Protection of Personal Data

İHLAS YAYIN HOLDİNG ANONİM ŞİRKETİ

CLARIFICATION TEXT FOR PROCESSING THE PERSONAL DATA

Data Controller:     İhlas Yayın Holding A.Ş.

Merkez Mahallesi, 29 Ekim Caddesi,

İhlas Plaza No:11 B/31, 34197,

Yenibosna, Bahçelievler, İstanbul

As İhlas Yayın Holding A.Ş. (“the Company”) and İhlas Publishing Group Companies, we attach utmost importance to the security of your personal data. With this awareness, as the Company, we attach great importance to the processing and storage of the personal data of individuals associated with our Company, including our customers, consumers and employees who benefit from our products and services, in accordance with the Constitution of the Republic of Turkey and international agreements to which our country is a party regarding human rights, and especially the Law No. 6698 on the Protection of Personal Data (“KVKK”) and other relevant legislation.

In this context, as the “Data Controller” as defined in the Law on Personal Data Protection, we would like to inform you.

With full awareness of this responsibility, we process your personal data in the manner explained below and within the limits mandated by the legislation.

Your personal data that you share with our company as a consumer, subscriber, customer, supplier, or employee may be processed, transferred to third parties domestically and internationally, stored, used for profiling, and classified in accordance with the KVKK (Turkish Law on Personal Data Protection ), in a manner that is relevant and proportionate to our business and service purposes.

1. Purposes of Collection, Processing, and Processing Personal Data

Your personal data may be collected by our Company through automated or non-automated methods, verbally, in writing, or electronically, by our Company units, İhlas Group Companies, our website, social media platforms, mobile applications, and similar means, depending on the services provided by our Company and our Company’s commercial activities. Your personal data may be processed by being created and updated as long as you benefit from the products and services offered by our Company and İhlas Group Companies.

In addition, your personal data may be processed when you use our call centers or our website to use the services of our Company or İhlas Group Companies, when you visit our Company or our website, or when you participate in training, seminars, or organizations organized by our Company.

Your personal data collected is used for the following purposes:

• To enable you to benefit from the products and services offered by our company and İhlas Group Companies, to understand your preferences, usage habits and needs, to respond to your requests more quickly, to improve our communication with you and to provide you with better service and more personalized products, services and offers, to conduct analysis to do this, to inform you about our products and services, to measure your satisfaction with our products and services, to develop and diversify our products and services in line with your requests and needs,
• To ensure the legal and commercial security of our company, İhlas Group Companies and individuals with whom our company has a business relationship (administrative operations related to communication carried out by our company, ensuring the physical security and control of company locations, İhlas Group Company customer evaluation/complaint management processes, reputation research processes, event management, legal compliance process, auditing, financial affairs, etc.),
• To determine and implement our company’s commercial and business strategies,
• To ensure the implementation of our company’s human resources policies; Our employees’ data is used to meet the requirements of the Labor Law and other applicable legislation on labor and social security, as well as to improve performance levels and employee satisfaction, and to ensure occupational safety and industrial peace.

For the abovementioned purposes, those determined clearly in Article 5 and 6 of the Law on Personal Data Protection;

ARTICLE 5 – Conditions for processing personal data

(1) Personal data cannot be processed without the explicit consent of the data subject.

(2) In the presence of one of the following conditions, it is possible to process personal data without the explicit consent of the data subject:

1. When explicitly provided for in the laws.
2. When it is necessary for the protection of the life or physical integrity of the person who is unable to express their consent due to factual impossibility or whose consent is not legally valid, or for the protection of the life or physical integrity of another person.
3. When the processing of personal data belonging to the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract.
4. When it is necessary for the data controller to fulfill its legal obligations.
5. When the data has been made public by the data subject themselves.
6. When data processing is necessary for the establishment, exercise, or protection of a right.
7. When data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

ARTICLE 6 – Conditions for Processing Sensitive Personal Data

(1) Data relating to a person’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data, are considered sensitive personal data.

(2) Processing sensitive personal data without the explicit consent of the data subject is prohibited.

(3) Personal data other than health and sexual life data listed in the first paragraph may be processed without the explicit consent of the data subject in cases stipulated by law. However, personal data relating to health and sexual life may only be processed without the explicit consent of the data subject by persons or authorized institutions and organizations under an obligation of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing.

