INFORMATION NOTICE FOR PROTECTION AND PROCESSING OF PERSONAL DATA

We, IC İçtaş – IC İçmak- Yapıtürk Konut Yapım Adi Ortaklığı (referred to as the "Company"), place paramount importance on safeguarding the security of your personal data. In this context, within the framework of the Personal Data Protection Law No. 6698 ("PDP Law"), we diligently implement measures to maintain an adequate level of security, thereby preventing any unlawful processing or unauthorized access to your personal data. We are committed to upholding the integrity and confidentiality of your personal data during its processing and when sharing it with third parties. To this end, we have prepared this document to provide information to data subjects.

We highly prioritize the security of your personal data, and we ensure that your personal data are stored in full compliance with the legal requirements, utilizing the utmost safety measures. Your personal data are retained for the duration specified by legal obligations. The personal data we collect are processed in a lawful and transparent manner, with precision, up-to-date information, and for specific, clearly defined, and legitimate purposes. They are processed in a manner that is relevant to the purposes for which they were collected, and we adhere to the principles of storing data for the period necessary for the intended purpose or as mandated by relevant legislation.

This information notice, issued by our Company on .... It may undergo revisions to the entire text or specific articles, and any such changes will result in updates to the effective date and version of the document. The document is accessible to data subjects through our Company's DENİZ KORU PROJECT website at ....

A. Data Controller

We, IC İçtaş – IC İçmak- Yapıtürk Konut Yapım Adi Ortaklığı, act as the legal entity responsible for determining the purposes and methods of personal data processing, as well as for establishing and managing the data recording system. Our Company will commence processing your personal data, ensuring data security, either upon obtaining your explicit consent or by informing you in cases where explicit consent is not required. During the processing of your personal data, we may also engage one or more data processors, ensuring the necessary level of security.

B. For What Purposes can Your Personal Data be Processed?

Your collected personal data may be processed by the Company for various purposes, which include fulfilling obligations towards individuals and entities engaged in a business relationship with the Company, providing updates and information, establishing and executing contracts with you, sending reminders and fulfilling legal obligations, conducting advertising and marketing activities, conducting surveys and obtaining your feedback, identifying suitable products, projects, and services for you, customizing and developing them, delivering efficient customer service, enabling you to benefit from the Company's products and services, carrying out related business processes in accordance with the personal data processing conditions specified in Articles 5 and 6 of the Law. These purposes encompass specific activities, such as:

• Managing quotation processes and collecting payments,
• Ensuring the legal, technical, and commercial security of the Company and related parties in a business relationship with the Company,
• Complying with requests from official institutions and providing information to authorized institutions as required by legislation,
• Meeting retention obligations stipulated in the legislation,
• Responding to individual applications in line with legal requirements and processing necessary procedures,
• Maintaining personal data throughout the general statute of limitations as potential evidence in future disputes,
• Safeguarding the security of company premises and/or facilities,
• Managing customer demands and complaints,
• Conducting customer satisfaction studies,
• Handling legal affairs,
• Performing audit and ethics activities,
• Managing operational activities to ensure the Company's compliance with Company procedures and/or relevant legislation.

We share the personal data we process for this purpose with our affiliates and business partners both in Turkey and internationally.

C. For What Purposes can Your Personal Data be Processed When You Provide Explicit Consent?

Your personal data, which is collected with your explicit consent, may be processed for the following purposes: planning and executing marketing processes for Products and Services; conducting profiling and analysis activities; recommending and promoting Products and Services customized to your preferences, usage habits, and needs; sending advertisements, promotions, and other commercial electronic messages to your contact information, which you have shared within the scope of your acceptance, and sharing them with third parties from whom we receive services to ensure delivery; notifying you of changes in legislation, internal company policies, or other notifications that concern you; birthday celebrations; participation in sweepstakes or contests; gift-giving and the organization of other similar events, promotions, and campaigns in your favor; informing you via email, SMS, and fax; providing information about campaigns; sending you printed bulletins, magazines, and articles about campaigns; profiling our visitor profiles; evaluating requests, demands, and complaints and implementing our company's human resources policies; and responding to your requests and questions.

D. To Whom and for What Purposes Can Processed Personal Data be Transferred?

The processed personal data may be transferred, directly or indirectly to our domestic/foreign affiliates or subsidiaries, domestic/foreign/international, public/private institutions and organizations, companies and other third persons or organizations from which our company receives service/support/consultancy or cooperates or is a project/program/financing partner, our company's affiliates, consultants, shareholders or solution partners to other group companies, Central Registry Agency and other authorized institutions and organizations, suppliers or subcontractors, limited to the purposes listed under Article (B) of this notification, provided that we comply with the conditions stipulated in Articles 8 and 9 of the PDP Law and take the necessary security measures.

