Your personal data is processed in accordance with the Law on the Protection of Personal Data No. 6698 (“KVKK”) and relevant secondary legislation, and is limited to our company’s operations. Our company takes the utmost care in the processing and protection of your personal data. All necessary technical and administrative measures are taken to prevent the unlawful processing of personal data, to prevent unlawful access to personal data, and to ensure the security of personal data.

In accordance with Article 10 of the Law, we hereby inform you, as the data controller, through the policies established to cover customers, suppliers, service providers and their managers and employees, business partners, company partners, company employees, job applicants, visitors, employees of public institutions and organizations, and employees of private legal entities, as well as relevant third parties, and through this privacy notice.

This privacy notice is issued pursuant to Article 10 of the Personal Data Protection Law No. 6698 (“the Law”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Provide Information.

1. Data Controller:

Danista Financial Advisory Services Inc. (19 Mayıs Neighborhood, 19 Mayıs Street, Nova Baran Plaza No. 4/68, Şişli, Istanbul; Tax Office: Mecidiyeköy; Tax ID No.: 2700469340; MERSIS No.: 0270046934000016); processes your personal data in its capacity as the “Data Controller” as defined in Article 3/1-ı of the Personal Data Protection Law No. 6698.

2. The Purpose for Which Personal Data Will Be Processed, and the Personal Data to Be Processed:

Your personal data is collected, recorded, stored, modified, and reorganized—either in whole or in part, automatically or by non-automated means provided it is part of a data recording system—in accordance with the principles set forth by law.

Your personal data is processed in accordance with applicable laws for the following purposes within the scope of the company’s operations. Accordingly;

To develop the company’s products and services, to continue corporate development activities, and to manage the company’s financial, accounting, administrative, legal, and technical business processes,

In accordance with legal regulations, to submit the necessary notifications to the relevant public institutions and organizations and to fulfill legal obligations,

Planning and implementing human resources processes, handling job application processes, creating personnel files for employees, fulfilling financial and administrative obligations,

To ensure the conclusion and performance of contracts that the company has entered into or will enter into with its customers, potential customers, suppliers, service providers, employees, and relevant third parties with whom it has a legal relationship,

Completing the necessary procedures with the Data Protection Authority under the Data Protection Law,

The company’s burden of proof in legal disputes with third parties,

To maintain contact and communication with individuals with whom the company has a legal relationship, to ensure the company’s corporate integrity, and to ensure the safety of the relevant individuals with whom it is in contact,

Your personal data is processed in accordance with the conditions and purposes specified under Articles 4, 5, and 6 of the Personal Data Protection Law. Your personal data is not used for any purpose other than our company’s operations. In accordance with the purposes stated above, and limited to our company’s operations, the personal data listed below is processed.

Identification information (Turkish ID Number/Foreign ID Number, your first and last name, place and date of birth, your mother’s and father’s names, your marital status, your gender, information listed on your marriage certificate, passport, driver’s license, and vehicle registration certificate, as well as other demographic information contained in your population registry record or the Identity Sharing System)

Your contact information (phone numbers, mailing address, email address)

Your location information (address, location details of where you are)

Personal Information (Employment contract, education, diploma information, certificate information, SGK employment start and termination notifications, GSS enrollment information, identification information listed on the family status declaration, dependents, spouse, and children’s relationship details, family members’ civil registry information, asset receipt form obtained based on the nature of the job, work certificate, resignation, termination, seniority and notice pay statements, pay stub information, disciplinary investigation information, SGK registration number, service history, resume information, leave information, employee performance evaluation reports, workplace accident information, information included in the job application form, reference information, bank account information, and IBAN number)

Legal Proceedings Information (Personal information contained in correspondence with judicial authorities; information in court and enforcement case files)

Customer, supplier, and service provider transaction information (first name, last name, Turkish ID number, address, email address, phone number, bank account information, information regarding payment methods such as checks, promissory notes, and credit cards, invoices, shipping documents, current account information, financial records, signature circulars, powers of attorney, commercial registry records, representation, and authorization information),

