Purpose and Scope of the Clarification Text As SYJ DANIŞMANLIK HİZMETLERİ ANONİM ŞİRKETİ (the “Company”), we take measures to protect your personal data within the scope of the Personal Data Protection Law No. 6698 (to be referred to as “KVKK” or the “Law”). We process your Personal Data within the scope of KVKK and relevant legal legislation and in our capacity as “data controller” for the reasons and methods explained below.

The SYJ DANIŞMANLIK HİZMETLERİ ANONİM ŞİRKETİ Clarification Text on the Processing of Personal Data has been prepared for the purpose of informing you in the most transparent way regarding: the identity of the data controller, the method and legal reason for collecting your personal data, for what purpose this data will be processed, to whom and for what purpose it can be transferred, the data processing period, and what your rights are as listed in Article 11 of the KVKK, in accordance with the article titled “Clarification Obligation of the Data Controller” in Article 10 of the KVKK. The explanations made for “Your Personal Data” in the clarification text also cover your “Special Quality Personal Data.”

Method and Legal Reason for Collecting Your Personal Data Your personal data may be collected through automatic or non-automatic methods, via the Company’s affiliated units, website, social media channels, software used for conducting activities within the Company, photographs, camera recordings, and verbally, in writing, or electronically. Your personal data may be processed by being created and updated as long as your relationship with the Company continues, and may be kept under protection in both digital and physical environments.

Your personal data is processed within the scope of the personal data processing conditions specified in Article 5, Paragraph 1 of Law No. 6698 (explicit consent) or as specified in Article 5, Paragraph 2: a) It is expressly provided for by the laws, c) It is necessary to process the personal data of the parties to a contract, provided that it is directly related to the establishment or performance of the contract, ç) It is mandatory for the data controller to fulfill its legal obligation, e) Data processing is mandatory for the establishment, exercise, or protection of a right, f) Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Your Processed Personal Data Your Personal Data is processed securely in accordance with the Personal Data Protection Law due to legal obligations or in order to provide a more suitable service in Company business and transactions. In this context, data of you and/or the company of which you are a shareholder/manager/representative is collected in the following categories as personal data:

• Identity: The data group containing information about the person’s identity. (e.g., Name, Surname)
• Contact: The data group that can be used to reach the person. (e.g., Phone Number, E-Mail Address, Address)
• Location: This data category refers to data types such as GPS location and travel data.
• Customer Transaction: This data category refers to data types such as call center records, invoices, orders, and request information.
• Transaction Security: This data category refers to data types such as IP address information, website login/logout information, password and passcode information. (e.g., Log Records, IP Addresses, Cookies)
• Financial Information: This data category refers to data types such as balance sheet information, financial performance information, credit and risk information, and asset information.
• Professional Experience: This data category refers to data types such as diploma information, courses attended, vocational training information, and certificates.
• Marketing: This data category refers to data types such as shopping history, surveys, cookie records, and information obtained through campaign studies.
• Visual and Auditory Records: This data category refers to data categories such as photographs and camera recordings, and voice recordings.

Purposes of processing your personal data:

• Offering our Company’s products and services to you via our website and performing sales transactions,
• Establishing sales contracts regarding our Company’s products and services, conducting invoicing processes,
• In case you create a membership; creating membership accounts via our website, conducting membership transactions, performing membership account closing and deletion transactions,
• Conducting order processes, making notifications regarding the preparation/delivery of purchased products and services,
• Fulfilling the legal obligations to which our Company is subject, primarily the Law on the Protection of the Consumer, the Law on the Regulation of Retail Trade, and the Law on the Regulation of Electronic Commerce,
• Providing information to authorized organizations arising from legislation and fulfilling official institution requests,
• Ensuring compliance with the storage obligations stipulated in the legislation,
• Ensuring the up-to-dateness and accuracy of your information,
• Evaluating and concluding your applications submitted to the Company within the scope of exercising your rights specified in Article 11 of the Law regarding your personal data processed by our Company in accordance with the legislation, and performing the necessary actions in this framework,
• Receiving, evaluating, and concluding your requests and complaints and managing customer relations,
• Storing personal data during the general statute of limitations for the purpose of following up and conducting legal affairs and constituting evidence in future disputes,
• Within the scope of our website services; properly making distance contracts and preliminary information, confirming and proving that they have been made, and ensuring that mandatory matters are complete and correct in cases where data entry is made by the Company, performing necessary controls and keeping records in the processes of ensuring compliance with the information committed in advertisements and promotions made via the website,
• Managing transactions and requests related to the tracking of financial and sales records,
• Conducting accounting and finance processes,
• Carrying out necessary work by our relevant business units for the realization of commercial activities carried out by our Company, planning business strategies, and conducting business processes related thereto,
• Performing controls to ensure the security of our website, carrying out reinforcement work in terms of information security,
• Performing customer acquisition activities,
• Managing customer relations and ensuring the up-to-dateness and accuracy of customer contact information,
• Ensuring the legal, technical, commercial, and occupational security of our Company and the relevant persons in a business relationship with our Company,
• Determining and implementing our Company’s commercial and business strategies,
• Ensuring the results arising from said legal transactions in the event of the division of the Company or the transfer of all or part of it to another firm,
• Conducting auditing and/or regulation duties to be performed by assigned and authorized public institutions and organizations and professional organizations in the nature of public institutions,
• Fulfilling information and document requests demanded by judicial organs and/or administrative authorities,
• Conducting market research, promotion, and providing necessary information regarding our products and services, evaluating complaints and suggestions, and contacting you directly via the communication channels shared with the Company,
• Fulfilling risk management and quality development activities,
• Taking all necessary technical and administrative measures for systems and applications within the scope of data security.

To Whom and For What Purpose Your Processed Personal Data Can Be Transferred By ensuring that all necessary technical and administrative measures are taken to provide the appropriate level of security in accordance with KVKK and relevant health legislation, we may transfer your Personal Data in line with the purposes stated above:

• To legally authorized public institutions and organizations upon their requests and limited to the purposes of the request,
• To our business partners for the purpose of fulfilling our services and ensuring their continuity,
• To organizations with which we have a contractual relationship for service and/or to which we provide services or cooperate with in order to carry out our activities,
• To supplier firms from which we procure services within the scope of our legitimate interests (cargo, research firms, advertising agencies, etc.) and other technical service providers (infrastructure, database management, etc. service providers), our business partners, and our shareholders,
• To the firm to which the relevant values of the Company will be transferred for the purpose of ensuring the results arising from said legal transactions in the event of the division of the Company or the transfer of all or part of it to another firm,
• Within the framework of the personal data processing conditions specified in Articles 8 and 9 of the KVK Law.

Data Processing Period and Retention Period Your personal data will be processed, limited to the purposes specified in this Clarification Text, by complying with the data processing and statute of limitations periods specified in all relevant laws and other legal legislation to which our Company and its affiliated centers and units are subject. In case of changes to the data processing periods in the laws, the new determined periods will be taken as the basis. Your personal data is processed for a period limited to the fulfillment of the purposes explained in this Clarification Text as a requirement of the principle of purpose limitation, and in any case for the period required for processing in accordance with Company practices and the customs of commercial life, and after the expiry of the periods, they are deleted, destroyed, or anonymized.

Exercise of Rights by the Relevant Person: As the relevant person, you may exercise your rights by submitting your requests within the scope of Article 11 of the Law, which regulates the rights of the relevant person, according to the “Communiqué on the Procedures and Principles of Application to the Data Controller,” in writing to the address “15063 Sok. No:22 Doğa Evleri Sitesi Bademler, Urla, İzmir” or by transmitting it electronically to the e-mail address _____________ provided that your e-mail is registered in the company systems, or by applying with a registered electronic mail to our Company’s __________ KEP address. A more comprehensive regulation on this subject and more detailed information regarding data groups are provided in the SYJ Danışmanlık Hizmetleri A.Ş. Personal Data Application and Response Procedure and the SYJ Danışmanlık Hizmetleri A.Ş. Personal Data Protection and Processing Policy. You can access the relevant procedure from our institution’s website or upon request from the relevant personnel.

Data Controller Title: SYJ DANIŞMANLIK HİZMETLERİ ANONİM ŞİRKETİ Address: 15063 SOK. NO:22 DOĞA EVLERİ SİTESİ, BADEMLER, URLA, İZMİR