PERSONAL DATA PROTECTION POLICY

In accordance with the Law on the Protection of Personal Data No. 6698 (“KVKK”), your personal data will be processed by our Association as the Data Controller, within the framework explained below, for business purposes, including but not limited to being used, recorded, stored, updated, transferred, and/or classified. In this context, our Association takes all technical and administrative measures to ensure an appropriate level of security to prevent the unlawful processing of your personal data, to prevent unauthorized access to it, and to ensure its safekeeping, in accordance with the laws and regulations established to protect individuals' fundamental rights and freedoms, especially the privacy of private life.

The target audience of this text includes all real persons whose personal data are processed by our Association, excluding our employees or job applicants.

The personal data processed as the data controller includes, but is not limited to, the following:

• Name, surname, T.C. identity number, address, phone number, email address, signature, physical location/security video recording, call center/service quality voice recording, bank account number, cookie records.

Purposes and Legal Grounds for Processing Personal Data: Your personal data shared by you will be processed for the following purposes:

• To benefit you and/or the institutions and organizations you represent from the products and services offered by our Association, including but not limited to determining and implementing our commercial and business strategies, conducting marketing activities, and carrying out business development and planning activities.
• To carry out administrative operations related to communication conducted by our Association.
• To ensure the physical security and supervision of the locations used by our Association.
• To establish relationships with business partners/customers/suppliers (authorized persons or employees).
• To fulfill contractual requirements and financial reconciliation regarding the products and services provided in collaboration with our business partners, suppliers, or other third parties.
• To implement our Association's human resources policies.
• To facilitate participation in training, seminars, or organizations organized by our Association.

Method of Collection and Storage of Personal Data: Your personal data shared with our Association may be collected verbally, in writing, or electronically through automatic or non-automatic methods, including offices, branches, call centers, websites, social media platforms, mobile applications, and similar channels. Your personal data will be stored in electronic and/or physical environments. Necessary business processes and technical security infrastructure developments are implemented to prevent unauthorized access, manipulation, loss, or damage to your personal data stored in these environments. Your personal data will be processed and stored with all necessary information security measures, for the duration required by the purpose of processing or as long as a legal retention period is not specified. Upon the expiration of this period, your personal data will be removed from our Association's data flows through deletion, destruction, or anonymization methods.

Transfer of Personal Data: Your personal data may be transferred to the following parties within the framework of laws and regulations and for the stated purposes:

• Türk Telekomünikasyon A.Ş. and its group companies,
• Companies and representatives authorized by us acting on behalf of our Association,
• Regulatory and supervisory authorities, public institutions or organizations authorized to request your personal data explicitly under the applicable laws,
• Business partners, suppliers, contractors, banks, credit risk and financial institutions, and other real or legal persons for the stated purposes,
• Tax and similar consultants, mandatory persons related to legal follow-up processes, and third parties from whom we receive consultancy, including auditors, both domestically and internationally.

Your Rights Under Article 11 of the KVKK: By applying to our Association, you have the right to:

1. Learn whether your personal data is being processed,
2. Request information if it has been processed,
3. Learn the purpose of processing and whether it is used in accordance with that purpose,
4. Know the third parties to whom it has been transferred within the country or abroad,
5. Request correction if it is incomplete or incorrectly processed,
6. Request deletion or destruction under the conditions stipulated in Article 7 of the KVKK,
7. Request notification of operations performed on your personal data to the third parties to whom it has been transferred,
8. Object to the emergence of a result against you due to exclusive automatic processing,
9. Request compensation for damages in case you suffer damage due to unlawful processing.

According to the first paragraph of Article 13 of the KVKK, you can submit your request regarding the exercise of the above rights to our Association in writing or by other methods determined by the Personal Data Protection Board.

To exercise your rights mentioned above, you can personally deliver your request along with the necessary identification information, send it via notary, or by other methods determined by the Personal Data Protection Board, or send it securely with an electronic signature to the address @umutyolunda.org.