(4) In the processing of special categories of personal data, it is also mandatory to take adequate measures determined by the Board.

Personal data will be processed within the scope of the conditions and purposes of personal data processing,

• In accordance with the law and the principle of fairness,
• In a manner that is relevant, limited and proportionate to the processing purposes,
• Accurate and up-to-date,
• For specific, clear and legitimate purposes.

2. To Whom and for What Purpose the Processed Personal Data May Be Transferred

Your collected and processed personal data may be shared within our subsidiaries and affiliates and İhlas Group companies, in accordance with the Personal Data Protection Law and current legislation, for the purposes listed in Article 1 of this document. It may also be transferred domestically or internationally to, but not limited to, our business partners, business contacts, subcontractors, suppliers, company officials, and shareholders, in line with the purpose of the service we provide, or to regulatory and supervisory institutions and official authorities in cases foreseen by relevant legislation, within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Personal Data Protection Law.

3. Method and Legal Basis for Personal Data Collection

Your personal data is collected in any verbal, written, or electronic medium, for the purposes stated above, in order to provide the products and services offered by the Company within the determined legal framework and to ensure that our Company fulfills its contractual and legal responsibilities completely and accurately.

Your personal data is collected by our Company or natural or legal persons processing data on behalf of our Company through various channels, including but not limited to, the website, various contracts, mobile applications, email, application forms, written or verbal communications with our Company, etc., verbally, in writing or electronically.

Your personal data collected for these purposes and legal reasons may also be processed and transferred for the purposes stated in Articles (1) and (2) of this document, within the scope of the personal data processing conditions and purposes specified in articles 5 and 6 of the Personal Data Protection Law.

4. Rights of the Personal Data Subject as Listed in Article 11 of the Personal Data Protection Law

As personal data subjects, if you submit your requests regarding your rights to our Company through the methods set out below in this Disclosure Statement, our Company will process the request free of charge within thirty days at the latest, depending on the nature of the request. However, if a fee is prescribed by the Personal Data Protection Board, the fee will be charged according to the tariff determined by our Company.

Within this scope, personal data owners have the following rights:

• To learn whether their personal data is being processed,
• To request information regarding the processing of their personal data if it has been processed,
• To learn the purpose of the processing of their personal data and whether it is being used in accordance with its purpose,
• To know the third parties to whom their personal data has been transferred, domestically or abroad,
• To request the correction of their personal data if it has been processed incompletely or incorrectly, and to request that this action be notified to the third parties to whom their personal data has been transferred,
• To request the deletion or destruction of their personal data if the reasons requiring its processing have ceased to exist, even if it has been processed in accordance with the Personal Data Protection Law and other relevant laws, and to request that this action be notified to the third parties to whom their personal data has been transferred,
• To object to a result that is detrimental to them arising from the analysis of processed data exclusively through automated systems,
• To demand compensation for damages if they suffer damage due to the unlawful processing of their personal data.

In accordance with Article 13, paragraph 1 of the Personal Data Protection Law, you may submit your request regarding the exercise of your rights mentioned above to our Company in writing or, if a separate method is determined by the Personal Data Protection Board, in accordance with that method.

We would like to remind you that in this application, which you will make to exercise your rights as a personal data owner and which includes your explanations regarding the right you wish to exercise, it is important that the matter you are requesting is clear and understandable, that the matter concerns you personally, or if you are acting on behalf of someone else, that you are specifically authorized to do so and that your authorization is documented, that it includes your identity and address information, and that documents verifying your identity are attached to the application.

Within this framework, the channels, and procedures for submitting your written applications to our Company under Article 11 of the Personal Data Protection Law are explained below.

To exercise your rights mentioned above, you can submit your request, including the necessary information to identify your identity and your explanations regarding the right you wish to exercise as specified in Article 11 of the Personal Data Protection Law, by filling out the (“PERSONAL DATA SUBJECT APPLICATION FORM”) available at www.ihlasyayinholding.com.tr in accordance with the information text at the beginning of the form, and by personally delivering a signed copy of the form along with documents identifying your identity to the address of

İhlas Yayın Holding A.Ş. Merkez Mahallesi, 29 Ekim Caddesi, İhlas Plaza No:11 B/31, 34197, Yenibosna, Bahçelievler, İstanbul

or sending it via notary public or other methods specified in the Personal Data Protection Law, or sending the relevant form to kvk.basvuru@ihlasyayinholding.com.tr.