TRES TEKNOLOJİ A.Ş. PERSONAL DATA PROCESSING DISCLOSURE STATEMENT

Doc. No: TRS.KVKK.04 Pub. Date: 01.09.2023 Rev. No: -

TRES TEKNOLOJİ A.Ş. PERSONAL DATA PROCESSING DISCLOSURE STATEMENT

This disclosure statement has been prepared by Tres Teknoloji A.Ş., in its capacity as data controller, in order to inform you regarding the processing of your personal data, pursuant to Article 10 of Law No. 6698 (KVKK / Personal Data Protection Law) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Disclosure Obligation.

1. IDENTITY OF THE DATA CONTROLLER

This disclosure statement has been prepared, in its capacity as data controller, by Tres Teknoloji A.Ş. ('the Company' or 'Tres'), located at Atatürk Mh. Ertuğrul Gazi Sk. No: 2E/331 Ataşehir / İSTANBUL, registered with the Kozyatağı Tax Office under tax number 8591277092 and Mersis number 0859127709200001. Our Company is registered with the Data Controllers Registry Information System (VERBİS). Contact: info@tresteknoloji.com · 0850 305 88 66.

2. CATEGORIES OF DATA SUBJECTS WHOSE PERSONAL DATA IS PROCESSED

This statement covers the processing of personal data belonging to the following groups:

—Individual customers —Corporate customers (sole proprietorships and capital companies) —Employees and authorized representatives of corporate customers —Website visitors and customer panel users

3. PERSONAL DATA PROCESSED

The following categories of personal data are processed in connection with the provision of our services:

—Identity data: full name, Turkish ID number (T.C. kimlik numarası), company title, tax number (VKN), tax office —Contact data: telephone number, e-mail address, address —Customer transaction and financial data: order, invoice and payment information —Transaction security data: IP address, access and session records, log records —Location data: country/region information

4. PURPOSES OF PROCESSING PERSONAL DATA

Your personal data is processed for the following purposes:

—Establishing and carrying out contractual processes —Carrying out goods/service sales and invoicing processes —Carrying out communication and request/complaint management activities —Marketing of products and services (only within the scope of your explicit consent) —Carrying out and auditing business activities and ensuring information security —Fulfilling legal obligations (including log retention under Law No. 5651)

5. LEGAL GROUNDS FOR PROCESSING

Your personal data is processed on the legal grounds set out in Article 5 of the Law, namely that processing is necessary for the establishment or performance of a contract, for the fulfillment of a legal obligation, for the establishment and protection of a right, and for the legitimate interests of the data controller. In cases requiring explicit consent (e.g. commercial electronic messages, marketing), your data is processed only with your explicit consent.

6. TRANSFER OF PERSONAL DATA

Your personal data may be transferred, limited to the purposes stated above, to authorized public institutions and organizations in the cases prescribed by legislation, to our suppliers who carry out our business processes, and to our legal advisors. During identity verification processes, information may be shared with the relevant official institutions and electronic verification providers in order to confirm application details. Where requested, your data may be shared with authorized official authorities under Law No. 5651 and Law No. 6563. Our service infrastructure is located within the borders of Türkiye.

7. METHOD OF DATA COLLECTION

Your personal data is collected in electronic form, by automated and partially automated means, through the forms you fill out on the website and customer panel, through communication established via e-mail and telephone, and through the system records generated during your use of the services.

8. YOUR RIGHTS UNDER ARTICLE 11 OF THE LAW

Pursuant to Article 11 of the Law, by applying to the data controller you have the following rights:

—To learn whether your personal data is being processed —To request information if it has been processed —To learn the purpose of processing and whether it is used in accordance with its purpose —To know the third parties to whom it is transferred domestically or abroad —To request its correction if it has been processed incompletely or inaccurately —To request its erasure or destruction within the framework of the conditions set out in Article 7 of the Law —To request that correction, erasure and destruction operations be notified to the third parties to whom the data has been transferred —To object to a result arising against you as a consequence of analysis carried out solely by automated systems —To request compensation for the damage in the event that you suffer damage due to unlawful processing

9. APPLICATION METHODS

You may submit your requests regarding the above rights by e-mail to hukuk@tresteknoloji.com or in writing to Atatürk Mh. Ertuğrul Gazi Sk. No: 2E/331 Ataşehir / İSTANBUL. Your requests will be concluded free of charge as soon as possible and within 30 days at the latest, depending on their nature; if the operation additionally requires a cost, a fee in the tariff determined by the Board may be charged.

TRS.KVKK.04 · Rev. - Tres Teknoloji A.Ş. — This is a controlled copy.

This English text is an unofficial translation provided for information purposes only. In case of any discrepancy, the Turkish (Türkçe) version prevails and is the sole legally binding text.

KVKK Disclosure Statement