PRIVACY NOTICE

Netaş Bilişim Teknolojileri A.Ş., takes the highest level of security precautions to protect your personal data’s confidentiality and privacy while collecting, processing, transferring and retaining them in accordance with law.

Our aim is; in accordance with article 10 of the Law No 6698 informing you for regard of collection of your personal data, purposes of processing of your personal data, the parties we share your data with, legal basis for its processing and your rights in this context in most transparent manner.

a) Data Controller

Your personal data will be collected and processed pursuant to the Law on the Protection of Personal Data No. 6698 ("Law No. 6698") by Netaş Bilişim Teknolojileri A.Ş.,. (“Netaş Bilişim” or “Our Company”) as the of data controller within the scope described below.

b) Purposes of Processing Personal Data

Netaş Bilişim may collect personal data in the categories of identity information, contact information, customer information, customer transaction information, transaction security information, legal action and compliance information and marketing and sales information from parties including potential customers, customers, employee candidates, employees, business partners and suppliers.

Included but not limited to those below Collected personal data will be processed in accord with personal data processing conditions and purposes of the processing of personal data specified in Articles 5 and 6 of the Law No. 6698 for purposes of;- Pricing and invoicing of products to make Netaş Bilişim products and services available for you, sale of products and services, performance of and follow up on works demanded by the customer in regard of purchases and/or purchased products and services, performance of after-sale services like product delivery, installation, maintenance, repair, etc.;

- Planning and performance of custom process and production operations and/or processes, planning and performance of supply chain management, planning and performance of customer relations management processes;

- Planning and performance of call centre, reception, defective product return, maintenance and repair, on-site repair and customer notification services;

- Planning and performance of consulting, maintenance, support and reporting services;

- Complying with information sharing, reporting, notification and taxation obligations and other obligations required by local and international legislations for preparation of records and documents and fulfilment of our obligations to you;

- Providing promotions, advertisements, campaigns, discounts, benefits, conditions, pricings, advantages and other benefits personalised for you in order to increase service and product quality and contacting you in this regard;

- Contacting you to provide you with the necessary information regarding services and products and necessity of the information technology requirements, system infrastructure and procured information technology support services;

- Website traffic measurement for purposes of sales and marketing, cross-analysis, statistical analysis, segmentation/profiling and CRM operations;

- Measurement and improvement of customer experience, complaint management, collection of opinions and recommendations regarding new services and products, collecting your problem-error reports and providing you with information regarding your complaints and requests;

- Order fulfilment, payment processing, ensuring logistical collaboration with third parties for delivery of products, recommending products and services that might interest you, online behavioural advertisement and marketing, customer portfolio management, service quality measurement and improvement, communication, optimisation, auditing, risk management and control, promotion, analysis, personal preferences, scoring, profiling, marketing, sales, advertisement and communication;

- Comparative offers for products and/or services, modelling, product operations and/or development on existing and new products, uses involving purposes related to all kinds of products and services in scope of applicable laws and regulations governing the acts specified under Netaş Bilişim charter which involves your disclosure of personal data to Netaş Bilişim;

-Complying with information sharing, reporting and notification obligations specified by official institutions, fulfilling requirements of contracts and to perform legal obligations Netaş Bilişim is subject to in relation of providing these services;

- Setting business strategies, carrying out financial communications, market research and social responsibility activities, purchasing operations (demand, offer, assessment, order, budgeting, contract), internal company system and application management operations and legal operations towards the purpose of determining and implementing commercial and business strategies for Netaş Bilişim;

- Review and assessment of and response to requests from official authorities or you.

c) The Recipients and Purposes of Personal Data Transfers

Collected personal data may be transferred to the extent of purposes listed above to other parties including;

- Affiliates, business partners, shareholders and associates of Netaş Bilişim;

- Relevant offices, bodies and organisations permitted in scope of the Tax Procedural Law, Social Security Institution regulations, Law on Prevention of Laundering of Criminal Revenues, Law on Prevention of Laundering of Anti Money, the Turkish Commercial Code, the Turkish Code of Obligations and other applicable legislations;

- Public offices and institutions, administrative authorities and legal authorities authorised under law;