Physical Premises Security Information (camera footage of entries and exits by customers, suppliers, service providers, managers, employees, company partners, job applicants, and visitors),

Financial Information (Balance sheet information, financial performance information, credit and risk information, asset information, bank account information, checking account information, policy information),

Professional experience information (educational background, degree information, work history, reference information, courses taken, on-the-job training information, certifications, driver’s license information, and other information provided on the forms),

Visual Records (Photographic information on completed and printed forms, documents, and official identification documents; photographs taken as needed in connection with job applications and company activities; and images of you captured in camera recordings)

Health Information (Health status information provided on the job application form for employees and job applicants; medical reports, health tests, blood type information, personal health and physical disability status information, and medical board reports for employees and subcontractor employees)

Information regarding criminal convictions and security measures (criminal record, conviction status, and legal status information),

3. To Whom and for What Purposes Personal Data May Be Transferred

Your personal data processed by our company is transferred to the natural and legal persons listed below for the purposes set forth herein, in accordance with Articles 8 and 9 of the Personal Data Protection Law No. 6698. Accordingly;

In order to fulfill the legal obligations set forth in the relevant legislation, to the relevant public institutions and organizations, including municipalities, the provincial directorates of the relevant ministries, the Revenue Administration, tax offices, and the Social Security Institution (SGK),

In order to conduct our business operations and fulfill our mutual obligations, we are committed to our customers, service providers, and suppliers,

In order to carry out occupational health and safety procedures for the relevant individuals, and as part of occupational health and safety measures, employees’ health information may be shared with the relevant healthcare providers and organizations, as well as insurance companies,

To carry out the financial transactions of the relevant individuals, to banks, financial institutions, public and private legal entities, public officials,

In matters related to public safety and legal disputes, upon request and solely for the purpose required by law, to public prosecutors’ offices, courts, enforcement offices, mediators, arbitration panels, and relevant legal institutions and organizations,

In order to install the computer operating systems and software used within our company, to maintain and repair the software, and to carry out the necessary procedures to ensure data security, we collaborate with software, hardware, IT, and technology companies,

With regard to the domestic transfer of special-category personal data, provided that the data subject’s explicit consent is obtained, special-category personal data—excluding data related to health and sexual life—as well as union membership information may be processed and transferred to relevant unions, government agencies, and data subjects, limited to the scope of the company’s activities, for the reasons specified by law.

In addition to the relevant groups of individuals listed above, your personal data may be transferred to our company’s employees, partners, legal, financial, and tax advisors, auditors, as well as relevant individuals and entities with whom we are in contact for foreign trade transactions—including public institutions, ministries, and judicial authorities—and to individuals, institutions, and organizations permitted under payment services legislation, provided that such transfers are in compliance with the law and limited to the purpose of the transfer.

4. Transfer of Data Abroad:

In accordance with the principles set forth in Article 4(2) of the Personal Data Protection Law, either by obtaining “Explicit Consent Statements” to be collected separately from the data subjects whose data is being processed, or—in the cases provided for in Articles 5(2) and 6(3) of the Law—without requiring explicit consent, in accordance with the rules set forth in Article 9 of the Law, once foreign countries with adequate protection, as determined by the Personal Data Protection Board (“the Board,”), have been announced, personal data may be transferred only to individuals and entities established in those countries; for countries where adequate protection has been determined not to exist and announced as such, transfers may be made only if the data controllers in Turkey and in the relevant foreign country have committed in writing to providing adequate protection and the necessary authorizations have been obtained from the Personal Data Protection Board for the relevant transfer.

In this context, within the limits set forth by Law No. 6698 and after taking all necessary precautions, your personal information—in connection with your legal relationship with our company and your activities—may be transferred abroad in compliance with the relevant legislation and limited to the purpose of such transfer.

