Disclosure Notice on the Processing of Personal Data

This Disclosure Notice has been prepared by Megapol Emlak Yatırım A.Ş (the “Company”) for the purpose of informing the Company’s customers about the processing of their personal data by the Company within the scope of the Law on the Protection of Personal Data No. 6698 (the “Law”).

For detailed information regarding the processing of your personal data within the scope of this Disclosure Notice, you can refer to the Personal Data Protection and Processing Policy of Megapol Emlak Yatırım A.Ş available at www.megapolgroup.com.

a) Methods of Collecting Personal Data and Legal Grounds

Your personal data is collected in electronic or physical environments. Your personal data collected on the legal grounds stated in this Disclosure Notice may be processed and shared within the framework of the personal data processing conditions specified in Articles 5 and 6 of the Law.

b) Purposes of Processing Personal Data

Within the framework of the personal data processing conditions set out in Articles 5 and 6 of the Law, your personal data is processed for the following purposes: planning and carrying out the activities required to customize, recommend and promote the products and services offered by the Company according to the preferences, usage habits and needs of the relevant persons; performing the necessary work by the business units and executing the related business processes to enable the relevant persons to benefit from the products and services offered by the Company; carrying out the necessary work by the relevant business units and executing the related business processes to perform the commercial activities conducted by the Company; planning and executing the Company’s commercial and/or business strategies; and ensuring the legal, technical and commercial-business security of the Company and of the relevant persons who are in a business relationship with the Company.

c) Parties to Whom Personal Data May Be Transferred and Purposes of Transfer

Within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law, your personal data may be shared with the Company’s business partners and suppliers, with legally authorized public institutions and organizations, and with legally authorized private law legal entities, for the following purposes: planning and carrying out the activities required to customize, recommend and promote the products and services offered by the Company according to the preferences, usage habits and needs of the relevant persons; performing the necessary work by the business units and executing the related business processes to enable the relevant persons to benefit from the products and services offered by the Company; carrying out the necessary work by the relevant business units and executing the related business processes to perform the commercial activities conducted by the Company; planning and executing the Company’s commercial and/or business strategies; and ensuring the legal, technical and commercial-business security of the Company and of the relevant persons who are in a business relationship with the Company.

d) Rights of Data Subjects and Exercise of These Rights

As data subjects, if you submit your requests regarding the rights stated below to the Company using the methods specified under the heading “Exercise of Rights by Data Subjects”, your requests will be evaluated and concluded by our Company as soon as possible and, in any case, within 30 (thirty) days.

Pursuant to Article 11 of the Law, as a data subject you have the following rights:

• To learn whether your personal data is being processed,
• To request information if your personal data has been processed,
• To learn the purpose of processing your personal data and whether it is used in accordance with its purpose,
• To know the third parties to whom your personal data is transferred, whether at home or abroad,
• To request the correction of your personal data in case it is incomplete or incorrectly processed, and to request that the action taken in this regard be notified to the third parties to whom the personal data has been transferred,
• To request the deletion or destruction of your personal data in the event that the reasons requiring its processing cease to exist, even though it has been processed in accordance with the Law and other relevant legal provisions, and to request that the action taken in this regard be notified to the third parties to whom the personal data has been transferred,
• To object to the occurrence of a result against you by analyzing the processed data exclusively through automated systems,
• To request compensation for damages in the event that you suffer damage due to the unlawful processing of your personal data.

Paragraph 2 of Article 28 of the Law lists the cases in which data subjects do not have the right to make a request; in this scope:

• Where the processing of personal data is necessary for the prevention of crime or for criminal investigation,
• The processing of personal data that has been made public by the data subject themselves,
• Where the processing of personal data is necessary for the performance of supervisory or regulatory duties and disciplinary investigations or prosecutions by authorized and competent public institutions and organizations and by professional organizations of a public nature, based on the authority granted by law,
• Where the processing of personal data is necessary for the protection of the State’s economic and financial interests with respect to budgetary, tax and financial matters,

the rights set out above cannot be exercised with respect to such data.

Pursuant to paragraph 1 of Article 28 of the Law, in the following cases the data will fall outside the scope of the Law, and therefore the requests of data subjects will not be processed with respect to such data either:

• The processing of personal data by natural persons within the scope of activities entirely related to themselves or to family members living in the same household, provided that it is not disclosed to third parties and that obligations regarding data security are observed.
• The processing of personal data for purposes such as research, planning and statistics, by anonymizing it in line with official statistics.
• The processing of personal data for purposes of art, history, literature or science, or within the scope of freedom of expression, provided that it does not violate national defense, national security, public safety, public order, economic security, the privacy of private life or personal rights, and does not constitute a crime.
• The processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations authorized and assigned by law to ensure national defense, national security, public safety, public order or economic security.
• The processing of personal data by judicial authorities or enforcement authorities in relation to investigation, prosecution, trial or enforcement proceedings.

Exercise of Rights by Data Subjects

To exercise the rights mentioned above, data subjects may use the “Application Form to be Submitted to the Data Controller by the Personal Data Subject” available at www.megapolgroup.com.

Applications, together with documents identifying the relevant data subject, will be made through one of the following methods:

• By completing the form and submitting a wet-signed copy in person, through a notary public, or by registered return mail to the address “Halkapınar Mahallesi, Pakistan Bulvarı No: 19/12 Floor: 35 Suite: 3501 Konak / İzmir - Turkey”,
• By signing the form with a secure electronic signature issued under the Electronic Signature Law No. 5070 and sending it via registered electronic mail (KEP) to megapolemlak@hs01.kep.tr,
• By following a method prescribed by the Personal Data Protection Board.

Within the limits set out in the Law, the Company responds to data subjects who wish to exercise the aforementioned rights within a maximum of thirty (30) days, as stipulated in the Law. In order for third parties to make an application request on behalf of personal data subjects, there must be a special power of attorney issued by the data subject through a notary in the name of the person who will make the application.

Data subject applications are processed free of charge as a rule; however, a fee may be charged according to the fee schedule prescribed by the Personal Data Protection Board. The Company may request information from the relevant person in order to determine whether the applicant is the personal data subject, and may pose questions to the personal data subject regarding their application in order to clarify the matters stated in the application.