Personal Data Protection and Processing Policy

TABLE OF CONTENTS

• CHAPTER 1: INTRODUCTION
  • II. IMPORTANCE OF THE PROTECTION OF PERSONAL DATA
  • III. PURPOSE OF THE POLICY
  • IV. SCOPE
  • V. IMPLEMENTATION OF THE POLICY AND THE RELEVANT LEGISLATION
  • VI. ACCESS AND UPDATES
• CHAPTER 2: PROCESSING OF PERSONAL DATA
  • I. PROCESSING OF PERSONAL DATA IN ACCORDANCE WITH THE PRINCIPLES AND RULES SET OUT IN THE LEGISLATION
    • 1. Principles for the Processing of Personal Data
      • A) Processing in Accordance with the Law and the Rule of Good Faith
      • B) Ensuring that Personal Data Are Accurate and, Where Necessary, Up to Date
      • C) Processing for Specific, Explicit and Legitimate Purposes
      • D) Being Relevant, Limited and Proportionate to the Purposes for Which They Are Processed
      • E) Retention for the Period Set Out in the Relevant Legislation or Required for the Purpose for Which They Are Processed
    • 2. Rules for the Processing of Personal Data of a General Nature
    • 3. Rules for the Processing of Special Categories of Personal Data
    • 4. Informing and Notifying the Data Subjects Whose Data Are Processed
  • II. TRANSFER OF PERSONAL DATA
    • 1. Principles for the Transfer of Personal Data
    • 2. Transfer of Special Categories of Personal Data
    • 3. Transfer of Personal Data Abroad
    • 4. Purposes for Which Our Company Transfers Personal Data and Categories of Persons to Whom Data Are Transferred
      • A) Purposes of Data Transfer
      • B) Persons to Whom Data Are Transferred
  • III. PERSONAL DATA CATEGORIZATIONS
• CHAPTER 3: LEGAL BASES AND PURPOSES OF THE PROCESSING OF PERSONAL DATA
  • I. LEGAL BASES FOR THE PROCESSING OF PERSONAL DATA
    • 1. General Principles
    • 2. Grounds of Lawfulness
      • A) Existence of the Explicit Consent of the Personal Data Subject
      • B) Being Expressly Provided for by the Laws
      • C) Inability to Obtain the Explicit Consent of the Person Concerned Due to Actual Impossibility
      • D) Being Directly Related to the Establishment or Performance of a Contract
      • E) Fulfillment of the Company’s Legal Obligation
      • F) The Data Subject Making Their Personal Data Public
      • G) Data Processing Being Mandatory for the Establishment or Protection of a Right
      • H) Data Processing Being Mandatory for the Legitimate Interest of Our Company
    • 3. Processing of Special Categories of Personal Data and Grounds of Lawfulness
  • II. PURPOSES OF THE PROCESSING OF PERSONAL DATA
• CHAPTER 4: RETENTION, DELETION, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA
  • I. RETENTION OF PERSONAL DATA AND RETENTION PERIODS
  • II. DELETION, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA
    • 1. Deletion of Personal Data
      • A) The Operation of Deleting Personal Data
      • B) The Process of Deleting Personal Data
      • C) Methods of Deleting Personal Data
    • 2. Destruction of Personal Data
      • A) The Operation of Destroying Personal Data
      • B) Methods of Destroying Personal Data
    • 3. Anonymization of Personal Data
      • A) The Operation of Anonymizing Personal Data
      • B) Methods of Anonymizing Personal Data
• CHAPTER 5: RIGHTS OF DATA SUBJECTS
  • I. SCOPE OF THE RIGHTS OF DATA SUBJECTS AND EXERCISE OF THESE RIGHTS
    • 1. Rights of Data Subjects
    • 2. Exercise of Their Rights by Data Subjects
    • 3. Responding to Applications
• CHAPTER 6: ENSURING THE SECURITY OF PERSONAL DATA
  • I. TECHNICAL AND ADMINISTRATIVE MEASURES TAKEN TO ENSURE THE LAWFUL PROCESSING OF PERSONAL DATA
  • II. TECHNICAL AND ADMINISTRATIVE MEASURES TAKEN IN THE PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA
  • III. TECHNICAL AND ADMINISTRATIVE MEASURES TAKEN TO PREVENT UNLAWFUL ACCESS TO PERSONAL DATA
    • 1. Technical Measures Taken to Prevent Unlawful Access to Personal Data
      • A) Ensuring Cyber Security
      • B) Software Updates
      • C) Access Restrictions
      • D) Encryption
      • E) Antivirus Software
      • F) Monitoring Personal Data Security
      • G) Ensuring the Security of Environments Containing Personal Data
      • H) Storing Personal Data in the Cloud
      • I) Procurement, Development and Maintenance of Information Technology Systems
      • J) Backing Up Personal Data
    • 2. Administrative Measures Taken to Prevent Unlawful Access to Personal Data
  • IV. STORING PERSONAL DATA IN SECURE ENVIRONMENTS
    • 1. Technical Measures Taken to Store Personal Data in Secure Environments
    • 2. Administrative Measures Taken to Store Personal Data in Secure Environments
  • V. TRAINING
  • VI. AUDIT
    • 1. Raising the Awareness of Business Units on the Protection and Processing of Personal Data, and Their Audit
    • 2. Raising the Awareness of Business Partners and Suppliers on the Protection and Processing of Personal Data, and Their Audit
    • 3. Audit of the Measures Taken for the Protection of Personal Data

CHAPTER 1: INTRODUCTION

II. IMPORTANCE OF THE PROTECTION OF PERSONAL DATA

The protection of personal data is a constitutional right and is among the priorities of our Company. Indeed, for this purpose, our Company has aimed to establish a system that is continuously updated, and this policy has been drawn up. Within the scope of Law No. 6698 on the Protection of Personal Data (the “Law”), this Personal Data Protection and Processing Policy (the “Policy”) is issued so that Mudi Finansal Teknoloji Hizmetleri A.Ş. (the “Company”), in its capacity as Data Controller, fulfills its general obligation to inform and sets out the fundamental principles of our Company’s personal data processing rules; within this scope, it lays down the fundamental principles for the protection of the personal data of our customers, potential customers, employees, employee candidates, interns and students, the employees and officers of suppliers/subcontractors, our company shareholders and company partners, our visitors and other third parties whose data we process.

