Information Text On The Law On Protection Of Personal Data

We, as UPT Odeme Hizmetleri A.S. (the "Company"), acting as the data controller, hereby would like to inform you as per the Law Nr. 6698 on Protection of Personal Data, which has been promulgated on the Official Journal, dated April 7, 2016 and bearing the issue number 29677 (the "Law").

Purposes of processing personal data, and the legal grounds thereof: Our Company processes your personal data, and transmit such data to the authorized institutions, for the purpose of recording the identity and such other details as required for identification of the respective person, executing the transaction, and issuing any and all records and documentation that will serve as the basis for the respective transactions, either by electronic means or in hard copy, and retaining such records and documentation during the course of time prescribed under the statutory applicable regulations and by the other concerned authorities, and complying with the related domestic and international regulations, and fulfilling any and all obligations with respect to data and documentation storage, reporting, information exchange and provision of information as prescribed by the Banking Regulation and Supervision Agency (BRSA), the CBRT (the Central Bank of the Republic of Türkiye), MASAK (Financial Crimes Investigation Board), and such other competent authorities; performance of the initiatives for planning, statistics, customer satisfaction and enhancement of the service quality, and antifraud activities, ensuring security, and accomplishment of the researches on information and the assessments with respect to the products and services of our Company as requested by you; management of all our legal processes/procedures; and also fulfillment of any and all obligations of our Company against you with respect to any and all transactions you have performed with our Company. In addition to the above-given purposes; your personal data may also be processed for performance of the promotional, marketing and campaign activities to the extent that you have granted your consent for establishment of communication with you.

Persons/entities to whom/which the personal data may be transmitted for the purposes listed herein above:
- The persons or organizations, to whom/which information exchange is required by the provisions prescribed under the Law on Payment and Security Settlement Systems, Payment Services and Electronic Monetary Organizations, and the other related applicable regulations;
- The public legal entities such as the Banking Regulation and Supervision Agency (BRSA), the CBRT (the Central Bank of the Republic of Türkiye), MASAK (Financial Crimes Investigation Board), as well as the governmental agencies;
- Our principal shareholder, direct and indirect subsidiaries, and the subsidiaries and affiliates of our principal shareholder;
- The scheme partner entities, from which we procure services or with which we collaborate for the purpose of performance of our operations where so permitted under the applicable statutory regulations, and the domestic / international banks, and the entities which provide intermediation for domestic / international money transfer, and the support service entities, and also the independent audit companies.

Cases Not Requiring Your Consent; As per Section 5 of the Law; our Company is entitled to process any personal data without obtaining the explicit consent if and when it is necessary to process any personal data of the parties to the agreement to the extent that it is expressly prescribed under the laws, and also that it is directly associated with execution or performance of the agreement, and if and when it is necessary for our Company to fulfill its statutory obligation in the capacity of data controller, and any such data is already made public by the concerned person, and processing of any data is necessary to establish, exercise or protect any right, and processing of any data is required for the legitimate interests of our Company, as the data controller, to the extent that the fundamental rights and freedoms of the concerned person will not be impaired.

Method for collecting personal data; Your personal data may be collected either verbally or in writing or electronically, by means of such channels as the branches, the organizations / entities that are authorized to represent our Company, situated either at home or abroad, of UPT Odeme Hizmetleri A.S. or its direct/indirect subsidiaries and shareholders, as well as the Head Office, kiosks, website, digital applications and the institutions / organizations, from which our Company procures service and the call center.

Your rights: As per Section 11 of the Law; you are entitled to apply to our Company, and (a) to inquire whether your personal data have been processed, or not; and (b) to ask for information regarding any such processed personal data, and (c) to be informed about the purpose of processing of any such data, and also about the fact that whether such data have been used as appropriate to the purpose thereto, and (ç) to be informed about the 3rd parties to which any such data has been transmitted either domestically or internationally, and (d) to ask for correction of any imperfect or inaccurate data, in case of any imperfect or inaccurate processing thereof, and (e) to ask for deletion or disposal of any such personal data in accordance with the terms and conditions prescribed under Section 7 of the Law, and (f) to ask for being informed about the transactions, which have been performed as per the sub-paragraphs (d) and (e) herein above, with respect to the persons to which any such personal data has been transmitted, and (g) to raise an objection against such outcome in case of emergence of an outcome that is to the detriment of you upon the analysis of any such processed personal data solely by any automatic systems, and (ğ) to claim for compensation of any and all damage and/or loss you might have incurred in case any such personal data has been processed in breach of the Law. Any and all costs and expenses that might be incurred by our Company for the purpose of ensuring that your requests are satisfied, may be claimed by you as based on the tariff as specified under Section 13 "Application to the Data Controller" of the Law.