Your personal data is processed in accordance with the Personal Data Protection Law No. 6698 ("KVKK") and relevant secondary legislation, limited to the activities of our company. Our company takes the utmost care in the processing and protection of your personal data. All necessary technical and administrative measures are taken to prevent the unlawful processing of personal data, prevent unlawful access to personal data, and ensure the protection of personal data.

Pursuant to Article 10 of the Law, we hereby inform you as the data controller through the policies established to cover customers, suppliers, service providers and their managers and employees, business partners, company partners, company employees, job applicants, visitors, employees of public institutions and organizations and private legal entities, and relevant third parties, as well as this disclosure statement.

This disclosure statement is issued in accordance with Article 10 of the Personal Data Protection Law No. 6698 (“Law”) and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Information Obligation.

1. Data Controller:

Danista Financial Advisory Services Inc. (19 May Mahallesi 19 May Cad. Nova Baran Plaza No:4/68 Şişli Istanbul, Tax Office: Mecidiyeköy, Tax ID No: 2700469340, Mersis No:0270046934000016); processes your personal data in its capacity as the "Data Controller" as defined in Article 3/1-ı of the Personal Data Protection Law No. 6698.

2. Purpose for Which Personal Data Will Be Processed, Processed Personal Data:

Your personal data is collected, recorded, stored, modified, reorganized, and processed in accordance with the principles set forth in the law, either fully or partially, automatically or by non-automated means as part of any data recording system.

Your personal data is processed in accordance with relevant legislation for the following purposes within the scope of company activities. Accordingly;

To develop the company's products and services, to continue corporate development activities, to maintain the company's financial and accounting, administrative, legal, and technical business processes,

In accordance with legal regulations, to make the necessary notifications to the relevant public institutions and organizations and to fulfill legal obligations,

Planning and executing human resources processes, managing the recruitment process, maintaining employee personnel files, and fulfilling financial and administrative obligations,

To ensure the conclusion and performance of contracts entered into or to be entered into by the company with its customers, potential customers, suppliers, service providers, employees, and relevant third parties with whom it has a legal relationship,

Completing the necessary procedures with the Personal Data Protection Authority under the Personal Data Protection Law,

The company’s burden of proof in legal disputes with third parties,

To maintain contact and communication with individuals with whom the company has a legal relationship, to ensure the company’s corporate integrity, and to ensure the safety of the relevant individuals with whom it is in contact,

Your personal data is processed in accordance with the conditions and purposes specified under Articles 4, 5, and 6 of the Personal Data Protection Law. Your personal data is not used for any purpose other than our company’s operations. In accordance with the purposes stated above, and limited to our company’s operations, the personal data listed below is processed.

Identity information (Turkish ID Number/Foreign ID Number, your first and last name, place and date of birth, mother and father's names, marital status, gender, marriage certificate, passport, driver's license, vehicle registration certificate information, your identity card or other identity information on the identity sharing system)

Your contact information (phone numbers, mailing address, email address)

Your location information (address, location details of where you are)

Personal Information (Employment contract, education, diploma details, certification information, SGK employment start and termination notifications, GSS enrollment information, identification details listed on the family status declaration, dependents, spouse and children’s relationship details, family members’ civil registry information, asset declaration form obtained based on the nature of the job, work certificate, resignation, termination, seniority and notice pay statements, payroll information, disciplinary investigation records, SGK registration number, service history, resume information, leave records, employee performance evaluation reports, workplace accident records, information from the job application form, reference information, bank account information, IBAN number)

Legal Proceedings Information (Personal information contained in correspondence with judicial authorities, and information in court and enforcement case files)

Customer, supplier, and service provider transaction information (First Name, Last Name, Turkish ID Number, address, email address, phone number, bank account information, details regarding payment methods such as checks, promissory notes, and credit cards, invoices, delivery notes, current account records, financial records, signature circulars, powers of attorney, commercial registry records, representation, and authorization information),

Physical Premises Security Information (camera footage of entry and exit records for customers, suppliers, service providers, managers, employees, company partners, job applicants, and visitors),

Financial Information (Balance sheet information, financial performance information, credit and risk information, asset information, bank account information, current account information, policy information),

Professional experience information (educational background, degree information, work history, reference information, courses taken, on-the-job training information, certifications, driver’s license information, and other information provided in the forms),

Visual Records (Photographic information on completed and printed forms, documents, and official identification documents; photographs taken as needed in connection with job applications and company activities; and images of you captured in camera recordings)

Health Information (Health status information provided on the job application form for employees and job applicants; medical reports, health tests, blood type information, personal health and physical disability status information, and medical board reports for employees and subcontractor employees)

Information regarding criminal convictions and security measures (criminal record, conviction status, and legal status information),

3. To Whom and for What Purpose Personal Data May Be Disclosed

Your personal data processed by our company is transferred to the natural and legal persons listed below for the purposes set forth herein, in accordance with Articles 8 and 9 of the Personal Data Protection Law No. 6698. Accordingly;

In order to fulfill the legal obligations set forth in the relevant legislation, to the relevant public institutions and organizations, including municipalities, the provincial directorates of the relevant ministries, the Revenue Administration, tax offices, and the Social Security Institution,

In order to conduct our business operations and fulfill our mutual obligations, we provide services to our customers, service providers, and suppliers,

In order to carry out occupational health and safety procedures for the relevant individuals, as part of occupational health and safety measures, employees’ health information may be shared with the relevant healthcare providers and organizations, as well as insurance companies,

To carry out the financial transactions of the relevant individuals, to banks, financial institutions, public and private legal entities, public officials,

In matters related to public safety and legal disputes, upon request and solely for the purpose required by law, to public prosecutors’ offices, courts, enforcement offices, mediators, arbitration panels, and relevant legal institutions and organizations,

In order to install the computer operating systems and software used within our company, maintain and repair the software, and perform the necessary procedures to ensure data security, we collaborate with software, hardware, IT, and technology companies,

With regard to the transfer of special category personal data within the country, such data, excluding health and sexual life data, may be processed and transferred to trade unions, public institutions, and relevant individuals for reasons stipulated by law, provided that the explicit consent of the data subject is obtained and such processing and transfer are limited to company activities.