For the implementation of the matters set out in this Policy, the necessary procedures are put in place within the Company, privacy notices specific to and consistent with each category of persons are prepared, personal data protection and confidentiality agreements are concluded with Company employees and third parties who have access to personal data, job descriptions are revised, the administrative and technical measures required for the protection of personal data are taken by the Company, and within this scope the necessary audits are carried out or caused to be carried out. The subject of the Protection of Personal Data is also embraced by senior management, and personal data protection processes are managed through the establishment of a special Committee on this subject (Company Personal Data Protection Working Committee).

III. PURPOSE OF THE POLICY

The main purpose of this Policy is to set out the principles governing the personal data processing activities carried out lawfully by the Company and the protection of personal data, and within this scope to ensure transparency by informing and notifying the persons whose personal data are processed by our Company.

IV. SCOPE

This Policy relates to all personal data of the persons whom we categorize under the headings “our customers, potential customers, employees, employee candidates, interns and students, employees and officers of suppliers/subcontractors, Company shareholders and Company partners, visitors, officers of product or service recipients, employee references, employees’ family members and relatives, parents/guardians/representatives and other third parties whose data we process”, which we process by automated means or, provided that they form part of any data recording system, by non-automated means.

V. IMPLEMENTATION OF THE POLICY AND THE RELEVANT LEGISLATION

The relevant statutory provisions in force on the processing and protection of personal data shall apply first and foremost. In the event of any inconsistency between the legislation in force and the Policy, our Company accepts that the legislation in force shall apply.

VI. ACCESS AND UPDATES

This Policy is published on our Company’s website at www.getmundi.app/en/legal-information and in the Settings > Legal Information section of our mobile application, is made available to data subjects upon the request of personal data owners, and is updated when necessary.

CHAPTER 2: PROCESSING OF PERSONAL DATA

In accordance with Article 20 of the Constitution and Article 4 of the Law, with regard to the processing of personal data, our Company carries out personal data processing activities in a manner that is lawful and consistent with the rules of good faith, accurate and, where necessary, up to date; for specific, explicit and legitimate purposes; and relevant, limited and proportionate to the purpose. Our Company retains personal data for the period provided for in the laws or required by the purpose of the personal data processing.

Pursuant to Article 20 of the Constitution and Article 5 of the Law, our Company processes personal data on the basis of one or more of the conditions set out in Article 5 of the Law.

Pursuant to Article 419 of the Code of Obligations, and without prejudice to the provisions of the Law, our Company processes the personal data of employees and employee candidates on the basis of the purposes of suitability for the job and the performance of the employment contract.

In accordance with Article 20 of the Constitution and Article 10 of the Law, our Company informs personal data owners and, where personal data owners request information or apply to exercise their rights arising from the law, provides the necessary information and responds to applications within the statutory period.

In accordance with Article 6 of the Law, our Company acts in compliance with the rules laid down for the processing of special categories of personal data.

In accordance with Articles 8 and 9 of the Law, our Company complies with the rules laid down in the Law on the transfer of personal data and acts taking into account the decisions taken and the communiqués published by the Personal Data Protection Board (the “Board”), as well as the lists of safe countries.

I. PROCESSING OF PERSONAL DATA IN ACCORDANCE WITH THE PRINCIPLES AND RULES SET OUT IN THE LEGISLATION

1. Principles for the Processing of Personal Data

A) Processing in Accordance with the Law and the Rule of Good Faith

In processing personal data, our Company acts in accordance with the principles introduced by legal regulations and with the rule of good faith. Within this scope, our Company acts after identifying the legal bases that require the processing of personal data, takes into account the requirements of proportionality, does not use personal data other than as required by the purpose, and does not carry out processing activities without the knowledge of the persons concerned.

B) Ensuring that Personal Data Are Accurate and, Where Necessary, Up to Date

Taking into account the fundamental rights of personal data owners and its own legitimate interests, our Company ensures that the personal data it processes are accurate and up to date and takes the necessary measures to this end. Within this scope, efforts are made to keep the data relating to all categories of persons up to date. In particular, customer and potential customer data are carefully updated, and marketing and promotional e-mails and offers are not sent to persons contrary to their consent.

C) Processing for Specific, Explicit and Legitimate Purposes

Our Company determines its legitimate and lawful purpose of processing personal data clearly and precisely. Our Company processes personal data in connection with the service it provides and to the extent necessary for it.

D) Being Relevant, Limited and Proportionate to the Purposes for Which They Are Processed

Our Company processes personal data in a manner suitable for achieving the specified purposes and avoids processing personal data that are not relevant to, or not needed for, achieving the purpose. Within this scope, processes are continuously reviewed and efforts are made to put into practice the “Data Minimization/Reduction of Personal Data” principle.

E) Retention for the Period Set Out in the Relevant Legislation or Required for the Purpose for Which They Are Processed

Our Company retains personal data only for the period specified in the relevant legislation or required for the purpose for which they are processed. Within this scope, our Company first determines whether the relevant legislation provides for a period for the retention of personal data and, if a period has been set, acts in accordance with that period; within this scope, it takes into account the civil and criminal limitation periods and retains personal data for the period necessary for the purpose for which they are processed. Upon expiry of the period, or if the reasons requiring their processing cease to exist, personal data are deleted, destroyed or anonymized in accordance with our Company’s “Retention and Disposal of Personal Data” policy.

2. Rules for the Processing of Personal Data of a General Nature

The protection of personal data is a constitutional right, and fundamental rights and freedoms may be restricted only by law and solely on the grounds set out in the relevant articles of the Constitution, without affecting their essence. Pursuant to the third paragraph of Article 20 of the Constitution, personal data may be processed only in the cases provided for by law or with the explicit consent of the person. In processing personal data, our Company processes personal data without seeking the explicit consent of the data subject only where the following conditions exist:

a) Being expressly provided for by the laws,
b) Being mandatory for the protection of the life or bodily integrity of the person himself/herself, who is unable to express his/her consent due to actual impossibility or whose consent is not given legal validity, or of another person,
c) Processing of the personal data of the parties to a contract being necessary, provided that it is directly related to the establishment or performance of that contract,
d) Being mandatory for the data controller to be able to fulfill its legal obligation,
e) Having been made public by the data subject himself/herself,
f) Data processing being mandatory for the establishment, exercise or protection of a right,
g) Data processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

In the absence of the above conditions, our Company relies on the explicit consent of the person concerned, given freely and based on information. In particular, in the field of Human Resources and Employment Relations, taking into account the employee’s relationship of dependence, the principle is that the data are based primarily on grounds of lawfulness other than consent, and explicit consent is relied on only where such grounds do not apply. In contrast, in activities such as marketing, processing is carried out on the basis of the explicit consent of the data subject. In any event, however, in all cases in which personal data are processed, the data processing activity is always carried out by “informing” the persons concerned.

