PERSONAL DATA PROTECTION AND PROCESSING POLICY

(INFORMATION TEXT)

Notification

The Personal Data Protection Law No. 6698 was adopted on March 24, 2016, and entered into force by being published in the Official Gazette on April 7, 2016. However, in accordance with Article 32 of the Law titled 'Entry into Force,' the following provisions of this Law; Articles 8, 9, 11, 13, 14, 15, 16, 17, and 18 became effective as of October 7, 2016.

The Law aims to protect individuals' fundamental rights and freedoms, particularly the privacy of personal life, in the processing of personal data, and to regulate the obligations of real and legal persons processing personal data and the principles and procedures to be followed. With this document, visitors are informed and enlightened by Prome Solutions, and the 'Protection of Personal Data and Personal Data Sharing Permission' is made available for visitors' information and review.

1. Scope of Personal Data Protection and Processing Policy

We have prepared this 'Privacy Policy' ('Policy') to protect the privacy of our visitors and users and to provide a secure experience in obtaining information, and to ensure compliance with internationally accepted privacy protection standards in the use of personal information collected through the products, digital services, and mobile applications within Prome Solutions ('Prome Solutions Websites and Digital Platforms').

We adopt an understanding that is fully compliant with internationally accepted privacy protection standards in order to protect the privacy of our visitors and users, ensure a secure experience in obtaining information, and in the use of personal information.

2. Reasons for Processing Your Data

Your personal data is processed by Prome Solutions for the following purposes: conducting necessary operational activities within the company to ensure the provision of products and services to you, conducting relevant studies with the relevant business unit and business partners to recommend products and services tailored to your consumption and purchasing motivations, providing human resources management by our company to ensure the rights of individuals, making commercial decisions, implementing and executing necessary steps, ensuring the legal security of the individuals and our company arising from the business relationships, and for similar purposes within the scope of Articles 5 and 6 of the Law.

Your Personal Data, as the Data Controller, may also be processed by Prome Solutions without requiring your explicit consent in the following cases:

• When it is explicitly stipulated in the laws;
• In cases where it is mandatory to protect the life or physical integrity of the data subject or someone else, who cannot express their consent due to actual impossibility or whose consent is not legally valid.
• Provided that it is directly related to the performance of the contract, when it is necessary to process personal data belonging to the parties of the contract.
• When it is necessary for the data controller to fulfill legal obligations;
• If the data subject has been made public by himself/herself.
• When data processing is necessary to establish, exercise, or protect a right;
• Subject to not harming the fundamental rights and freedoms of the data subject, data processing is necessary for the legitimate interests of the data controller, based on any of the conditions specified below, it may be used for the purposes listed below

Processing Conditions for Special Categories of Personal Data

The Company does not process Special Categories of Personal Data without the explicit consent of the data subject. However, Personal Data other than health and sexual life can be processed without the explicit consent of the data subject in cases prescribed by laws. Personal Data related to health and sexual life is processed by the Company only for the purposes of protecting public health, preventive medicine, medical diagnosis and treatment, and care services, planning and management of health services and their financing, under the conditions where we are subject to confidentiality obligations, without requiring the explicit consent of the data subject. The Company carries out the necessary procedures regarding taking the measures determined by the Board in the processing of Special Categories of Personal Data.

3. What Type of Data Do We Collect from You?

Through Prome Solutions Websites and Digital Platforms, the following data belonging to you may be collected. These are:

• Behavioral data collected by us and third parties, which do not include your personal data, collected for the purpose of improving our technological infrastructure.