5. Methods and Legal Grounds for Collecting Personal Data:

Your personal data is processed—within the scope of the company’s activities and limited to the specified purposes—in any oral, written, or electronic format, for the purposes of filling out application forms, creating personnel files, drafting and executing contracts, accounting, processing financial information to establish and maintain financial and social rights, procurement, marketing, planning,and the use of video surveillance systems to ensure security in the interior and exterior areas of company buildings and annexes—are processed and collected either fully or partially automatically, or through non-automated means provided they form part of a data recording system.

In accordance with the legal regulations to which our company is subject, and in order for our company to provide its products and services and, in this context, to fully and accurately fulfill its obligations arising from contracts and applicable laws, your personal data and special category personal data are, as a general rule, processed based on the explicit consent of the data subject. Additionally, in the context of your interaction with our company, your personal data is processed without requiring explicit consent in the following cases:

Provided that it is directly related to the conclusion or performance of contracts between our company and third-party individuals or legal entities, and that the processing of personal data belonging to the parties to the contract is necessary,

It is necessary for the company to be able to fulfill its legal obligations,

The fact that the personal data has been made public by the data subject,

Where data processing is necessary for the establishment, exercise, or defense of a legal claim,

Provided that it does not infringe upon the fundamental rights and freedoms of the data subject, the processing of data is necessary for the legitimate interests of the data controller.

Because it is expressly provided for by law,

Personal data is processed, collected, and transferred solely for the purposes specified in accordance with Articles 5 and 6 of the Personal Data Protection Law No. 6698 and Article 5/1-h of the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Provide Information.

6. Rights of the Data Subject (Right to File a Request):

You may submit your requests under Article 11 of the Personal Data Protection Law No. 6698, which “regulates the rights of the data subject,” to Danista Financial Advisory Services Inc. as the data controller, in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller (located at 19 Mayıs Mahallesi, 19 Mayıs Cad., Nova Baran Plaza No: 4/68, Şişli, Istanbul). As the data subject, you may submit your request by filling out the “APPLICATION FORM” provided in the attachment and personally delivering a signed copy of the form to the company’s address along with documents verifying your identity, submit a personal application via email to [email protected] using a secure electronic signature, mobile signature, or the email address you have provided to us and which is registered in our system; submit an application through a notary public; or submit it using the methods specified by the Personal Data Protection Authority.

Pursuant to Article 11 of the Law, anyone may contact the data controller regarding their own personal data to:

The right to know whether personal data is being processed,

To request information regarding the processing of personal data,

The right to learn the purpose of the processing of personal data and whether it is being used in accordance with that purpose,

The right to know which third parties, whether within the country or abroad, personal data is transferred to,

The right to request the correction of personal data that has been processed incompletely or incorrectly,

The right to request the erasure or destruction of personal data in accordance with the conditions set forth in Article 7 of the KVKK,

In the event of the correction, deletion, or destruction of personal data, the right to request that these actions be communicated to third parties to whom the personal data has been transferred,

The right to object to a decision made solely through the automated processing of personal data that results in adverse consequences for the individual,

Individuals have the right to request compensation for damages suffered as a result of the unlawful processing of their personal data.

Pursuant to Article 13/1 of the Personal Data Protection Law No. 6698, in order to exercise your rights as stated above, you must submit your requests to our company in writing or through the methods specified above by the Personal Data Protection Authority. Our company will process your requests contained in the application free of charge as soon as possible and no later than thirty days, depending on the nature of the request. However, if the process incurs additional costs, a fee based on the schedule determined by the Board will be charged. In this context, if a written response is provided to the data subject’s request, no fee will be charged for up to ten pages; a processing fee of 1 TL will be charged for each page exceeding ten pages. If the response to the request is provided on an electronic storage medium such as a CD or flash drive, any fee charged by our company will not exceed the cost incurred for the storage medium itself.