KVKK

KVKK Obligations

Personal Data Owner Application Guide 1. General Information The Law No. 6698 on the Protection of Personal Data ("KVK Law") has granted personal data owners the right to be informed about personal data related to them, to access this data, tolearn whether it is used for their purposes and to make certain requests such as requesting their correction or deletion. Pursuant to the first paragraph of Article 13 of the KVK Law; WEBADASI Information Technologies (hereinafter referred to as "WEBADASI"), which is the data controller, the applications to be made regarding these rights must be submitted in writingvia this Personal Data Owner Application Form or other methods determined by the Personal Data Protection Board ("Board"). Within this framework, applications to be made to WEBADASI in "written" form can be submitted to us by printing out this form; ● by the personal application of the Applicant, ● through a notary public, ● by signing it with the "secure electronic signature" defined in the Electronic Signature Law No. 5070 by the Applicant and sending it to the registered e-mail address of our company, ● by sending it to the registered e-mail address of WEBADASI with the registered e-mail address that the Applicant has notified to WEBADASI. Explanations regarding the written application channels and the information notes to be specified in the submissions are given in the table below. 2. Right to Apply Application Subjects Pursuant to Article 11 of the KVK Law, anyone whose personal data is processed will be able to apply to WEBADASI as mentioned above and makerequests regarding the following issues: ● To learn whether his/her personal data has been processed, ● To request informationif his/her personal data has been processed,

• To learn the purpose of processing his/her personal data and whether his/her personal data is used in accordance with its purpose, To learn the third parties to whom his/her personal data is transferred domestically or abroad, ● To request correction of his/her personal data in case of incomplete or incorrect processing and to request notification of the transaction made within this scope to third parties to whom his/her personal data is transferred, To request the deletion, destruction or anonymization of personal data in the event that the reasons requiring the processing of personal data disappear and to requestnotification of the transaction made within this scope to third parties to whom personal data is transferred, ● To object to theoccurrence of a result to the detriment of the data owner by analyzing the processed data exclusively through automated systems, ● To request the compensation of the damage in case of damage due to unlawful processing of personal data. Pursuant to Article 28 of the KVK Law, it will not be possible for personal data owners to assert their application rights, as the following cases are excluded from the scope of the KVK Law: ● Processing of personal data for purposes such as research, planning and statistics by anonymizing them with official statistics. Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that such processing does not violate national defense, national security, public security, public safety, public order, economic security, privacy of private life or personalrights o r constitute a crime. Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public security, public order or economic security. Processing of personal data by judicial authorities or execution authorities in relation to investigation, prosecution, trial or execution procedures. Pursuant to paragraph 2 of Article 28 of the KVKK Law,except for the right to claim compensation for the damage, it is not possible to assert the rights in the following cases: ●Processing of personal data is necessary for the prevention of crime or criminal investigation, ● Processing of personal data made public by the person concerned, ● Processing of personal data by authorized public institutions and organizations and professional organizations in the nature of public institutions based on the authority granted by law,

• Personal data processing is necessary for the execution of supervisory or regulatory duties and for disciplinary investigation or prosecution, Personal data processing is necessary for the protection of the economic and financial interests of the State inrelation to budget, tax and financial matters. 3. Procedure and Duration of WEBADASI's Response to Applications In accordance with Article 13 of the KVK Law, WEBADASI will finalize the application requests made by personal data owners free of charge within 30 (thirty) days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, the fee in the tariff determined by the PDP Board may be charged. Our Company may accept the application or reject it for the reasons listed below by explaining the reason and may notify the relevant person in writing or electronically. The application of the personal data owner may be rejected in the following cases: ● It prevents the rights andfreedoms of other persons ● It requires disproportionate effort ● The information is publicly available ● It jeopardizes the confidentiality of others ● There is one of the situations excluded from the scope pursuant to the KVK Law (see 2.2.) 4. Pursuant to Article 14 of the PDP Law, the personal data subject may file a complaint to the PDP Board within thirty days from the date he/she learns the response of the data controller and in any case within sixty days from the date of application, in cases where his/her application is rejected, the response is insufficient or the application is not responded in due time.

A complaint to the Board will not be possible without applying to our company. 5. Other Issues WEBADASI may requestadditional information from the relevant data subject and may ask questions to the personal data subject regarding the application in order to clarify the issues in the application of the personal data subject. These obligations on this page cover not only WEBADASI but also the data coming from solution partners who have signed a contract with WEBADASI