3. Rules for the Processing of Special Categories of Personal Data

In processing personal data designated in the Law as “special categories”, our Company acts in accordance with the rules laid down in the Law. Article 6 of the Law designates as “special categories” certain personal data that carry the risk of causing persons to be victimized or discriminated against if processed unlawfully, and care and sensitivity must be shown in processing such data. These are data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. In accordance with the Law, our Company processes special categories of personal data in the following cases, provided that the necessary measures are taken:

• Special categories of personal data other than those relating to the health and sexual life of the data subject, in the cases provided for by the laws or, if the data subject has given explicit consent, on the basis of that consent,
• Special categories of personal data relating to the health and sexual life of the data subject, on the other hand, are processed only for the purposes of protecting public health, preventive medicine, medical diagnosis, conducting treatment and care services, and planning and managing health services and their financing, by persons under an obligation of confidentiality or by authorized institutions and organizations, or with the explicit consent of the data subject.
• Whatever the ground relied on, the general principles of data processing are always taken into account in processing operations, and compliance with these principles is ensured (Law, Article 4; see Chapter 2, I, 1 above).

With regard to the protection of special categories of data, the “Procedure on the Protection of Special Categories of Personal Data” has been put into effect in our Company, and our business units act in accordance with the provisions of this procedure and take the necessary measures.

4. Informing and Notifying the Data Subjects Whose Data Are Processed

In accordance with Article 10 of the Law, our Company informs personal data owners at the time their personal data are obtained. Within this scope, the data subject whose data are processed is informed of the purpose for which the personal data will be processed, to whom and for what purpose the processed personal data may be transferred, the method and legal ground of the collection of personal data, and the rights of the data subject whose personal data are processed, and the relevant units of our Company carry out the necessary actions in accordance with our Company’s “Procedure on the Principles of Informing”. Likewise, Article 11 of the Law lists the right to “Request Information” among the rights of the data subject whose personal data are processed; within this scope, in accordance with Article 20 of the Constitution and Article 11 of the Law, our Company provides the necessary information where the data subject whose personal data are processed requests information, and acts in this regard in accordance with the “Data Subject Application Procedure” within our Company.

II. TRANSFER OF PERSONAL DATA

In line with lawful purposes of personal data processing, our Company may transfer the personal data and special categories of personal data of the data subject whose personal data are processed to third parties, taking the necessary security measures. In doing so, our Company acts in accordance with the rules laid down in Article 8 of the Law.

1. Principles for the Transfer of Personal Data

In line with legitimate and lawful purposes of personal data processing, our Company may transfer personal data to third parties on the basis of, and limited to, one or more of the personal data processing conditions set out in Article 5 of the Law and listed below.

If the data subject whose personal data are processed has given explicit consent, on the basis of that consent; or

• If there is an express provision in the laws on the transfer of the personal data,
• If it is mandatory for the protection of the life or bodily integrity of the data subject or of another person, and the data subject is unable to express his/her consent due to actual impossibility or his/her consent is not given legal validity;
• If the transfer of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract,
• If the transfer of personal data is mandatory for our Company to fulfill its legal obligation,
• If the personal data have been made public by the data subject himself/herself,
• If the transfer of personal data is mandatory for the establishment, exercise or protection of a right,
• If the transfer of personal data is mandatory for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the data subject whose personal data are processed, the personal data are transferred.

Whatever the ground relied on, the general principles of data processing are always taken into account in transfer processes, and compliance with these principles is ensured (Law, Article 4; see Chapter 2, I, 1 above).

2. Transfer of Special Categories of Personal Data

Exercising the necessary care, taking the necessary security measures and taking the adequate measures prescribed by the Board, our Company may, in line with legitimate and lawful purposes of personal data processing, transfer the special categories of data of the data subject whose personal data are processed to third parties in the following cases.

• If the data subject has given explicit consent, on the basis of that consent, or
• If the data subject has not given explicit consent;
  • Special categories of personal data of the data subject other than those relating to health and sexual life (these are data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, criminal convictions and security measures, as well as biometric and genetic data), in the cases provided for by the laws,
  • Special categories of personal data relating to the health and sexual life of the data subject, on the other hand, may be processed only for the purposes of protecting public health, preventive medicine, medical diagnosis, conducting treatment and care services, and planning and managing health services and their financing, by persons under an obligation of confidentiality or by authorized institutions and organizations.

With regard to the transfer of special categories of personal data, the “Procedure on the Protection of Special Categories of Personal Data” has been put into effect in our Company, and our business units act in accordance with the provisions of this Policy and of the said procedure and take the necessary measures. Whatever the ground relied on, the general principles of data processing are always taken into account in transfer processes, and compliance with these principles is ensured (Law, Article 4; see Chapter 2, I, 1 above).

3. Transfer of Personal Data Abroad

In line with lawful purposes of personal data processing, our Company may transfer the personal data and special categories of personal data it processes to third parties abroad, taking the necessary security measures. Our Company may transfer personal data to foreign countries to be declared by the Board as having adequate protection (“Foreign Country with Adequate Protection”) or, where adequate protection does not exist, to foreign countries where the data controllers in Türkiye and in the relevant foreign country undertake adequate protection in writing and where the Board has given its permission (“Foreign Country Where a Data Controller Undertaking Adequate Protection Is Located”). In doing so, our Company acts in accordance with the rules laid down in Article 9 of the Law.

In line with legitimate and lawful purposes of personal data processing, our Company may transfer personal data to Foreign Countries with Adequate Protection or Foreign Countries Where a Data Controller Undertaking Adequate Protection Is Located if the data subject whose personal data are processed has given explicit consent or, if the data subject whose personal data are processed has not given explicit consent, where one of the following cases exists:

• If there is an express provision in the laws on the transfer of the personal data,
• If it is mandatory for the protection of the life or bodily integrity of the data subject whose personal data are processed or of another person, and the data subject whose personal data are processed is unable to express his/her consent due to actual impossibility or his/her consent is not given legal validity;
• If the transfer of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract,
• If the transfer of personal data is mandatory for our Company to fulfill its legal obligation,
• If the personal data have been made public by the data subject himself/herself,
• If the transfer of personal data is mandatory for the establishment, exercise or protection of a right,
• If the transfer of personal data is mandatory for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the personal data subject.