- Related companies and associates in foreign jurisdictions;

- Consultants, auditors, attorneys and other third parties providing us with services;

- Real and legal bodies with whom we collaborate and acquire services from in scope of product/service comparison, analysis, assessment, advertisement and other purposes listed above, institutions and organisations partnering in these programs, organisations with whom we have agreements for transfer of messages sent to our customers, and cargo companies performing delivery of orders to you, in accordance with conditions and purposes processing personal data specified under Article 8 and 9 of Law No. 6698.

d) Methods and Legal Basis for Collection of Personal Data

Netaş Bilişim General Directorate collects your personal data in scope of legal provisions for the purposes listed above, in scope of performance of the contract, through various oral, written or electronic environment channels currently established or might be established in future, particularly including applications made through contracted internet sites, various organisations we provide support services to or receive support services from, real and/or legal bodies with whom we transact in scope of any legislation or contract, vendors, text message or electronic mail, interactive voice response system, our website and our mobile app, our call centres, and our social media accounts.

e) Rights of the Data Subject as Specified in Article 11 of Law No. 6698

In case you contact us as data subject regarding your requests related to your rights Netaş Bilişim will process and conclude your requests as soon as possible and in thirty days at the latest, according to nature of the requests. Responses to such requests will be free of charge up to ten pages. 1 Turkish Lira in processing fees will be collected for each page beyond ten. In case the response to the request is presented on a storage environment like a CD or Flash memory the fee charged by our company will not exceed the cost of said storage environment.

In this scope, requests have the rights to;

• Learn whether or not your personal data is processed or not;

• Request information concerning the processing if your personal data have been processed;

• Learn the purpose for the processing of your personal data and whether your personal data have been used in accordance with the purpose;

• Know the third parties within Turkey or abroad to whom personal data have been transferred;

• Request rectification in case your personal data have been processed incompletely or inaccurately and request notification of the operations made within this context to third parties to whom your personal data have been transferred;

• Request deletion or destruction of your personal data in case the reasons necessitating their processing cease to exist, despite your personal data have been processed in accordance with Law No.6698 or other relevant laws, and request notification of the operations made within this context to third parties to whom your personal data have been transferred;

• Object to occurrence of any result deriving from a decision based solely on automated processing and that is to your detriment; and

• Request compensation for the damages in case you incur damages due to unlawful processing of personal data

You can sent your requests regarding use of your rights listed above, drawn in Turkish language, in written form or using the registered electronic mail (KEP) address, secure electronic signature, mobile signature or the electronic mail address previously notified to Netaş Bilişim and registered in our systems, in accordance with Article 13 of the Law No. 6698 and the General Notice on Procedure and Principles of Data Subject Requests to Data Controller numbered 30356 and dated 10 March 2018. Responses to applications will only include information directly related to applicant and no information will be provided regarding other family members of the applicant or any third party. Netaş Bilişim reserves the right to verify your identity before responding.

Your requests must include;

a) Your name, surname and your signature, if the application is made in writing;

b) Your Republic of Turkey Identification Number for Turkish citizens or your nationality, passport number or identification number if you are a foreign national;

c) Your residence or work address for due service of official notices;

d) Your electronic mail address, phone number or fax number for due service of official notices;

e) Subject of your request;

and other information and documentation related to your request should also be enclosed with the application.

Written applications enclosed with necessary documentation can be addressed to our Company in capacity of data controller at its address of Orhanlı Mah. İrfan Cad. No:28 34956 Orhanlı Tuzla Istanbul. You can find the application form here.

If you wish to submit an application through e-mail you can send you application to the e-mail address kvkk@netasbilisim.com.tr .Applications through KEP system can be sent to our KEP address of netasbilisim@hs02.kep.tr

Based on the nature of your request, necessary information and documents allowing identity determination must be provided to us without any omission or error. In case necessary information and documents are not duly provided as needed, Netaş Bilişim may experience disruptions in full and qualified performance of investigations made in response to your request. In this case, Netaş Bilişim declares all legal rights of Netaş Bilişim are reserved. Therefore, your request must be sent to include all necessary information and documents allowing due identity determination without any omission or error, based on nature of your request.