As GRİSPİ BİLİŞİM TEKNOLOJLARI A.Ş., the protection of the personal data of our users is our priority.

In this context, we would like to enlighten you in the capacity of data controller within the scope of 6698 p. Personal Data Protection Law (KVKK).

Your personal data that we have recorded may be processed, transferred to domestic and foreign third parties, stored, used for profiling and classified in accordance with the purpose of processing and transfer, method of collection, legal reason, collection activity in accordance with the KVKK, in connection with our service purposes and legal obligations. Again, with this clarification text, it is aimed to inform you about your rights under the KVKK.

Some of your personal information (name-surname, telephone, e-mail, date of birth, marital status, etc.) may be requested from you in order to use GRİSPİ BİLİŞİM TEKNOLOJLARI A.Ş. services. The data collected with your relevant personal data will be kept within GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. member companies can access this information and can reach you via e-mail, telephone, SMS in accordance with the purpose of operation.

1- OUR PURPOSES FOR PROCESSING PERSONAL DATA:

Your personal data collected by GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. for the following purposes within the personal data processing conditions and purposes specified in Articles 5 and 6 of the Law and in particular within the scope of the personal data processing conditions and purposes specified in Article 5, paragraph 1. “Explicit consent” pursuant to paragraph 1 of Article 5, “Explicitly stipulated by law” pursuant to subparagraph a of paragraph 2, “It is mandatory for the protection of the life or physical integrity of the person who is unable to disclose his consent due to actual impossibility or whose consent is not legally valid” pursuant to subparagraph b, “It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract” pursuant to subparagraph c, “It is mandatory for the data controller to fulfill its legal obligation” pursuant to subparagraph ç, “It has been made public by the data subject himself/herself” pursuant to subparagraph d, “Data processing is mandatory for the establishment, exercise or protection of a right” pursuant to subparagraph e, “Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject” pursuant to subparagraph f, and “Explicit consent” specified in paragraph 2 and “Processing of sensitive personal data, except for health and sexual life, without explicit consent in cases stipulated by law” specified in paragraph 3 of Article 6. “Explicit consent” stated in the 2nd paragraph of Article 6 and “Special categories of personal data, except for health and sexual life, can be processed without obtaining explicit consent in cases stipulated by law” stated in the 3rd paragraph.

For the planning and execution of the activities necessary for the recommendation and promotion of the products and services we offer as GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. to the relevant persons by customizing them according to the taste, usage habits and needs of the relevant persons; For the planning and / or execution of member / user satisfaction activities, For the planning and / or execution of market research activities for the sales and marketing of products and services, For the planning and / or execution of the marketing processes of products and / or services, For the planning and / or execution of the relevant processes to obtain the highest benefit from the products or services offered by GRİSPİ BİLİŞİM TEKNOLOJİLERİ A. Ş. for the planning and/or execution of the relevant processes in order to obtain the highest benefit from the products or services offered;

Planning and / or execution of sales processes of products and / or services, planning and / or execution of after-sales support services activities, planning and / or execution of member / user relationship management processes, follow-up and finalization of member / user requests and / or complaints, follow-up of contract processes and / or legal requests within the scope of carrying out the necessary work by our business units to benefit the relevant persons from the products and services offered by GRİSPİ BİLİŞİM TEKNOLOJLARI A.Ş. and carrying out the relevant business processes;

In order to ensure the legal, technical and commercial business security of GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. and related persons who have a business relationship with it; Planning and / or execution of GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. and audit activities, Planning and fulfillment of the necessary operational activities to ensure that GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. activities are carried out in accordance with the requirements of the business and / or the relevant legislation, Ensuring the security of GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. and its operations, Ensuring that the data is accurate and up-to-date, Providing information to authorized institutions arising from the legislation. Ensuring the security of GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. and its operations, ensuring that the data is accurate and up-to-date, providing information to authorized institutions arising from the legislation, carrying out the necessary work by our relevant business units for the realization of the commercial activities carried out by GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. and carrying out the related business processes;

Planning, auditing and execution of information security processes, creation, management and control of information technologies infrastructure, follow-up of financial and/or accounting affairs, follow-up of insurance affairs, follow-up of legal affairs, follow-up of tax affairs, planning and/or fulfillment of activities for the effectiveness / efficiency and / or relevance analysis of business activities, planning and fulfillment of business activities, planning and fulfillment of corporate communication activities, planning and fulfillment of logistics and warehousing activities, planning and fulfillment of production, supply and / or operation processes

GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. is processed within the scope of planning and execution of commercial and/or business strategies, providing services, performing activities, campaigning and advertising activities and performance evaluation activities of business partners, employees and/or services provided.

However, your personal information is processed for the performance of obligations arising from the legal relationship established between us, marketing, advertising, periodical campaign activities, designing special promotional activities for customer profiles and customer “classification” studies to prevent the transmission of unsolicited e-mails, customer profile and behavior classifications, evaluation and analysis activities of customer satisfaction complaints, targeting, strategy and efficiency studies, social media, search engines, etc. Conducting marketing activities in different channels, providing general and special offers, products and services to customers and making use of the services of the call center in this context, measuring and evaluating the quality of telephone calls made with the customer and performing our legal and contractual obligations and for the purposes described in this text.