4. Purposes for Which Our Company Transfers Personal Data and Categories of Persons to Whom Data Are Transferred

A) Purposes of Data Transfer

Data are transferred for purposes such as ensuring the fulfillment of our Company’s purposes of activity and incorporation, ensuring that the services which our Company outsources from suppliers and which are necessary for carrying out our Company’s commercial activities are provided to our Company, ensuring the conduct of our Company’s human resources and employment policies, and fulfilling our Company’s obligations and taking the necessary measures within the framework of occupational health and safety.

B) Persons to Whom Data Are Transferred

In accordance with Articles 8 and 9 of the Law, our Company may transfer personal data to the categories of persons specified below:

In transfers carried out by our Company, action is taken in accordance with the principles and rules set out in this Policy.

III. PERSONAL DATA CATEGORIZATIONS

The persons whose data are processed in our Company and the data processed within this scope are categorized as follows:

CATEGORIZATION OF PERSONS

CATEGORIZATION OF DATA

CHAPTER 3: LEGAL BASES AND PURPOSES OF THE PROCESSING OF PERSONAL DATA

I. LEGAL BASES FOR THE PROCESSING OF PERSONAL DATA

1. General Principles

Although the legal bases on which our Company processes personal data vary, in every personal data processing activity our Company acts in accordance with the general principles in Article 4 of the Law. Accordingly, in all data processing, the general principles of

a) being lawful and in accordance with the rules of good faith,
b) being accurate and, where necessary, up to date,
c) being processed for specific, explicit and legitimate purposes,
d) being relevant, limited and proportionate to the purposes for which they are processed,
e) being retained for the period set out in the relevant legislation or required for the purpose for which they are processed are observed.

2. Grounds of Lawfulness

A) Existence of the Explicit Consent of the Personal Data Subject

One of the conditions for the processing of personal data is the explicit consent of their owner. The explicit consent of the data subject must relate to a specific matter, be based on information and be given of the data subject’s own free will.

B) Being Expressly Provided for by the Laws

The personal data of the data subject may be processed lawfully where this is expressly provided for by law. For example, notifying the identities of our employees to the competent authorities under the Identity Notification Legislation.

C) Inability to Obtain the Explicit Consent of the Person Concerned Due to Actual Impossibility

The personal data of the data subject may be processed where the processing of personal data is mandatory to protect the life or bodily integrity of the person himself/herself, who is unable to express his/her consent due to actual impossibility or whose consent cannot be given validity, or of another person. For example, sharing the blood type of an employee who has fainted with a physician.

D) Being Directly Related to the Establishment or Performance of a Contract

Personal data may be processed where it is necessary to process the personal data of the parties to a contract, provided that this is directly related to the establishment or performance of that contract. For example, obtaining a CV from a candidate in order to establish an employment contract, or obtaining an address so that notifications can be served under the contract.

E) Fulfillment of the Company’s Legal Obligation

The personal data of the data subject may be processed where processing is mandatory for our Company, as data controller, to fulfill its legal obligations. For example, processing family information so that an employee can benefit from the Minimum Living Allowance.

F) The Data Subject Making Their Personal Data Public

Personal data may be processed where the data subject has made his/her personal data public himself/herself. For example, where customers of our Company submit their complaints, requests or suggestions on a platform on the internet that is open to everyone, these customers have made the relevant information public. In this case, the data may be processed by an officer of our Company, provided that this is limited to the purpose of responding to the complaints, requests or suggestions.

G) Data Processing Being Mandatory for the Establishment or Protection of a Right

The personal data of the data subject may be processed where data processing is mandatory for the establishment, exercise or protection of a right. For example, retaining data that serve as evidence (a sales contract, an invoice) and using them when necessary.

H) Data Processing Being Mandatory for the Legitimate Interest of Our Company

The personal data of the data subject may be processed where data processing is mandatory for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the data subject. For example, monitoring the Company’s critical points with a security camera against theft or for occupational safety purposes.

3. Processing of Special Categories of Personal Data and Grounds of Lawfulness

If the data subject has not given explicit consent, special categories of personal data may be processed by our Company only in the cases provided for by the laws, and only provided that the adequate measures to be determined by the Board are taken. Special categories of personal data relating to the health and sexual life of the data subject, on the other hand, may be processed only for the purposes of protecting public health, preventive medicine, medical diagnosis, conducting treatment and care services, and planning and managing health services and their financing, by persons under an obligation of confidentiality or by authorized institutions and organizations. Whatever the ground relied on, the general principles of data processing are always taken into account in processing operations, and compliance with these principles is ensured (Law, Article 4; see Chapter 2, I, 1 above).

II. PURPOSES OF THE PROCESSING OF PERSONAL DATA

Our Company processes personal data limited to the purposes and conditions within the personal data processing conditions set out in paragraph 2 of Article 5 and paragraph 3 of Article 6 of the Law. In the data processing process, the legal bases stated above are taken into account, and if no other grounds of lawfulness exist, the consent of the person concerned is requested. Here too, a review against the general principles under Article 4 is carried out, and above all the data processing activity is required to comply with the principles of lawfulness in general. The consent of the person concerned is obtained “in an explicit manner, based on information and on free will”.

In our Company’s units, personal data are processed in particular for the following purposes:

• In order for the mutual obligations arising from the employment contract to be fulfilled as an employer, the personal data of EMPLOYEES, STUDENTS AND INTERNS (employees in the broad sense) and of their PARENT/GUARDIAN REPRESENTATIVES need to be processed. The personal data of employees are processed and retained in a manner that is lawful and consistent with the rules of good faith, accurate and, where necessary, up to date; for specific, explicit and legitimate purposes; and relevant, limited and proportionate to the purpose. Within this scope, in line with the purposes necessary for employees to be employed in accordance with the laws, the legal bases of personal data processing are: conducting the processes of establishing, performing and terminating the employment contract lawfully; the legitimate interests of the Company, provided that they do not contravene fundamental rights and freedoms; cases expressly provided for by law; the fulfillment of legal obligations relating to the employment of employees; cases where data processing is mandatory for the establishment, exercise and protection of a right in legal proceedings; and, in cases other than these, the explicit consent, based on information, that will be requested from employees and that employees will give of their own free will.
• Within the scope of the activities required by the Company’s field of activity, the legitimate interests of the employer make it necessary to process the personal data of employees. Indeed, employees’ personal data may be processed for reasons such as preventing abuse, preventing theft, and ensuring general security or occupational health and safety. However, in this case too, great care is taken not to harm the fundamental rights and freedoms of employees.
• After the transition to “Employee” status (it is not requested in the employee candidate category), if the employee is a member of a trade union, trade union membership may also be processed pursuant to the express provisions of the law so that the requirements of the legislation can be fulfilled. Apart from this, as a rule, employees’ race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress are not among the personal data processed unless expressly provided for by law; if an exceptional practice is to be adopted, the requirements are carefully assessed before the personal data are processed and explicit consent is obtained from the person concerned. Our Company’s information and communication tools (telephones, mobile phones, computers and the internet) are subject to inspection and monitoring. Law No. 5651, the relevant legislation and our Company’s legitimate interests constitute the legal bases of these practices.
• In addition to our employees, our visitors and other categories of persons who connect to the internet through our Company’s system may also fall within the scope of this processing. A vehicle tracking system may be applied in Company vehicles on the grounds of “security and more effective management of vehicles and personnel”. This activity is likewise based on our Company’s legitimate interests, but is carried out provided that it does not harm the fundamental rights and freedoms of employees.
• The personal data of EMPLOYEES’ RELATIVES AND FAMILY MEMBERS are also processed in connection with ensuring contact and communication in emergency processes (for example, giving notice in the event of an accident), fulfilling legal obligations such as the minimum living allowance, and employee relations processes.
• Pursuant to Labor Law No. 4857, Article 419 of the Code of Obligations No. 6098, Law No. 6698 on the Protection of Personal Data and the relevant legislation, our Company may process personal information of EMPLOYEE CANDIDATES who apply for a job, such as name, address, date of birth, e-mail address, telephone number and other contact details, CV, cover letter, past or relevant work experience or other experience, educational background, transcript, language test results or supporting or explanatory documents relating to the job application, records of the information obtained during the interview where an interview is held by means such as video conference or telephone or face to face, and the references you have stated in your job application. In the context of employee candidacy, it is strongly recommended that the candidate refrain from stating any personal information not directly related to the candidate’s competencies, and in particular special (sensitive) categories of data (persons’ race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, biometric and genetic data), and that any such parts in CVs and documents provided in writing be blacked out before they are delivered to the Company. In addition, the PERSONAL DATA BELONGING TO THE REFERENCE PERSON/PERSONS (name, surname, telephone, e-mail, etc.) included in the candidate’s CV and processed in this process must be delivered to the Company in the knowledge that informing the person concerned and obtaining his/her (or their) explicit consent is the candidate’s responsibility.
• The personal data of SUPPLIER/SUBCONTRACTOR OFFICERS AND EMPLOYEES may also be processed by our Company. Indeed, Law No. 6331 sets out the documents and information that the principal employer must check, in relation to occupational health and safety, with respect to employees coming from another workplace. Likewise, Labor Law No. 4857 and Social Insurance and General Health Insurance Law No. 5510 impose obligations on the principal employer with respect to subcontractor workers and temporary workers, and specify the matters to be checked within this scope. Accordingly, the processing of the personal data of workers working at the workplace in affiliation with suppliers and other employers is based on our Company’s legitimate interests, first and foremost the requirements of the said legal regulations and the fulfillment of legal obligations. The data of PERSONS RECEIVING PRODUCTS/SERVICES OR THEIR OFFICERS are also processed within the scope of the commercial activity and legal relationship with the data subject.
• The personal data of users who visit our Website and use our Mobile Application are also processed through cookies. Of the cookies used on our website and in our Mobile Application, (i) strictly necessary cookies are used so that the information society service you have requested by visiting our website and mobile application can be provided. Your personal data processed through these cookies are processed under Article 5/2(c) of the Law, being necessary for the performance of the contract, or Article 5/2(f) of the Law, the legitimate interests of the data controller. (ii) Cookies necessary for performance and analysis are used to help develop our website and mobile application. Your personal data processed through these cookies; (iii) cookies necessary for functionality are used to increase the functionality of our website and mobile application and to personalize your settings other than your privacy preference. Your personal data processed through these cookies; (iv) targeting and advertising cookies are used by third-party cookie service providers to profile visitors according to their interests and to show visitors advertisements relevant to them. Your personal data processed through the cookies under (ii), (iii) and (iv) are processed with your explicit consent under Article 5/1 of the Law.
• In addition, personal data:

1. Conducting Emergency Management Processes
2. Conducting Information Security Processes
3. Conducting Employee Candidate / Intern / Student Selection and Placement Processes
4. Conducting the Application Processes of Employee Candidates
5. Conducting Employee Satisfaction and Loyalty Processes
6. Fulfilling Obligations Arising from Employment Contracts and Legislation for Employees
7. Conducting Fringe Benefits and Interests Processes for Employees
8. Conducting Audit/Ethics Activities
9. Conducting Training Activities
10. Managing Access Authorizations
11. Conducting Activities in Compliance with the Legislation
12. Conducting Finance and Accounting Affairs
13. Conducting Company/Product/Service Loyalty Processes
14. Ensuring the Security of Physical Premises
15. Conducting Assignment Processes
16. Following Up and Conducting Legal Affairs
17. Conducting Internal Audit/Investigation/Intelligence Activities
18. Conducting Communication Activities
19. Planning Human Resources Processes
20. Conducting / Auditing Business Activities
21. Conducting Occupational Health / Safety Activities
22. Receiving and Evaluating Suggestions for Improving Business Processes
23. Conducting Activities to Ensure Business Continuity
24. Conducting Goods / Services Procurement Processes
25. Conducting Goods / Services After-Sales Support Services
26. Conducting Goods / Services Sales Processes
27. Conducting Goods/Services Production and Operation Processes
28. Conducting Customer Relationship Processes
29. Conducting Activities for Customer Satisfaction
30. Organization and Event Management
31. Conducting Marketing Analysis Studies
32. Conducting Performance Evaluation Processes
33. Conducting Advertising/Campaign/Promotion Processes
34. Conducting Risk Management Processes
35. Conducting Storage and Archive Activities
36. Conducting Social Responsibility and Civil Society Activities
37. Conducting Contract Processes
38. Conducting Sponsorship Activities
39. Conducting Strategic Planning Activities
40. Following Up Requests / Complaints
41. Ensuring the Security of Movable Property and Resources
42. Conducting the Remuneration Policy
43. Conducting Marketing Processes for Products/Services
44. Ensuring the Security of Data Controller Operations
45. Conducting Investment Processes
46. Conducting Talent / Career Development Activities
47. Providing Information to Authorized Persons, Institutions and Organizations
48. Conducting Management Activities
49. Creating and Following Up Visitor Records

are processed in our relevant units for these purposes.

• At our workplaces, camera monitoring activities at the workplace and Visitor Records, for the purposes of occupational health and safety, general security and product security, are carried out taking into account our Company’s legitimate interests, provided that they do not harm the fundamental rights and freedoms of our visitors, of the persons whose data are processed within this scope and, in particular, of employees.