Along with the relevant groups of individuals listed above, our company's employees, company partners, legal, financial, and tax advisors, auditors, public institutions such as ministries and judicial authorities, relevant individuals and organizations we are in contact with for foreign trade transactions, and individuals, institutions, and organizations permitted by payment services legislation, your personal data is transferred in accordance with the legislation and limited to the purpose of transfer.

4. Transfer of Data Abroad:

In accordance with the principles set forth in Article 4/2 of the KVK Law, by obtaining "Explicit Consent Texts" to be collected separately from the relevant persons whose data is processed, or in the cases provided for in Articles 5/2 and 6/3 of the Law, without seeking explicit consent, in accordance with the rules set forth in Article 9 of the Law, After the Personal Data Protection Board ("Board") announces the foreign countries that have adequate protection, only to individuals and organizations established in these countries, and for countries where it has been determined and announced that there is no adequate protection, provided that the data controllers in Turkey and the relevant foreign country have committed in writing to provide adequate protection and the necessary permissions have been obtained from the Personal Data Protection Board for the relevant transfer, the data may be transferred on a limited basis.

Within this scope, in accordance with the limits set forth in Law No. 6698, and with all necessary measures taken, your personal information may be transferred abroad in accordance with the legislation and limited to the purpose of transfer, within the scope of your legal relationship and activities with our company.

5. Method and Legal Grounds for Collecting Personal Data:

Your personal data will be processed within the scope of company activities, limited to the specified purposes, in any verbal, written, or electronic medium, for the purposes of filling out application forms, creating personnel files, drafting and executing contracts, accounting, establishing and maintaining financial and social rights, processing financial information, purchasing, marketing, planning,and the use of a video camera recording system to ensure the security of company buildings and annexes, both indoors and outdoors, are processed and collected by fully or partially automated means or by non-automated means, provided that they are part of any data recording system.

In accordance with the legal regulations to which our company is subject, your personal data and special category personal data are generally processed based on the explicit consent of the relevant person in order for our company to be able to provide products and services and to fully and accurately fulfill its obligations arising from contracts and legal regulations within this scope. Additionally, your personal data is processed without requiring explicit consent in the following cases within the scope of your contact with our company.

Provided that it is directly related to the establishment or performance of contracts between our company and third parties, whether natural or legal persons, and that the processing of personal data belonging to the parties to the contract is necessary,

It is mandatory for the company to fulfill its legal obligations,

Personal data has been made public by the data subject themselves,

Where processing is necessary for the establishment, exercise, or defense of legal claims,

Processing of data is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Because it is expressly provided for in the laws,

Personal data is processed, collected, and transferred strictly for the purposes specified in accordance with Articles 5 and 6 of the Personal Data Protection Law No. 6698 and Article 5/1-h of the Circular on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.

6. Rights of the Data Subject (Right to Apply):

Requests under Article 11 of the Personal Data Protection Law No. 6698, which regulates the rights of the data subject, should be submitted to the data controller, Danista Financial Advisory Services Inc., in accordance with the Circular on the Procedures and Principles for Submitting Requests to the Data Controller. (19 Mayıs Mahallesi 19 Mayıs Cad. Nova Baran Plaza No:4/68 Şişli İstanbul) by filling out the attached "APPLICATION FORM" as the data subject, delivering a signed copy of the form in person to the company address along with documents proving your identity, You may also submit your personal application via email to [email protected] using a secure electronic signature, mobile signature, or the email address you have provided to our company and which is registered in our company's system. Alternatively, you may submit your application through a notary public or using the methods specified by the Personal Data Protection Authority.

Pursuant to Article 11 of the Law; everyone may apply to the data controller regarding themselves;

Learning whether personal data is being processed or not,

Requesting information regarding the processing of personal data,

Learning the purpose of processing personal data and whether it is being used for its intended purpose,

Knowing the third parties to whom personal data is transferred within or outside the country,

Requesting the correction of personal data if it has been processed incompletely or incorrectly,

Requesting the deletion or destruction of personal data within the framework of the conditions set forth in Article 7 of the KVKK,

Requesting that third parties to whom personal data has been transferred be notified of any rectification, erasure, or destruction of personal data.

Objecting to a result that is detrimental to the individual arising solely from the analysis of processed data by automated systems,

In the event of damage caused by the unlawful processing of personal data, they have the right to request compensation for the damage.

Pursuant to Article 13/1 of the Personal Data Protection Law No. 6698, in order to exercise your rights mentioned above, you must submit your requests to our company in writing or through the methods specified by the Personal Data Protection Authority. Our company will process your requests as soon as possible and within a maximum of thirty days, free of charge, depending on the nature of the request. However, if the process incurs additional costs, the fee specified in the tariff determined by the Board will be charged. In this context, if a written response is provided to the relevant person's application, no fee will be charged for up to ten pages, and a processing fee of 1 TL will be charged for each page exceeding ten pages. If the response to the request is provided in an electronic format such as a CD or flash drive, the fee charged by our company will not exceed the cost of the recording medium.