4. For What Purposes Are Your Information Collected on Prome Solutions Websites and Digital Platforms?

We collect user data on Prome Solutions Websites and Digital Platforms generally for the following purposes:

• To provide personalized services to our users and enhance user experience to increase user satisfaction,
• To communicate with our members, users, or visitors, to inform them about our services and campaigns as permitted by them,
• To monitor the technical functionality of Prome Solutions Websites and Digital Platforms and ensure their proper operation,
• To use for advertising purposes to ensure that our visitors, members, and users can continue to benefit from Prome Solutions Websites and Digital Platforms for free,
• To send our publications to you,
• To send newsletters via email or notifications,
• To answer your inquiries and provide effective customer service,
• To inform you about our new services,
• To conduct direct marketing by Prome Solutions Websites and Digital Platforms or persons with whom we collaborate,
• To use for various statistical evaluations, database creation, and market research without disclosing the user's identity,
• To identify system-related issues and promptly address any issues that may arise within Prome Solutions Websites and Digital Platforms,
• To identify IP addresses and users and gather comprehensive demographic information.
• Prome Solutions Websites and Digital Platforms may have adopted other policies or procedures regarding the security, confidentiality, collection, etc., of other data outside of this Policy. Therefore, we recommend reviewing other policies and legal documents as well.

How and When Do We Collect Your Information?

We collect your personal data:

• When you visit Prome Solutions Websites and Digital Platforms
• Cookies,
• When you access our advertisements or marketing announcements,
• When you use Prome Solutions Websites and Digital Platforms,
• When you participate in our campaigns or promotions, contests, surveys, draws, etc."

We collect your personal data through various means:

• Form:

  When you fill out forms on Prome Solutions Websites and Digital Platforms, you provide information such as your name, email address, phone number, address, and message.

• Credit Card Information:

  For the execution of our services, we may request your credit card information, billing address, and billing details. We may share this information with third parties for purposes such as completing transactions, verifying credit card information, or verifying identity.

• User-Generated Content or Publicly Available Content (Comments, polls, etc.):

  When you choose to disclose information or personal data publicly (e.g., by commenting, voting, rating, recommending, sharing photos, expressing your thoughts, etc.), it is considered voluntarily disclosed by you, and we may use it for statistical, advertising, or promotional purposes without your explicit consent. We do not bear any responsibility for the use of your disclosed personal data by third parties or other sites.

• Personal Information Collected in Contests, Sweepstakes, and Surveys:

  If you participate in contests, surveys, or sweepstakes organized by Prome Solutions Websites and Digital Platforms, your personal data may be collected by Prome Solutions or authorized third parties via Prome Solutions Websites and Digital Platforms. If your personal information is collected by third parties, you will be notified accordingly.

• Non-Personal and Automatically Collected Information:

  We may collect data about you to adapt our technologies to the needs of our users, to address technical issues, and to monitor our technical infrastructure. We may gather information about your digital behavior, such as the number of clicks, frequency of tab openings, or your interest in specific topics, based on your usage within the website, through cookies or other programs and software.

• Device Information:

  We may collect data from the electronic devices you use (e.g., computers, laptops, tablets, smartphones, smart TVs, etc.), such as location information, which cannot be directly associated with you.

• Cookies:

  For detailed information about cookies, you can refer to the 'Cookies' page.

The Personal Data Collected Can Be Transferred to Whom and for What Purpose

The personal data collected may be transferred to our business partners, suppliers, shareholders, legally authorized public institutions and private individuals within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Personal Data Protection Law ('KVKK'). This transfer aims to ensure the legal and commercial security of our company and individuals in a business relationship with our company, to conduct necessary studies by our company's departments to benefit from the products and services offered by our company, to customize the products and services offered by our company according to your preferences, usage habits, and needs, to determine and implement our company's commercial and business strategies, and to ensure the implementation of our company's human resources policies.

Method of Personal Data Collection and Legal Basis

The method of collecting personal data and the legal basis for this collection are based on various legal grounds by our company to carry out our commercial activities. Personal data collected for these legal reasons may be processed and transferred for the purposes specified in clauses (b) and (c) of this text within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVKK.