CHAPTER 4: RETENTION, DELETION, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA

As regulated in Article 138 of the Turkish Penal Code and Article 7 of the Law, even though personal data have been processed in accordance with the provisions of the relevant laws, where the reasons requiring their processing cease to exist, personal data are deleted, destroyed or anonymized by our Company on its own decision or upon the request of the data subject.

I. RETENTION OF PERSONAL DATA AND RETENTION PERIODS

Where this is provided for in the relevant laws and legislation, our Company first and foremost retains personal data for the period specified in the relevant legislation. If no period is set in the legislation for how long personal data must be retained, retention periods are determined taking into account the limitation/forfeiture periods that may apply within the scope of the legal relationship with the data subject. With regard to the Retention of Personal Data, the “Procedure on the Retention and Disposal of Personal Data” has been put into effect and detailed retention periods have been specified.

II. DELETION, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA

As regulated in Article 138 of the Turkish Penal Code and Article 7 of the Law, even though personal data have been processed in accordance with the provisions of the relevant laws, where the reasons requiring their processing cease to exist, personal data are deleted, destroyed or anonymized on our Company’s own decision or upon the request of the data subject. Within this scope, our Company fulfills the relevant obligation through the methods explained in this chapter.

1. Deletion of Personal Data

A) The Operation of Deleting Personal Data

Even though personal data have been processed in accordance with the provisions of the relevant laws, where the reasons requiring their processing cease to exist, our Company may delete personal data on its own decision or upon the request of the data subject. Deletion of personal data is the operation of making personal data inaccessible and unusable again in any way for the relevant users. Our Company takes all necessary technical and administrative measures to ensure that deleted personal data are inaccessible and unusable again for the relevant users.

B) The Process of Deleting Personal Data

The process to be followed in the operation of deleting personal data is as follows:

• Identifying the personal data that will be subject to deletion.
• Identifying the relevant users for each item of personal data using an access authorization and control matrix or a similar system.
• Identifying the relevant users’ authorizations and methods such as access, retrieval and reuse.
• Closing off and eliminating the relevant users’ authorizations and methods of access, retrieval and reuse with respect to the personal data.

C) Methods of Deleting Personal Data

Since personal data may be stored in various recording media, they are deleted using methods appropriate to the recording media.

2. Destruction of Personal Data

A) The Operation of Destroying Personal Data

Even though personal data have been processed in accordance with the provisions of the relevant laws, where the reasons requiring their processing cease to exist, our Company may destroy personal data on its own decision or upon the request of the data subject. Destruction of personal data is the operation of making personal data inaccessible, irretrievable and unusable again by anyone in any way. Our Company takes all necessary technical and administrative measures relating to the destruction of personal data.

B) Methods of Destroying Personal Data

To destroy personal data, all copies in which the data are located are identified, and the systems in which the data are located are destroyed one by one.

3. Anonymization of Personal Data

A) The Operation of Anonymizing Personal Data

Anonymization of personal data means rendering personal data incapable of being associated in any way with an identified or identifiable natural person, even by matching them with other data. Our Company may anonymize lawfully processed personal data when the reasons requiring their processing cease to exist. Our Company takes all necessary technical and administrative measures to anonymize personal data.

In accordance with Article 28 of the Law, personal data that have been anonymized may be processed for purposes such as research, planning and statistics. Such processing falls outside the scope of the Law, and the explicit consent of the data subject will not be sought.

B) Methods of Anonymizing Personal Data

Anonymization means preventing the identity of the data subject from being determined by removing or altering all direct and/or indirect identifiers in a data set, or the data losing the characteristic of being distinguishable within a group or crowd in such a way that they cannot be associated with a natural person. Data that do not point to a specific person as a result of these characteristics being prevented or lost are deemed anonymized data. The aim of anonymization is to break the link between the data and the person identified by those data.

All link-breaking operations carried out by automated or non-automated methods such as grouping, masking, derivation, generalization and randomization applied to the records in the data recording system in which the personal data are kept are called anonymization methods. The data obtained as a result of applying these methods must not be able to identify a specific person.

CHAPTER 5: RIGHTS OF DATA SUBJECTS

I. SCOPE OF THE RIGHTS OF DATA SUBJECTS AND EXERCISE OF THESE RIGHTS

1. Rights of Data Subjects

Persons whose personal data are processed by our Company have the following rights:

• To learn whether personal data are processed,
• To request information about it if his/her personal data have been processed,
• To learn the purpose of processing the personal data and whether they are used in accordance with their purpose,
• To know the third parties to whom personal data are transferred domestically or abroad,
• To request the rectification of personal data if they have been processed incompletely or inaccurately, and to request that the action taken within this scope be notified to the third parties to whom the personal data have been transferred,
• To request the deletion or destruction of personal data where the reasons requiring their processing cease to exist, even though they have been processed in accordance with the provisions of the Law and other relevant laws, and to request that the action taken within this scope be notified to the third parties to whom the personal data have been transferred,
• To object to the occurrence of a result to the detriment of the person himself/herself through the analysis of the processed data exclusively by means of automated systems,
• To claim compensation for the damage if he/she suffers damage due to the unlawful processing of personal data.

2. Exercise of Their Rights by Data Subjects

Pursuant to paragraph 1 of Article 13 of the Law, it is necessary and sufficient for data subjects to submit their requests concerning the exercise of the rights set out above to our Company by choosing one of the following methods and addresses:

The application must contain:

Name, surname and, if the application is in writing, signature; for citizens of the Republic of Türkiye, the Republic of Türkiye Identity Number; for foreigners, nationality, passport number or, if any, identity number; the residential or workplace address for service of notifications; if any, the e-mail address, telephone and fax number for notifications; and the subject of the request. Information and documents relating to the matter are also attached to the application.

For a person other than the data subject to make a request, there must be a power of attorney issued by the data subject in the name of the person who will make the application. In the application containing explanations regarding the right that is requested to be exercised as the data subject, the matter requested must be clear and understandable, the subject requested must relate to the data subject or, if acting on behalf of another person, the applicant must be authorized and the authority must be documented, the application must contain identity and address information, and documents proving your identity must be attached to the application.

The Data Subject Application Form is available on our Company’s website at www.getmundi.app/en/legal-information and in the Settings > Legal Information section of the mobile application.

