under Article 11 of KVKK
You may request to:

• Learn whether your data is processed.
• Request information if processed.
• Know the purpose and whether it is used accordingly.
• Identify third parties (domestic/international) to whom data is transferred.
• Request correction of incomplete/incorrect data.
• Request deletion/destruction under Article 7.
• Demand notification of corrections/deletions to third parties.
• Object to automated profiling resulting in adverse consequences.
• Claim compensation for damages due to unlawful processing.

How to Exercise Your Rights

Submit a written request (with identity verification) via:

• In-person delivery
• Notary public
• Secure e-signature to: info@online.asilzadeegitim.com