MOR GROUP – CLARIFICATION TEXT FOR PROTECTION AND PROCESSING OF PERSONAL DATA

As __ (“Mor Group”), we give importance in security of any kind of personal data of all persons regarding our company and processing and storage of personal data in accordance with the Law on Protection of Personal Data numbered 6698.

Clarification Text of Protection and Processing of Personal Data of Mor Group is prepared to inform and enlighten the real persons when obtaining personal data within the scope of the Art. 10 of the Law on Protection of Personal Data numbered 6698 (“LPPD”) and other relevant regulations.

1-) IDENTITY OF THE DATA CONTROLLER

Within the scope of the Law on Protection of Personal Data numbered 6698, our company Mor Group has the capacity of “data controller” as defined in the LPPD.

2-) PROCESSING OF PERSONAL DATA AND PURPOSE FOR PROCESSING

Your personal data will be processed to enable institutions and enterprises that you represent to benefit from products and services that are provided by our Company, to determine and apply commercial and business strategies of our Company, to carry out marketing activities, to conduct necessary operations including business development and planning activities, to ensure physical security and audit of locations of our Company that are in use, to establish relationships with business partners/customers/suppliers (their authorized persons or employees), to fulfill agreement requirements and make financial agreements with our business partners, suppliers and other third parties for products and services, to enforce human resources policies of our Company, to call center or use Website of our Company and/or participate in trainings, seminars or organizations held by our company within the frame of conditions and purposes for personal data processing as specified in the Articles 5 and 6 of the LPPD by using, recording, storing, updating, transferring and/or classifying them in accordance with the principles for personal data processing specified in the Art. 4 of the LPPD. You shall be responsible for accurate, complete and updated personal data that you provided to our Company and sending necessary notification in case of change.

3-) TRANSFER OF PERSONAL DATA

Your personal data may be transferred within the limitations set by provisions of the Laws and other regulations as limited to realizing the purposes specified above and fulfilling the obligations brought by the relevant regulation; to Mor Group, its group companies, Subsidiaries and Affiliates and Company authorities and our shareholders, to companies authorized by us and operating on behalf of our Company, our representatives, Regulatory and supervisory institutions, public institutions and organizations authorized to demand your personal data as expressly specified in the relevant laws, to business partners, suppliers and contracting companies within the scope of the purposes specified, banks, credit risk and financial institutions and other real or legal persons, Tax and similar advisors, obligatory persons related to legal follow-up processes, institutions and organizations and third parties that we receive consultancy services including auditors, to business partners, third parties, authorized persons and enterprises that provide services operating in Turkey and abroad for the purposes specified above, to public institutions and private persons that are authorized legally within the frame of conditions and purposes for personal data processing as specified in the Articles 8 and 9 of the LPPD.

4-) METHOD AND LEGAL REASON FOR COLLECTING PERSONAL DATA

Your personal data are collected with automated or nonautomated methods in verbal, written or electronic ways with various channels through offices, branches, call center, website, social media platforms mobile applications and similar means. Your personal data will be stored in electronic and/or physical environments. Necessary business processes are designed and technical security infrastructures are developed in order to ensure your personal data obtained and stored by our Company are not exposed to unauthorized access, manipulated, lost or damaged. Your personal data will be processed with all necessary information security measures and stored and processed during legal storage period or a period required by purpose for processing if a legal storage period is not provided on condition that your data are not used for purposes and scope other than those notified to you. At the end of this period, your personal data will be removed from data flow of our Company with methods like deletion, disposal or anonymization. Your personal data collected for this legal reason may be processed and transferred within the scope of terms and purposes for personal data processing specified in the articles 5 and 6 of the LPPD and for purposes specified in the articles (2) and (3) of this text.

5-) RIGHTS OF THE PERSONAL DATA OWNER

According to the Article 20 of the T.R. Constitution, everybody has the right to be informed about his/her personal data and he/she has the right to “request information” as a right of the Personal Data owner as per the Article 11 of the LPPD. Within this scope, Mor Group informs the personal data owner if requested by the owner. With this Clarification Text, Mor Group informs the data owner about how to use said right to request information and how to assess the matters regarding the request for information.

In accordance with the LPPD, Personal data owner has the right:

1. To learn purpose of processing personal data and personal data is used in accordance with such purposes,
2. To request information if his/her Personal Data is processed,
3. To learn whether his/her Personal Data is processed,
4. To know domestic and international third parties that his/her personal data are transferred to,
5. To request correction if personal data is processed deficiently or incorrectly,
6. To request his/her personal data to be deleted or disposed within the frame of the conditions provided in the Article 7 of the LPPD and request his/her Personal Data to be notified to the third parties that Personal Data is transferred to,
7. To reject if there is a result against him/her when his/her processed data is analyzed exclusively through automated systems,
8. To request for claim of damage if Personal Data is damaged due to processing of Personal Data contrarily to the LPPD.

Application of the Data Owner

You may deliver your requests for your rights specified above in written through the address of [.] or via registered e-mail address [.]. If conclusion of said requests require an additional cost, Mor Group may demand a fee from the applicant in a tariff determined by the Council of Protection of Personal Data.

Data Owner shall be responsible for up-to-datedness and accuracy of Personal Data processed within the scope of this Clarification Text.