As the Company, we may collect your personal data verbally, in writing or electronically through our affiliates, business partners and employees through our website and all other channels, on servers located in or outside Turkey or in other electronic media in accordance with the provisions of the relevant legislation, provided that we take the necessary security measures. This information notice and information form is an annex and an integral part of any contract you have signed with the Company and your requests for service procurement.

E. Method and Legal Reason for Collection of Your Personal Data

Your personal data may be obtained by the Company through different channels (offices and other physical environments where you can contact Deniz Koru Project head office, agencies, sales offices or other subcontractors or business partners, call centers, websites, mobile applications and similar electronic transaction platforms, through social media or other public channels, through your participation in training, conferences and similar environments organized, or through other group companies or other persons and organizations they have contracted, in written, verbal, audio or video recording or other physical or electronic media, etc.). Your personal data are collected and processed for the purposes specified in articles (b) and (c) of this notice and on the basis of the legal grounds that it is necessary to process personal data belonging to the contractual parties, provided that it is directly related to the performance of a contract as specified in paragraph 2(c) of Article 5 of the Personal Data Protection Law, and based on the basis of the legal grounds that the Company's legitimate interest or your explicit consent, provided that it does not harm the legal obligation of the data controller in subparagraph (ç) of the same paragraph, the necessity of data processing for the establishment, exercise and protection of a right under subparagraph (e), and the fundamental rights and freedoms of the person concerned under subparagraph (f).

Your Personal Data is stored in accordance with the legislation for the period required by legal obligations or for the period permitted by the relevant legislation.

F. Destruction Policy

Your processed personal data is stored for the periods stipulated in the applicable legislation. However, if no additional period is specified by the law for data retention, we keep your personal data for the duration necessary to fulfill our Company's practices and commercial customs related to the services we provide. After this period, we retain it only for a reasonable duration required as potential evidence in legal disputes. Once these specified periods have elapsed, we either delete, destruct, or anonymize your personal data on the first destruction date in accordance with Article 7 of the PDP Law.

G. Your Rights as the Data Subject

As a data subject, when you submit requests to our Company regarding your rights using the methods outlined below, our Company will process your request at no cost. We aim to address your request promptly, taking into account its nature, and in any case, we guarantee a response within thirty days at the latest. However, if the Personal Data Protection Board mandates a fee, our Company will apply the fee specified in our tariff. If the information and documents provided are incomplete, the response period will begin from the date when all necessary information and documents are received. Our Company reserves the right to verify your identity before responding. We will provide our responses in writing, either by regular mail or email, based on your preference.

In this context, the data subjects are entitled:

• To learn whether their personal data are processed or not,
• To request information if their personal data are processed,
• To learn the purpose of their data processing and whether such data are used for intended purposes,
• To learn the third parties in the country or abroad to whom personal data have been transferred,
• If personal data is processed incompletely or inaccurately, to request correction of the same and request for such correction to be informed to the third parties to whom the personal data is transferred,
• Although processed in compliance with PDP Law and provisions of other applicable laws, if reasons for processing are no longer available, to request the erasure or destruction of their personal data and to request for such transaction to be informed to the third parties to whom their personal data is transferred,
• To object to the occurrence of a result against them by analyzing the data processed solely through automated systems,
• To claim compensation for the damage arising from the unlawful processing of their personal data.

To exercise the rights mentioned above, you can send a written request to the Company at the following address: Maden Mahallesi, Kuğu Caddesi, No:46 Sarıyer/İstanbul, either in person or through a notary public. Your request must include essential information to identify you and clarify the right you wish to exercise.

When making the request, it is essential to use the Turkish language and provide a clear explanation of the specific right you are invoking, as outlined in Article 11 of the PDP Law. Please attach the necessary identity information, relevant documents, and any additional information required for your application. If you are making the request on behalf of a third party, ensure that you have the appropriate power of attorney to represent the individual.

This information notice is an integral part of any written or verbal agreement you have with IC İçtaş – IC İçmak- Yapıtürk Konut Yapım Adi Ortaklığı.

IC İçtaş – IC İçmak- Yapıtürk Konut Yapım Adi Ortaklığı reserves the right to modify this information notice in response to changes in the PDP Law and regulations set by the Personal Data Protection Board.