Privacy Notice

It is one of our company’s leading principles to protect the privacy of individuals who visit the tpcomply.ai domain names, our customers and their valued employees, individuals who receive or wish to receive information about our products or services, our business partners and/or solution partners and their employees (“Data Subject”). This Privacy Notice under the Turkish Personal Data Protection Law (KVKK) provides explanations regarding the processing of Data Subjects’ personal data. PROCESSING OF DATA SUBJECTS’ PERSONAL DATA Personal data obtained from the above-mentioned Data Subjects through various channels, including the website, telephone, postal mail, e-mail, face-to-face meetings, and the physical delivery of documents, may be processed by TPComply within the scope described below pursuant to Law No. 6698 on the Protection of Personal Data (“Law”). PURPOSE OF PROCESSING YOUR PERSONAL DATA Your personal data may be processed by TPComply for the purposes listed below, in accordance with Articles 5 and 6 of the KVKK:

1. Carrying out the necessary work by our business units and executing the relevant business processes to enable relevant individuals to benefit from the products and services offered by the Company,
2. Planning and carrying out the necessary activities to customize, recommend, and promote the products and services offered by the Company according to the preferences, usage habits, and needs of relevant individuals,
3. Carrying out the necessary work by our relevant business units to conduct the commercial activities performed by the Company and executing the related business processes,
4. Monitoring the Company’s finance and accounting operations,
5. Planning and executing the Company’s commercial and business strategies,
6. Ensuring the legal, technical, and commercial-business security of the Company and of relevant individuals who have a business relationship with the Company,
7. Planning and carrying out market research activities for the sales and marketing of products and services,
8. Ensuring the continuous improvement of customer and employee satisfaction,
9. Identifying participants and carrying out events such as webinars, seminars, teleconferences, conferences, online meetings, and similar activities.

PARTIES TO WHOM YOUR PERSONAL DATA IS TRANSFERRED AND PURPOSE OF TRANSFER Your personal data may be transferred, in line with the purposes of processing your personal data, to our business partners, suppliers, legally authorized public institutions, and private persons within the scope of the personal data processing conditions and purposes specified in Articles 8 and 9 of the KVKK. METHOD OF COLLECTION AND LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA Any information that identifies or makes you identifiable is considered “personal data.” Your personal data is collected in written or electronic environments in accordance with the data processing conditions set out in the Law through the following methods:

1. Through cookies, which are technical communication files, when you visit our websites,
2. Through contact areas available on our websites,
3. Through the Cybersecurity Assessment study available on our website,
4. Through our corporate e-mail addresses,
5. Through our registered electronic mail address,
6. In writing by postal mail,
7. In writing through hand delivery,
8. Verbally,
9. By telephone.

RIGHTS OF DATA SUBJECTS As personal data subjects, we hereby inform you that you have the following rights under Article 11 of the Law:

1. To learn whether your personal data has been processed,
2. To request information if your personal data has been processed,
3. To learn the purpose of processing your personal data and whether it is used in accordance with that purpose,
4. To know the third parties to whom your personal data has been transferred domestically or abroad,
5. To request the correction of your personal data if it has been processed incompletely or inaccurately, and to request that the correction be notified to third parties to whom your personal data has been transferred,
6. To request the deletion or destruction of your personal data if the reasons requiring its processing no longer exist, despite having been processed in accordance with the Law and other relevant laws, and to request that this action be notified to third parties to whom your personal data has been transferred,
7. To object to the occurrence of a result against you arising from the analysis of processed data exclusively through automated systems,
8. To request compensation for damages if you suffer damage due to the unlawful processing of your personal data.

You may submit your applications regarding the rights listed above to TPComply. Depending on the nature of your request, your applications will be concluded free of charge as soon as possible and no later than thirty days; however, if the transaction requires an additional cost, a fee may be requested from you according to the tariff determined by the Personal Data Protection Board. MEASURES TAKEN TO ENSURE THE SECURITY OF DATA SUBJECTS’ PERSONAL DATA In line with the importance our Company places on the protection of personal data and ensuring data security, and in accordance with Article 12 of the Law, our Company takes all necessary technical and administrative measures to ensure an appropriate level of security for the following purposes:

1. Preventing the unlawful processing of personal data,
2. Preventing unlawful access to personal data,
3. Ensuring the preservation of personal data.

When sharing information with us, we kindly ask you not to share any Personal Data classified as “Special Categories of Personal Data” under Law No. 6698 on the Protection of Personal Data.