Personal Data Processing Information Text

As İhlas Holding A.Ş. ("Company") and İhlas Group Companies; we show utmost sensitivity to the security of your personal data. With this awareness, as a Company, we attach great importance to the processing and storage of personal data held by us regarding persons related to our Company, including our customers, consumers and employees who benefit from our products and services, in accordance with the Constitution of the Republic of Turkey and international agreements to which our country is a party regarding human rights, especially the Personal Data Protection Law No. 6698 ("PDPL") and relevant legislation.

In this context, we would like to inform you as a "Data Controller" as defined in the Personal Data Protection Law.

With the full awareness of this responsibility, we process your personal data as explained below and within the limits mandated by legislation.

Your personal data that you share with our Company as a consumer, subscriber, customer, supplier or employee may be processed, transferred to third parties domestically and abroad, stored, used for profiling and classified in accordance with PDPL, in connection with our activities and service purposes and proportionally.

1. Collection, Processing and Processing Purposes of Personal Data

Your personal data may vary depending on the service provided by our Company and the commercial activities of our Company; may be collected orally, in writing or electronically through automatic or non-automatic methods, through our Company units, İhlas Group Companies, website, social media channels, mobile applications and similar means. Your personal data may be processed by creating and updating as long as you benefit from the products and services offered by our Company and İhlas Group Companies.

In addition, when you use our call centers or our website to use the services of the Company or İhlas Group Companies, when you visit our Company or our website, when you participate in trainings, seminars or organizations organized by our Company, your personal data may be processed.

Your Personal Data Collected;

• To enable you to benefit from the products and services offered by our Company and İhlas Group Companies, to understand your preferences, usage habits and needs of the products and services offered, to respond to your requests faster and to improve our communication with you to provide you with better service and to offer more personalized products, services and offers, to analyze to be able to do these, to inform you about our products and services, to measure your satisfaction with our products and services, to develop and diversify our products and services in line with your requests and needs,
• Ensuring the legal and commercial security of our Company, İhlas Group Companies and persons in business relationship with our Company (administrative operations for communication carried out by our Company, ensuring the physical security and control of locations owned by the Company, İhlas Group Company customer evaluation / complaint management processes, reputation research processes, event management, legal compliance process, audit, financial affairs, etc.),
• Determining and implementing the commercial and business strategies of our Company,
• For the purpose of ensuring the implementation of our Company's human resources policies; employee data, in addition to the obligations stipulated by the Labor Law and labor and social security legislation and other legislation in force, to increase the performance level and employee satisfaction and to ensure occupational safety and industrial peace

for the purposes specified in Articles 5 and 6 of the Personal Data Protection Law, which are clearly stated below;

Article 5 - Conditions for Processing Personal Data

(1) Personal data cannot be processed without the explicit consent of the data subject.

(2) In case of the existence of one of the following conditions, it is possible to process personal data without seeking the explicit consent of the data subject:

1. Being explicitly stipulated in laws.
2. Being necessary for the protection of the life or physical integrity of the person who is unable to express his/her consent due to factual impossibility or whose consent is not legally valid, or of another person.
3. Being necessary for the processing of personal data belonging to the parties of a contract, provided that it is directly related to the establishment or performance of a contract.
4. Being mandatory for the data controller to fulfill its legal obligation.
5. Being made public by the data subject himself/herself.
6. Being mandatory for data processing for the establishment, exercise or protection of a right.
7. Being mandatory for data processing for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Article 6 - Conditions for Processing Special Categories of Personal Data

(1) Data concerning people's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress and attire, association, foundation or union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data are special categories of personal data.

(2) Processing special categories of personal data without the explicit consent of the data subject is prohibited.

(3) Personal data other than health and sexual life mentioned in the first paragraph may be processed without seeking the explicit consent of the data subject in cases stipulated in laws. Personal data regarding health and sexual life can only be processed without seeking the explicit consent of the data subject by persons or authorized institutions and organizations under the obligation of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing.

(4) In processing special categories of personal data, it is also mandatory to take adequate measures determined by the Board.