2- PERSONS TO WHOM PERSONAL DATA CAN BE TRANSFERRED AND PURPOSE OF TRANSFER:

For the purposes of reaching GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. customers more easily, carrying out advertising, promotion and promotional activities, GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. business partners e-mail transmission companies; GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. customer panels, Social media companies, (For example, facebook.com, twitter.com, youtube.com, instagram.com and similar); Internet search engine companies (for example google.com, yandex. com and the like); SMS sending companies and third parties from whom we receive support in areas such as storage, archiving, information technology support (server, hosting, program, cloud computing), information security, GRİSPİ BİLİŞİM TEKNOLOJLARI A.Ş. It can be shared with companies that process data on behalf of GRİSPİ BİLİŞİM TEKNOLOJLARI A.Ş., provide customer satisfaction measurement, profiling support, provide support in the field of sales and marketing in matters where personal data should be processed, and audit companies.

The personal data collected by GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. may be shared with our affiliates, shareholders, business partners, legally authorized public institutions and private persons and other persons within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the KVKK for the purposes of carrying out the necessary work by our relevant business units for the realization of the commercial activities detailed above and carrying out the related business processes, ensuring the legal, technical and commercial business security and rights of the relevant persons in business relations.

GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. does not use and sell the information it collects for commercial purposes for any reason other than legal obligations and obligations, without the knowledge or contrary instruction of the member in question.

Your information may be disclosed to the official authorities without your knowledge only if such information is requested by the official authorities in accordance with the procedure and in cases where it is obliged to make a statement to the official authorities in accordance with the provisions of the mandatory legislation in force.

3- METHOD OF COLLECTING PERSONAL DATA

As mentioned above, your personal data is processed during the login and filling of the forms required for you to benefit from GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. service.

4- PERSONAL DATA STORAGE PERIOD:

GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. will retain the personal data it obtains for the period required for the purpose for which they are processed in this KVKK Clarification Text and GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. MEMBERSHIP AGREEMENT in order to fulfill the obligations arising from the legal legislation, optimization of the service offered to its members / users. According to Article 7 paragraph 1 of Law No. 6698, personal data within the scope of this text will be deleted, destroyed or anonymized within the scope of the relevant legislation when the purpose requiring processing is eliminated and / or the statute of limitations required for the processing of data in accordance with the legislation expires.

5- RIGHTS OF PERSONAL DATA SUBJECTS:

Pursuant to the LPPD and the relevant legislation, the relevant persons may apply to GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. to learn whether their personal data are processed or not;

To learn whether personal data is processed or not,

Request information if their personal data has been processed,

To learn the purpose of processing personal data and whether they are used for their intended purpose,

To know the third parties to whom personal data is transferred domestically or abroad,

To request correction of personal data in case of incomplete or incorrect processing and to request notification of the transaction made within this scope to third parties to whom personal data is transferred,

To request the deletion or destruction of personal data within the framework of the framework of the conditions stipulated in the relevant legislation,

To request notification of the correction, deletion and destruction made in accordance with the relevant legislation to third parties to whom personal data are transferred,

To object to the emergence of a result to the detriment of the person himself/herself by analyzing the processed data exclusively through automated systems,

In the event that personal data is damaged due to unlawful processing of personal data, it has the right to demand the compensation of the damage.

The procedures and methods for the exercise of the relevant rights should be carried out according to the conditions and methods specified in the communiqué published by the Personal Data Protection Authority.

GRİSPİ BİLİŞİM TEKNOLOJİLERİ A.Ş. may make its reasoned positive/negative response in writing or digitally as soon as possible and within 30 days at the latest in accordance with the above-mentioned requests. If the transactions subject to the request require a cost, it is possible to request fees and expenses over the tariff determined by the Personal Data Protection Board according to Article 13 of the Personal Data Protection Law No. 6698.

For Your Requests

Data Controller: GRİSPİ BİLİŞİM TEKNOLOJİLERI A.Ş.

Address : Kazımdirik mah. 375 sk. No:18 Interior Door No: 14 Piramit Business Center Bornova – Izmir

E-mail: [email protected]

Phone: 0232 215 01 06

LAW ON THE PROTECTION OF PERSONAL DATA EXPLICIT CONSENT TEXT

In cases where you give your explicit consent while logging in/registering to benefit from the service provided by GRİSPİ BİLİŞİM TEKNOLOJLARI A.Ş. or while using our services, you acknowledge and declare that you have read and understood the “Privacy Policy and Clarification Text” above and that you have given your explicit consent to the collection of your personal data by GRİSPİ BİLİŞİM TEKNOLOJLARI A.Ş. within the scope of KVKK by the methods specified above, to be processed within the purposes specified above and to be transferred to third (real/legal) persons within and outside the country specified above.