CLARIFICATION TEXT ON THE PROCESSING OF PERSONAL DATA

In this Clarification Text, the principles regarding the processing of your personal data by MESAİ TEKNOLOJİ DANIŞMANLIK VE TİCARET ANONİM ŞİRKETİ (“Mesai” and/or “Company”) located at the address of the data controller MALTEPE MAH. YILANLI AYAZMA SK. NEF 13 D BLOK NO: 13 D INTERIOR DOOR NO: 84 ZEYTİNBURNU/ İSTANBUL in accordance with the Personal Data Protection Law No. 6698 (“Law”) and the relevant legislation are stated below.

1. Purpose of Processing Personal Data

Your personal data in the form of your identity information (name, surname), contact information (e-mail), IP information obtained due to your visit to our website may be processed by our Company for the purposes listed below:

• In case of a request from the contact department, social media accounts and/or various communication channels,

2. Method and Legal Grounds for Collection of Personal Data

Your personal data are collected by our Company in written and electronic media as part of the data recording system by means of cookies, which are technical communication files due to your visit to our website, and by fully or partially automated methods for the purposes specified in this Clarification Text. For detailed information about cookies, please see Cookie Clarification Text.

Your personal data collected other than cookies are collected as part of the data recording system by non-automated or partially automated methods, verbally/written in electronic and/or physical environments, non-automated or partially automated methods by filling out the forms on the website, establishing the contract regarding the membership relationship and / or sharing it with our Company within the scope of using the application.

Your personal data is processed in accordance with the following legal grounds:

• Explicit consent of the person concerned pursuant to Article 5/1 of the Law,
• Pursuant to Article 5/2 (a) of the Law, it is expressly provided for in the law,
• Pursuant to Article 5/2 (c) of the Law, provided that it is directly related to the conclusion or performance of a contract, it is necessary to process personal data of the parties to the contract,
• It is mandatory for the data controller to fulfill its legal obligations pursuant to Article 5/2 (ç) of the Law,
• Pursuant to Article 5/2 (e) of the Law, data processing is mandatory for the establishment, exercise or protection of a right,
• Data processing is mandatory for the legitimate interests of our Company, provided that it does not harm your fundamental rights and freedoms in accordance with Article 5/2 (f) of the Law.

1. Places of Transfer of Processed Personal Data and Purpose of Transfer

The purpose of processing personal data and the purpose of data transfer are parallel. Our Company may transfer the personal data it collects to its business partners with whom it cooperates in order to carry out its activities, to its suppliers, service providers, affiliates, consultants and, upon request, to official authorities, public institutions and organizations within the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law.

If you consent to sending commercial electronic messages to you, your personal data may be transferred to İleti Yönetim Sistemi A.Ş. in accordance with your consent.

1. Ways to Apply to the Data Controller and Your Rights

Pursuant to Article 11 of the Law, by applying to our Company, your personal data; a) to learn whether your personal data is processed, b) to request information if processed, c) to learn the purpose of processing and whether it is used in accordance with its purpose, d) to learn the parties to whom it is transferred domestically, e) to request correction if incomplete / incorrectly processed, f) To request the deletion/destruction within the framework of the conditions stipulated in Article 7 of the Law, g) to request notification of the transactions made in accordance with the above-mentioned subparagraphs (e) and (f) to the third parties to whom it is transferred, h) to object to the occurrence of a result against you due to the analysis exclusively by automated systems, i) You have the right to demand compensation for the damage in case you suffer damage due to processing in violation of the Law.

You can submit your information and application requests regarding your rights stated above to our Company in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. You can send your information and application requests to [-] or by e-mail to [-] and direct them to us.

Our Company finalizes your requests free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, a fee may be charged if the transaction requires an additional cost. Our Company may accept and process the request or reject the request in writing by explaining the reason.

In cases where the application made by following the above-mentioned procedure is rejected, the response is found insufficient or the application is not responded to in due time, there is a right to file a complaint to the Personal Data Protection Board (“Board”) within thirty days following the notification of the response and in any case within sixty days from the date of application. However, a complaint cannot be filed before exhausting the remedy.

The Board, upon a complaint or ex officio upon learning of an alleged violation, shall conduct the necessary investigation on matters within its jurisdiction. Upon a complaint, the Board shall examine the request and give a response to those concerned. If no response is given within sixty days from the date of the complaint, the request shall be deemed rejected. If it is understood that there is a violation as a result of the examination made upon complaint or ex officio, the Board decides that the unlawfulness detected by the Board shall be eliminated by the data controller and notifies the relevant parties. This decision shall be fulfilled without delay and within thirty days at the latest following the notification. The Board may decide to suspend data processing or transfer of data abroad in the event of irreparable or impossible damages and in the event of a clear violation of the law.

Your data is sensitively protected by our Company and we thank you for your trust in us.