Data Controller: İTO BİLGİYİ TİCARİLEŞTİRME VE ARAŞTIRMA VAKFI (hereinafter referred to as “BTM”).

Address: Fulya Mahallesi Yeşilçimen Sokak Polat Tower Independent Unit 430, 34394 Şişli/Istanbul

The purpose of the Website (“Website”) we have made available is to inform the public about BTM activities. Within this scope, BTM may need to collect, process, or transfer personal data of natural person representatives of BTM’s Technology Suppliers and/or Technology Users. Additionally, BTM may collect, process, or transfer personal data of all Website visitors for the purposes and scope specified in this Disclosure Text.

At BTM, we prioritize the confidentiality of your personal data and would like to inform you about the processing and transfer of personal data in accordance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”).

1. Purposes and Legal Grounds of Processing Personal Data

BTM processes and transfers your personal data for the following purposes:

• Providing necessary information related to BTM activities and/or informing about other events within BTM, including sending commercial electronic messages,

• Determining and implementing BTM’s commercial and business strategies,

• Event management, monitoring legal processes, and establishing, exercising, and protecting rights arising from legislation,

• Planning and executing corporate communication activities and management of all kinds of requests and complaints,

• Planning, auditing, and executing information security processes,

• Executing work and managing relations with our business partners, subcontractors, and other auxiliaries,

• Determining how you became aware of the Website, improving your visit experience, and enhancing the Website’s usability and functionality,

• Recognizing you during your visit to the Website and providing content tailored to your expectations and interests along with personalized browsing capabilities.

According to KVKK, your personal data may be processed based on your explicit consent or other lawful reasons regulated under KVKK. In this context, your personal data will be processed without requiring explicit consent pursuant to Article 5/2(c) of KVKK, provided it is directly related to BTM’s performance, or under Article 5/2(f) to protect BTM’s legitimate interests without harming your fundamental rights and freedoms. Additionally, personal data made public by you may be processed without further consent pursuant to Article 5/2(d) of KVKK within the relevant purpose and to the extent permitted.

Your personal data will be processed lawfully, ethically, accurately, and up-to-date, limited to specific, explicit, and legitimate purposes, and retained only as long as necessary without harming your rights.

2. Parties to Whom and Purposes for Which Personal Data May Be Transferred

BTM may transfer collected personal data, in compliance with KVKK’s basic principles and under the conditions stipulated in Articles 8 and 9 of KVKK, to the following domestic or international parties for the purposes stated herein:

• Our business partners, consultants, subcontractors, and other auxiliaries providing technical, administrative, and other support,

• Regulatory and supervisory official authorities.

If BTM procures data storage, hosting, cloud computing services from abroad, and data transfers to insecure countries become necessary and mandatory, such transfers may occur in compliance with all legal regulations and with necessary permissions and commitments.

3. Methods of Collecting Personal Data

Pursuant to KVKK, your personal data is collected and processed automatically or non-automatically, in written or electronic form, including but not limited to:

• Via the Website and other internet sites managed by BTM, mobile and other applications, and all other online platforms owned by BTM or through cookies that communicate with your devices on the Website.

4. Rights of the Data Subject under KVKK

Under KVKK, data subjects have the following rights regarding their personal data:

• To learn whether personal data is processed,

• To request information if personal data has been processed,

• To learn the purpose of processing personal data and whether it is used accordingly,

• To know the third parties to whom personal data has been transferred domestically or abroad,

• To request correction of incomplete or inaccurate personal data and notification of the relevant third parties,

• To request deletion or destruction of personal data when the reasons requiring processing no longer exist, and notification of relevant third parties,

• To object to the occurrence of a result detrimental to the person by analysis of processed data solely through automated systems,

• To demand compensation for damages due to unlawful processing of personal data.

5. Procedures to Exercise Rights and Submit Requests Regarding Personal Data

According to Article 13(1) of KVKK, you may submit your requests to exercise your rights in writing or via other methods prescribed by the Personal Data Protection Board (registered electronic mail, secure electronic signature, mobile signature, or using the email address previously registered in BTM’s system) to the address “Fulya Mahallesi Yeşilçimen Sokak Polat Tower Independent Unit 430, 34394 Şişli/Istanbul” or to the email [email protected].

You should send documents identifying your identity and contact details along with your explanations regarding the rights you wish to exercise. These documents may be delivered in person to the above address or sent via a notary. Your request will be evaluated after identity verification.

Notarized power of attorney submissions and applications made via notary do not require further identity verification.

Your request will be processed free of charge as soon as possible and at the latest within 30 days after receiving the documents. If any costs arise due to fulfilling your request, only the fees determined by the Personal Data Protection Board may be charged.