As GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş., the protection of our users' personal data is our priority.

In this context, within the scope of the Law on Protection of Personal Data No. 6698 (KVKK), we would like to enlighten you in our capacity as the data controller.

Your personal data that we record may be processed, transferred to third parties located domestically and abroad, stored, used for profiling, and classified in connection with our service purposes and legal obligations, in accordance with the processing and transfer purposes, collection methods, legal reasons, and collection activities set forth in this text, pursuant to the KVKK. Furthermore, this clarification text aims to inform you about your rights under the KVKK.

In order to use the services of GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş., some of your personal information (name-surname, telephone, e-mail, date of birth, marital status, etc.) may be requested from you. The data collected regarding your relevant personal data will be kept within GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. Member companies of GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. may access this information and contact you via e-mail, telephone, or SMS in accordance with their business purposes.

1- PURPOSES OF PROCESSING PERSONAL DATA

Your personal data collected by GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. may be processed within the personal data processing conditions and purposes specified in Articles 5 and 6 of the Law for the following purposes. Specifically:

• Pursuant to paragraph 1 of Article 5, with "Explicit consent",
• Pursuant to paragraph 2, item a, "Explicitly stipulated in laws",
• Pursuant to item b, "It is mandatory for the protection of life or physical integrity of the person or of any other person who is bodily incapable of giving his consent or whose consent is not deemed legally valid",
• Pursuant to item c, "Processing of personal data belonging to the parties of a contract, is necessary provided that it is directly related to the establishment or performance of the contract",
• Pursuant to item ç, "It is mandatory for the controller to be able to perform his legal obligations",
• Pursuant to item d, "The data concerned is made available to the public by the data subject himself",
• Pursuant to item e, "Data processing is mandatory for the establishment, exercise or protection of any right",
• Pursuant to item f, "It is mandatory for the legitimate interests of the controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject",
• Based on the legal grounds of "Explicit consent" specified in Paragraph 2 of Article 6 and "Processing of special categories of personal data other than health and sexual life without explicit consent in cases foreseen by laws" specified in Paragraph 3.

As GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş., we process your personal data for the following purposes:

• Planning and execution of activities necessary for customizing the products and services we offer according to the tastes, usage habits, and needs of the persons concerned and recommending and introducing them to the relevant persons,
• Planning and/or execution of member/user satisfaction activities,
• Planning and/or execution of market research activities for the sales and marketing of products and services,
• Planning and/or execution of marketing processes of products and/or services,
• Planning and/or execution of relevant processes to obtain the highest benefit from the products or services offered by GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş.,
• Planning and/or execution of sales processes of products and/or services, planning and/or execution of after-sales support service activities,
• Planning and/or execution of member/user relationship management processes, tracking and finalizing requests and/or complaints,
• Tracking of contract processes and/or legal requests,
• Ensuring the legal, technical, and commercial business security of GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. and the relevant persons in business relations with it,
• Planning and/or execution of audit activities,
• Planning and fulfillment of operational activities, ensuring data is accurate and up-to-date,
• Providing information to authorized institutions arising from legislation,
• Planning, auditing, and execution of information security processes, creation of information technology infrastructure,
• Tracking of finance, accounting, insurance, law, and tax affairs,
• Performing efficiency/productivity analyses of business activities, execution of corporate communication activities.

Additionally, your personal information will be processed for purposes such as marketing, advertising, periodic campaign studies, designing special promotional activities for customer profiles, customer "classification" studies, evaluation of customer satisfaction complaints and analysis activities, targeting, strategy and efficiency studies, and other purposes explained in this text.

2- PERSONS TO WHOM PERSONAL DATA MAY BE TRANSFERRED AND PURPOSE OF TRANSFER

GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. may share your data with the following persons and institutions for the purposes of reaching its customers more easily and carrying out advertising, publicity, and promotion activities:

• Business partner e-mail transmission companies,
• Customer panels,
• Social media companies (e.g., Facebook, Twitter, YouTube, Instagram, etc.),
• Internet search engine companies (e.g., Google, Yandex, etc.),
• SMS sending companies,
• Third parties located domestically and abroad providing storage, archiving, information technology support (server, hosting, program, cloud computing),
• Companies processing data on behalf of GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş., providing customer satisfaction measurement, and profiling support,
• Audit companies, affiliates, shareholders, and legally authorized public institutions.

GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. does not use the collected information for commercial purposes for any reason and does not sell it without the knowledge or contrary instruction of the member in question, except for legal obligations and liabilities. Your information may only be disclosed to official authorities if this information is requested by official authorities in due form and in cases where it is obliged to make a statement to official authorities in accordance with the provisions of the mandatory legislation in force.

3- METHOD OF COLLECTING PERSONAL DATA

As stated above, your personal data is processed during the entries made and forms filled out required for you to benefit from the GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. service.

4- STORAGE DURATION OF PERSONAL DATA

GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. will retain the personal data obtained for the period necessary for the purpose for which they are processed in this KVKK Clarification Text and the GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. MEMBERSHIP AGREEMENT, in order to fulfill its obligations arising from legal legislation and for the optimization of the service offered to its members/users.

According to Art. 7, paragraph 1 of Law No. 6698, personal data within the scope of this text will be deleted, destroyed, or anonymized within the scope of the relevant legislation when the purpose requiring processing disappears and/or when the limitation periods mandatory for the processing of data in accordance with the legislation expire.

5- RIGHTS OF PERSONAL DATA OWNERS

Pursuant to the KVKK and relevant legislation, data subjects have the following rights by applying to GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş.:

• To learn whether personal data is processed or not,
• If personal data has been processed, to request information regarding this,
• To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
• To know the third parties to whom personal data is transferred domestically or abroad,
• To request correction of personal data in case of incomplete or incorrect processing and to request notification of the transaction made within this scope to third parties to whom personal data is transferred,
• To request the deletion or destruction of personal data within the framework of the conditions foreseen in the relevant legislation,
• To request notification of the correction, deletion, and destruction processes made in accordance with the relevant legislation to third parties to whom personal data is transferred,
• To object to the occurrence of a result against the person himself by analyzing the processed data exclusively through automated systems,
• To demand compensation for the damage in case of loss due to unlawful processing of personal data.

Procedures and methods for exercising relevant rights must be made according to the conditions and methods determined in the communiqué published by the Personal Data Protection Authority.

GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. may provide its reasoned positive/negative response regarding the requests listed above in writing or digitally as soon as possible and within 30 days at the latest. If the transactions subject to the request require a cost, it is possible to request a fee and expense based on the tariff determined by the Personal Data Protection Board.

PERSONAL DATA PROTECTION LAW EXPLICIT CONSENT TEXT

By logging in/registering to benefit from the service provided by GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. or when you give your explicit consent while benefiting from our services, you accept and declare that you have read and understood the "Privacy Policy and Clarification Text" above and that you give explicit consent to the collection of your personal data by GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. within the scope of KVKK through the methods specified above, processing within the purposes specified above, and transferring to third (real/legal) persons in the country and abroad specified above.