3. Responding to Applications

Where the data subject submits his/her request to our Company in accordance with the prescribed procedure, our Company will conclude the request free of charge as soon as possible and at the latest within thirty days, depending on the nature of the request. However, if the action requires an additional cost, our Company will charge the applicant the fee in the tariff determined by the Board. Our Company may request information from the data subject in order to determine whether the applicant is the data subject. Our Company may put questions to the data subject about his/her application in order to clarify the matters in the application. Applications are managed within our Company in accordance with our Company’s “Data Subject Application Procedure”.

CHAPTER 6: ENSURING THE SECURITY OF PERSONAL DATA

I. TECHNICAL AND ADMINISTRATIVE MEASURES TAKEN TO ENSURE THE LAWFUL PROCESSING OF PERSONAL DATA

Our Company takes all technical and administrative measures necessary to ensure the lawful processing of personal data. Within this scope,

• The “Procedure on the Principles of Informing in the Processing of Personal Data” has been put into effect so that our Company’s obligation to inform data subjects can be fulfilled completely and correctly.
• Employees are informed and trained on the legislation on the protection of personal data.
• All activities carried out by our Company are analyzed in detail for each business unit, and as a result of this analysis, compliance with the legislation is ensured in personal data processing processes specific to the activities carried out by the relevant business units.
• The personal data processing activities carried out by our Company’s business units; the requirements to be fulfilled to ensure that these activities comply with the personal data processing conditions required by Law No. 6698 are determined specifically for each business unit and the detailed activity it carries out.
• Provisions imposing an obligation not to process, disclose or use personal data, except as instructed by the Company and except for the exceptions introduced by law, are included in the contracts and documents governing the legal relationship between our Company and employees, and employee awareness is raised and audits are carried out on this matter.
• Provisions imposing an obligation not to process, disclose or use personal data, except as instructed by the Company and except for the exceptions introduced by law, are included in the contracts and documents governing the legal relationship between our Company and the third parties that process data for which our Company is responsible, and the “Procedure on Confidentiality and Protection of Personal Data with Third Parties” has been put into effect on this matter.

II. TECHNICAL AND ADMINISTRATIVE MEASURES TAKEN IN THE PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA

The Law attaches special importance to certain personal data because of the risk of causing persons to be victimized or discriminated against if they are processed unlawfully. These data are data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. Our Company acts with sensitivity in protecting special categories of personal data that are designated as “special categories” by the Law and are processed lawfully. Within this scope, the technical and administrative measures taken by our Company for the protection of personal data are carefully applied with respect to special categories of personal data, and the necessary audits are ensured.

Within this scope:

• The “Procedure on the Processing of Special Categories of Personal Data” has been put into practice with respect to the security of special categories of personal data and the principles for their processing.
• Employees involved in the processes of processing special categories of personal data are regularly given training on the Law and the regulations based on it and on the security of special categories of personal data, confidentiality agreements are concluded, the scope and duration of the authorizations of users authorized to access the data are clearly defined, authorization checks are carried out, the authorizations in this area of employees who change roles or leave the job are revoked immediately, and within this scope the inventory allocated to them by the data controller is taken back.
• If the environments in which special categories of personal data are processed, kept and/or accessed are electronic environments, the data are kept using cryptographic methods. Cryptographic keys are kept in secure and separate environments, transaction records of all actions performed on the data are securely logged, security updates for the environments where the data are located are monitored, the necessary security tests are carried out, and the test results are recorded.
• If the data are accessed through software, user authorizations for that software are set up, security tests of such software are carried out regularly, and the test results are recorded. If remote access to the data is required, at least a two-factor authentication system is provided.
• If the environments in which special categories of personal data are processed, kept and/or accessed are physical environments, adequate security measures (against situations such as electrical leakage, fire, flooding and theft) are taken according to the nature of the environment in which the special categories of personal data are located, and unauthorized entry and exit are prevented by ensuring the physical security of these environments.
• If special categories of personal data are to be transferred and the data need to be transferred by e-mail, it is ensured that they are transferred in encrypted form via a corporate e-mail address or using a Registered Electronic Mail (KEP) account.
• If special categories of personal data need to be transferred via media such as memory sticks, CDs or DVDs, they are encrypted using cryptographic methods and the cryptographic key is kept in a separate environment.
• If special categories of personal data are transferred between servers in different physical environments, the data transfer is carried out by setting up a VPN between the servers or by the sFTP method. If special data need to be transferred on paper, the necessary measures are taken against risks such as the documents being stolen, lost or seen by unauthorized persons, and the documents are sent in the format of “classified documents”.
• In addition to the measures stated above, the technical and administrative measures for ensuring an appropriate level of security set out in the Personal Data Security Guide published on the website of the Personal Data Protection Authority are also taken into account.

III. TECHNICAL AND ADMINISTRATIVE MEASURES TAKEN TO PREVENT UNLAWFUL ACCESS TO PERSONAL DATA

Our Company takes technical and administrative measures to prevent the careless or unauthorized disclosure of, access to or transfer of personal data, and all other forms of unlawful access.

1. Technical Measures Taken to Prevent Unlawful Access to Personal Data

The main technical measures taken by our Company to prevent unlawful access to personal data are listed below:

A) Ensuring Cyber Security

To ensure personal data security, cyber security products are used first and foremost, but the measures are not limited to these. Measures such as firewalls and gateways are taken. Software and services that are not used are removed from devices.

B) Software Updates

Patch management and software updates ensure the proper functioning of software and hardware and the regular checking of whether the security measures taken for the systems are adequate.

C) Access Restrictions

Access to systems containing personal data is also restricted. Within this scope, employees are granted access authorization to the extent necessary for the work and duties they perform and for their authority and responsibilities, and access to the relevant systems is provided through the use of a username and password. When these passwords and passcodes are created, it is ensured that combinations of upper and lower case letters, numbers and symbols are preferred over sequences of numbers or letters that are associated with personal information and easy to guess. Accordingly, an access authorization and control matrix is created.

D) Encryption

In addition to the use of strong passwords and passcodes, access is restricted through methods such as limiting the number of password entry attempts, ensuring that passwords and passcodes are changed at regular intervals, opening the administrator account and admin authorization for use only when needed, and deleting the account or closing logins without delay for employees whose relationship with the data controller has ended.

E) Antivirus Software

To protect against malicious software, products such as antivirus and anti-spam software that regularly scan the information system network and detect threats are also used, and these are kept up to date and the necessary files are scanned regularly. If personal data are to be obtained from different websites and/or mobile application channels, it is ensured that connections are made via SSL or a more secure method.

