Bilkent Holding

Protection of Personel Data

INFORMATION ON THE LAW ON THE PROTECTION OF PERSONAL DATA

1. General Information About the Law

The Law No. 6698 on the Protection of Personal Data was enacted on 24 March 2016 and published in the Official Gazette No. 29677 of 7 April 2016.

According to Article 32 entitled "Effective Date" of the Law No. 6698 on Protection of Personal Data, the Articles 8, 9, 11, 13, 14, 15, 16, 17 and 18 of this Law came into effect on 7 October 2016, six months after the publication date.

The Law No. 6698 on the Protection of Personal Data was prepared in order to protect basic rights and liberties, particularly the right to privacy, of persons during the processing of personal data and to regulate the obligations of natural and legal persons who process personal data as well as the procedures and principles to be observed by the latter.

2.    Information on the Data Controller

In our capacity of Data Controller pursuant to Law No. 6698 on the Protection of Personal Data; we, BILKENT HOLDING A.S., will use your personal data in accordance with applicable legislation.

3.    How will your personal data be processed?

In our capacity of data controller pursuant to Law No. 6698 on the Protection of Personal Data; we, Bilkent Holding A.S., will be allowed to perform all transactions on the data, such as obtaining, recording, storing, maintaining, changing, restructuring, disclosing, transferring, taking over, making available or classifying your personal data that you share with our company or preventing the use thereof by fully or partially-automated or non-automated means as part of any recording system.

4.    What are the purposes of and legal causes for processing your personal data?

We will process the personal data you share with us in accordance with the Law No. 6698 on the Protection of Personal Data and the applicable legislation in order to provide our services in accordance with the requirements of the legislation, contract and technology, to develop our products and services, to fulfil our obligations in terms of information storage, reporting and acknowledgement stipulated by judicial and administrative authorities, to engage in advertising and publicity activities, and to analyze our customer portfolio.

5.    Information on the persons or organizations to which we may transfer your personal data

For the above mentioned purposes and in accordance with the Law No. 6698 on the Protection of Personal Data and the applicable legislation; the persons/organizations to whom the personal data that you share with us may be transferred are all government authorities and agencies, Bilkent Holding A.S. to which we are affiliated, the companies of which Bilkent Holding A.S. is a direct or indirect shareholder, its subsidiaries, the companies of which we are a shareholder as Bilkent Holding A.S. and our principal shareholder, including Bilkent Holding and its subsidiaries, our direct/indirect subsidiaries at home and abroad; other partners under ordinary partnerships, the program partner organizations from which we get services and cooperate to carry out our activities, domestic/international organizations and other third parties.

6.    How is your personal data collected?

Your personal data may be collected in oral, written or electronic form via our website, sales and marketing department employees, forms collected during customer visits, digital marketing, contracts, applications, forms, offers, cookies used by our computer to recognize you during your website visits, etc.

7.    What are your rights under the Law No. 6698 on the Protection of Personal Data?

a. learn whether or not your personal data has been processed,
b. request information on the processed data, if your personal data has been processed,
c. learn the purpose of processing the personal data and whether or not the personal data has been used in accordance with the declared purpose,
d. know about the third parties at home and abroad, to which the personal data has been transferred,
e. request for the correction of the personal data, if such data were processed incompletely or incorrectly,
f. request for deletion or destruction of personal data under the provisions set forth in the Article 7 of the Law,
g. request for the notification of the transactions performed pursuant to the paragraphs (d) and (e) above to the third parties to which the personal data has been transferred,
h. object to any consequence that may arise against himself/herself through the analysis of the processed data exclusively by means of automated systems, and
i. request for compensation of any damages incurred by himself/herself due to unlawful processing of personal data.