Rights of the Data Subject Listed in Article 11 of the Personal Data Protection Law

As the data subject, you have the following rights regarding your personal data, and if you submit your requests regarding your rights to our Company through the methods specified in this Information Text, our Company will conclude the request as soon as possible and within thirty days at the latest, free of charge, depending on the nature of the request. However, if the Personal Data Protection Board determines a fee, the fee specified by our Company will be charged. In this context, data subjects have the following rights:

• Learning whether personal data is processed,
• Requesting information if personal data has been processed,
• Learning the purpose of processing personal data and whether they are used in accordance with their purpose,
• Knowing the third parties to whom personal data are transferred domestically or abroad,
• Requesting correction of personal data if it is incomplete or incorrectly processed, and notifying third parties to whom personal data have been transferred about the transaction made within this scope,
• Requesting the deletion or destruction of personal data in the event that the reasons requiring its processing are eliminated, even though it has been processed in accordance with the provisions of the Law and other relevant laws, and requesting notification of the transaction made within this scope to third parties to whom personal data have been transferred,
• Objecting to the occurrence of a result against the person by analyzing the processed data exclusively through automated systems,
• If personal data is processed unlawfully, requesting the compensation of the damage suffered.
• In accordance with Article 13 of the KVKK, you can submit your request regarding the exercise of your aforementioned rights to our Company in writing or through other methods determined by the Personal Data Protection Board. Since the Personal Data Protection Board has not determined any method at this stage, you are required to submit your application to our Company in writing in accordance with the KVKK. In this context, the channels and methods for submitting your application to our Company within the scope of Article 11 of the KVKK are explained below.
• To exercise your above-mentioned rights, you can personally submit your written request, along with necessary identification information and explanations regarding the right you wish to exercise, by filling out the Prome Solutions Application Form and delivering a signed copy of the form to the address: Sultan Selim Mah. Eski Büyükdere Cad. No: 61 İç Kapı No: 2 Kağıthane/İstanbul with identification documents, or you can send it via a notary or other methods specified in the KVKK, or you can securely send it with an electronic signature to the relevant info@promesolutions.com address.

Links to Third-Party Websites or Mobile Applications Provided Through Prome Solutions Websites and Digital Platforms:

We may provide links to individuals' websites, portals, or mobile applications. However, we have no responsibility for the enforcement of privacy policies on these sites or the privacy policies applicable to third parties. The privacy policies of third-party websites or mobile applications may differ from this Policy.

How Do We Protect Your Information?

To prevent the unlawful processing and access of your personal data you share and ensure the lawful storage of such data, we employ secure databases, servers, firewalls (security software), and encryption of email information. We undertake to protect your information, including personal data, by analyzing existing information security policies, data values, and risk situations in light of current technological developments and taking the broadest and most appropriate preventive security measures. In the event of a cyberattack by third parties resulting in the theft, deletion, or alteration of information belonging to any user, we undertake to notify the data subject and the relevant administrative authorities within the shortest possible time frame.

How Do I Manage My Information?

If you express your wish for your data not to be stored by contacting us, we undertake to delete data that is not necessary for the functioning of our system and that we are not legally obliged to keep, or for which the statutory storage periods have expired. With your support, we keep your personal information up-to-date and accurate using technological capabilities. You can request the deletion of your information through membership systems or by sending an email to "info@promesolutions.com."

How Do I Block Electronic Communications?

You can opt out of receiving electronic mail or instant message services for marketing and advertising purposes at any time using the methods provided in the messages we send you.

Children:

We do not intentionally process the data of users under the age of 18. All of our departments, including the individuals and legal entities we collaborate with, are aware of the sensitivity of your children's personal data and take the utmost care to protect this data. It is the responsibility of the parent or legal guardian to share their child's personal data with us. If a parent notices that their child has shared personal information with us without their consent, they can either delete this personal information themselves through Prome Solutions Websites and Digital Platforms or request us to do so. We advise parents to take an active role in monitoring their children's online activities.

Updating the Policy:

The provisions of this Policy may be changed or updated at any time without prior notice for any reason. The updated Policy provisions become effective on the date they are published on Prome Solutions Websites and Digital Platforms. Therefore, we recommend that you follow the updates to the Policy.