F) Monitoring Personal Data Security

• Checking which software and services are running on information networks,
• Determining whether there is any infiltration or any activity that should not occur on information networks,
• Regularly keeping records of the transaction activities of all users (such as log records),
• Reporting security issues as quickly as possible,

are carried out, and a formal reporting procedure is established for employees to report security vulnerabilities in systems and services or threats exploiting them. In undesired events such as a crash of the information system, malicious software, denial-of-service attacks, incomplete or incorrect data entry, breaches compromising confidentiality and integrity, and misuse of the information system, evidence is collected and stored securely.

G) Ensuring the Security of Environments Containing Personal Data

If personal data are stored on devices located on the premises of data controllers or on paper, physical security measures are taken against threats such as the theft or loss of these devices and papers. Physical environments containing personal data are protected against external risks (fire, flood, etc.) by appropriate methods, and entry to and exit from these environments are controlled.

If personal data are in an electronic environment, access between network components may be restricted, or the components are separated, to prevent personal data security breaches.

Measures of the same level are also taken for paper media, electronic media and devices (laptops, mobile phones, flash drives) located outside the Company’s premises and containing personal data belonging to the Company. Personal data to be transferred by electronic mail or by post are also sent carefully and with adequate measures taken.

Where employees access the information system network with their personal electronic devices, adequate security measures are taken for these devices as well.

Against situations such as the loss or theft of devices containing personal data, the method of using access control authorization and/or encryption methods is applied. Within this scope, the encryption key is stored in an environment that only authorized persons can access, and unauthorized access is prevented.

Paper documents containing personal data are also stored under lock and in environments that only authorized persons can access, and unauthorized access to these documents is prevented.

H) Storing Personal Data in the Cloud

Cloud storage practices for personal data may also be resorted to when necessary. In this case, the Company must assess whether the security measures taken by the cloud storage service provider are also adequate and appropriate. Within this scope, the measures set out in the Board’s guidelines and recommendations are taken into account.

I) Procurement, Development and Maintenance of Information Technology Systems

When the Company determines its needs regarding the procurement or development of new systems or the improvement of existing systems, security requirements are taken into account.

J) Backing Up Personal Data

In cases such as personal data being damaged, destroyed, stolen or lost for any reason, the Company ensures that it becomes operational again as soon as possible by using the backed-up data. Backed-up personal data are accessible only by the system administrator, and data set backups are kept outside the network.

2. Administrative Measures Taken to Prevent Unlawful Access to Personal Data

The main administrative measures taken by our Company to prevent unlawful access to personal data are listed below:

• Employees are informed and trained on the technical measures to be taken to prevent unlawful access to personal data.
• Employees are informed that they may not disclose the personal data they learn to others in breach of the provisions of the Law or use them outside the purpose of processing, and that this obligation will continue after they leave their position, and the necessary undertakings are obtained from them accordingly.
• Personal Data Security Policies and Procedures are established, and within the scope of the policies and procedures, checks are carried out regularly, the checks carried out are documented, and the matters that need to be improved are identified. Likewise, the risks that may arise for each category of personal data and how security breaches will be managed are also clearly determined.
• Minimizing Personal Data as Far as Possible: Personal data must be accurate and up to date and must be retained for the period set out in the relevant legislation or required for the purpose for which they are processed. However, whether data that are inaccurate, out of date and serve no purpose are still needed is assessed, and personal data that are not needed are deleted, destroyed or anonymized under the personal data retention and disposal policy.
• Managing Relationships with Data Processors: When the Company obtains services from data processors to meet its Information Technology needs, it acts, while obtaining those services, by making sure that those data processors provide, with respect to personal data, at least the level of security that the Company itself provides. Within this scope, protective provisions relating to the protection of personal data are introduced into the contracts signed with the data processor.

IV. STORING PERSONAL DATA IN SECURE ENVIRONMENTS

Our Company takes the necessary technical and administrative measures, according to technological possibilities and the cost of implementation, to store personal data in secure environments and to prevent their destruction, loss or alteration for unlawful purposes.

1. Technical Measures Taken to Store Personal Data in Secure Environments

The main technical measures taken by our Company to store personal data in secure environments are listed below:

• Systems in line with technological developments are used to store personal data in secure environments.
• Technical security systems are set up for storage areas, the technical measures taken are audited periodically by the audit mechanism determined by our Company, and matters that pose a risk are re-evaluated and the necessary technological solution is produced.
• All necessary infrastructure is used in a lawful manner to ensure that personal data are stored securely.

2. Administrative Measures Taken to Store Personal Data in Secure Environments

The main administrative measures taken by our Company to store personal data in secure environments are listed below:

• Employees are informed about ensuring that personal data are stored securely.
• Where our Company obtains an external service for the storage of personal data due to technical requirements, the contracts concluded with the relevant firms to which personal data are lawfully transferred include provisions stating that the persons to whom the personal data are transferred will take the necessary security measures to protect personal data and will ensure compliance with these measures within their own organizations, and action is taken in this regard in accordance with the provisions of the Company’s Procedure on Confidentiality and Protection of Personal Data with Third Parties.

V. TRAINING

• Our Company provides its employees with the necessary training on the protection of Personal Data within the scope of the Policy and the Personal Data Protection Procedures and the Personal Data Protection Regulations.
• The training particularly addresses the definitions of Special Categories of Personal Data and the practices for their protection.
• If an employee of our Company accesses Personal Data physically or in a computer environment, our Company provides that employee with training specific to such access (for example, the computer program accessed).

VI. AUDIT

1. Raising the Awareness of Business Units on the Protection and Processing of Personal Data, and Their Audit

Our Company ensures that the necessary notifications are made to business units in order to raise awareness of preventing the unlawful processing of personal data and unlawful access to data and of ensuring the safekeeping of data.

2. Raising the Awareness of Business Partners and Suppliers on the Protection and Processing of Personal Data, and Their Audit

Our Company provides the necessary information to its business partners in order to raise awareness of preventing the unlawful processing of personal data, preventing unlawful access to data and ensuring the safekeeping of data.

3. Audit of the Measures Taken for the Protection of Personal Data

Our Company has the right to audit regularly, at any time and ex officio, without any prior notice, whether all of the Company’s employees, departments and contractors act in compliance with this Policy and the Personal Data Protection regulations, and within this scope carries out, or causes to be carried out, the necessary routine audits. The results of these audits are evaluated within the scope of the Company’s internal operations, and the activities necessary to improve the measures taken are carried out.

4. Measures to Be Taken in the Event of Unauthorized Disclosure of Personal Data

In accordance with Article 12 of the Law, our Company operates a system ensuring that, if the processed personal data are obtained by others through unlawful means, this situation is notified to the data subject concerned and to the Board as soon as possible.