2. To Whom and For What Purpose the Processed Personal Data May Be Transferred

Your personal data collected and processed; for the purposes listed in Article 1 of this document, in accordance with PDPL and current legislation, may be shared within our affiliated partnerships and subsidiaries and İhlas Group companies, as well as, without being limited to those listed; with our business partners, business connections, subcontractors, suppliers, company officials and shareholders for the purpose of the service we provide or with regulatory supervisory institutions and official authorities in cases stipulated by relevant legislation, within the framework of personal data processing conditions and purposes specified in Articles 8 and 9 of the Personal Data Protection Law, may be transferred domestically or abroad.

3. Method and Legal Basis of Personal Data Collection

Your personal data is acquired in all kinds of verbal, written or electronic environments, for the purposes stated above, in order to provide the products and services we offer as a Company within the determined legal framework and for our Company to fulfill its contractual and legal responsibilities completely and correctly in this context.

Your personal data is collected verbally, in writing or electronically by our Company or natural or legal persons processing data on behalf of our Company, through tools such as, but not limited to, websites, various contracts, mobile applications, e-mail, application forms, written or verbal communications with our Company, etc.

Your personal data collected for these purposes and legal reasons may also be processed and transferred for the purposes specified in Articles (1) and (2) of this text within the scope of personal data processing conditions and purposes specified in Articles 5 and 6 of the Personal Data Protection Law.

4. Rights of the Personal Data Subject Listed in Article 11 of the Personal Data Protection Law

As personal data subjects, when you convey your requests regarding your rights to our Company through the methods regulated below in this Information Text, our Company will conclude the request free of charge within thirty days at the latest, depending on the nature of the request. However, if a fee is stipulated by the Personal Data Protection Board, the fee in the tariff determined by our Company will be charged.

In this context, personal data subjects have the right to;

• Learn whether personal data is processed or not,
• Request information about it if personal data has been processed,
• Learn the purpose of processing personal data and whether they are used in accordance with their purpose,
• Know the third parties to whom personal data is transferred domestically or abroad,
• Request correction if personal data is processed incompletely or incorrectly and request notification of the transaction made in this context to third parties to whom personal data has been transferred,
• Request deletion or destruction of personal data in case the reasons requiring processing have disappeared, although they have been processed in accordance with the Personal Data Protection Law and other relevant legal provisions, and request notification of the transaction made in this context to third parties to whom personal data has been transferred,
• Object to the emergence of a result against the person by analyzing the processed data exclusively through automated systems,
• Request compensation for damage in case of damage due to unlawful processing of personal data

You have these rights.

In accordance with the first paragraph of Article 13 of the Personal Data Protection Law, you can convey your request regarding the exercise of your rights mentioned above to our Company in writing or in accordance with this method if a separate method is determined by the Personal Data Protection Board.

In this application that you will make to exercise your rights as a personal data subject and which includes your explanations regarding the right you want to exercise; we importantly remind you that your request should be clear and understandable, the subject you request should be related to yourself or if you are acting on behalf of someone else, you should be specially authorized on this matter and your authorization should be documented, and it should also include identity and address information and documents proving your identity should be added to the application.

Within this framework, the channels and procedures through which you will submit your written applications to our Company within the scope of Article 11 of the Personal Data Protection Law are explained below.

To exercise your rights mentioned above, you can submit your request containing the necessary information to identify your identity and your explanations regarding the right you want to exercise among the rights specified in Article 11 of the Personal Data Protection Law; by filling out the ("PERSONAL DATA SUBJECT APPLICATION FORM") at www.ihlas.com.tr in accordance with the information text at the beginning of the form, and delivering a signed copy of the form

İhlas Holding A.Ş. Merkez Mahallesi, 29 Ekim Caddesi, İhlas Plaza No:11 B/21, 34197, Yenibosna, Bahçelievler, Istanbul, Turkey

You can deliver it personally with documents identifying your identity to the address, send it through notary channels or other methods specified in the Personal Data Protection Law, or you can send the relevant form to kvk.basvuru@ihlas.com.tr.

Attachments

İhlas Holding Personal Data Protection and Processing Policy

Application Form