[Mono Kristal Arge Dan.Bil.San.Tic.Ltd. Şti. / Bulut İşkence] Personal Data Policy

General Information on the Personal Data Protection Law
The Personal Data Protection Law No. 6698 (hereinafter referred to as KVKK) was adopted on March 24, 2016, and published in the Official Gazette No. 29677 on April 7, 2016. Some parts of KVKK came into force on the publication date, while other parts became effective on October 7, 2016.

Notification as the Data Controller
As the Data Controller in accordance with KVKK No. 6698, your personal data will be recorded, stored, updated, disclosed/transferred to third parties where permitted by legislation, classified, and processed in the ways outlined in this document.

How Your Personal Data Can Be Processed
Under KVKK No. 6698, the personal data you share with our company may be processed in whole or in part, automatically or through non-automated means, provided that it forms part of a data recording system. All operations performed on the data under KVKK are considered "processing of personal data."

Purposes and Legal Grounds for Processing Your Personal Data
The personal data you share may be processed for the following purposes:

1. To fulfill the requirements of the services we provide to our customers in accordance with agreements and technological needs, and to improve the products and services we offer;
2. To record identity, address, and other necessary information of the transaction owner in compliance with:
   • The Law on the Regulation of Electronic Commerce No. 6563,
   • The Consumer Protection Law No. 6502,
   • The Regulation on Service Providers and Intermediary Service Providers in Electronic Commerce (published on August 26, 2015, Official Gazette No. 29457),
   • The Regulation on Distance Contracts (published on November 27, 2014, Official Gazette No. 29188),
   • Other relevant legislation;
3. To prepare records and documents necessary for electronic and paper-based transactions in banking and electronic payment systems, and to comply with retention, reporting, and information disclosure obligations stipulated by law or authorities;
4. To provide information to public prosecutors, courts, and relevant public officials upon request and as required by law, particularly in matters of public safety and legal disputes.

Third Parties to Whom Your Personal Data May Be Transferred
Your personal data may be shared with the following individuals or organizations for the purposes outlined above:

• Our company’s service providers, such as IdeaSoft Software Co.,
• Suppliers, cargo companies, and other relevant third parties involved in the services we offer,
• Partner institutions and organizations collaborating with our company,
• Domestic and international entities authorized to process personal data under KVKK.

Methods of Collecting Your Personal Data
Your personal data may be collected through:

• Forms on our company’s website and mobile applications, including details such as name, surname, national ID number, address, phone, business or personal email address, as well as preferences and actions recorded using username and password;
• Verbal, written, or electronic communication through our sales and marketing employees, branches, suppliers, or other sales channels;
• Business cards, resumes (CVs), offers, or similar methods shared during a business relationship with our company;
• Indirectly through third-party channels, such as websites, blogs, competitions, surveys, campaigns, newsletters, and publicly available databases.

Transfer of Personal Data Abroad
Your personal data collected using the methods listed above may be transferred abroad for processing or storage purposes in countries accredited by the Personal Data Board, provided that sufficient protection measures are in place.

Retention and Protection of Personal Data
Your personal data will be stored confidentially in our company’s databases and systems in accordance with KVKK Article 12. It will not be shared with third parties unless required by law or stipulated in this policy.

Rights of the Personal Data Owner Under KVKK
As of October 7, 2016, Article 11 of KVKK grants data owners the following rights:

1. To inquire whether their personal data is processed;
2. To request information if their personal data has been processed;
3. To learn the purpose of data processing and whether it is used appropriately;
4. To know the third parties to whom personal data has been transferred domestically or abroad;
5. To request the correction of incomplete or incorrect personal data;
6. To request the deletion or destruction of personal data under the conditions specified in Article 7 of KVKK;
7. To request notification of correction, deletion, or destruction to third parties to whom personal data has been transferred;
8. To object to the emergence of any adverse outcome due to the analysis of personal data exclusively by automated systems;
9. To demand compensation for damages incurred due to unlawful processing of personal data.

For detailed queries or complaints, personal data owners can contact our company at the following channels:

• Email: info@bulutiskence.com.tr
• Phone: +90 532 154 08 90