GENERAL DISCLOSURE TEXT ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

As Taneva Fair Organization Trade Ltd. Co. ("Taneva"), we place utmost importance on the security of your personal data. With this awareness, we prioritize the processing and storage of personal data belonging to individuals interacting with Taneva in compliance with the Personal Data Protection Law No. 6698 ("Law"), the secondary regulations (regulations, communiqués, circulars) enacted or to be enacted under the Law, and the binding decisions made or to be made by the Personal Data Protection Board. With full awareness of this responsibility, as a "Data Controller" defined under the Law, we process your personal data as explained below and within the limits prescribed by the legislation.

Information About the Data Controller

In accordance with the Law, Taneva Fair Organization Trade Ltd. Co., registered with the Istanbul Trade Registry Office under registration number 196581-0 and MERSIS number 0469002668200014, headquartered at "Bostancı Mah. Oramiral Celal Eyiceoğlu Sk. Urcun Palas Apt. No:5 B Blok D:1 Suadiye / Istanbul," is the Data Controller.

Purposes of Processing Personal Data

Your personal data may be processed by Taneva to:

• Perform the necessary activities by the company’s business units to ensure that Taneva’s commercial activities are carried out in compliance with the legislation and company policies,
• Identify, plan, and implement the company's short, medium, and long-term commercial policies,
• Design and execute the company's human resources activities,
• Fulfill obligations arising from its membership in MKK (Central Securities Depository of Turkey),
• Manage customer relations and corporate communication processes, and
• Ensure the commercial and legal security of the company's affiliated companies and individuals with whom the company has business relations.

Your personal data is processed in accordance with the principles of legality, fairness, and relevance, limited to and proportionate with these purposes, as specified in the Law.

Transfer of Personal Data

Your personal data, within the scope of the purposes mentioned above, may be transferred in compliance with the conditions stated in Articles 8 and 9 of the Law to:

• Legally authorized public institutions, judicial, and administrative authorities,
• Private legal entities and individuals authorized by legislation,
• Institutions and organizations authorized to audit the company,
• Payment institutions contracted for fulfilling financial obligations,
• Business partners from whom services are received or with whom collaborations are established to conduct and improve company activities,
• The company's affiliated companies and shareholders, when necessary.
  All transfers are conducted by implementing the data security measures outlined in the Law.

Method and Legal Basis for Collecting Personal Data

Your personal data is collected by authorized company units and employees through automatic and non-automatic methods, orally, in writing, or electronically. Personal data categories such as identity, contact information, location, personal records, legal transactions, customer transactions, physical security, transaction security, risk management, finance, professional experience, marketing, and visual/auditory recordings are processed based on the following legal grounds specified in Article 5(2) of the Law:

• Processing is necessary for the conclusion or performance of a contract,
• Processing is mandatory for the data controller to fulfill its legal obligations,
• Data has been made public by the individual concerned, and
• Processing is mandatory for the legitimate interests of the company, provided that it does not harm the fundamental rights and freedoms of the data subject.

Your Rights Under the Law

At any time, you may contact the company to:

• Learn whether your personal data is processed,
• Request information if your personal data has been processed,
• Learn the purpose of processing and whether your data is used in line with this purpose,
• Know the third parties to whom your personal data is transferred domestically or abroad,
• Request correction of incomplete or inaccurate data,
• Request the deletion or destruction of personal data under the conditions stipulated in Article 7 of the Law,
• Request notification of the actions taken as per (d) and (e) to third parties to whom personal data has been transferred,
• Object to a result arising against you due to the exclusive analysis of processed data via automated systems, and
• Demand compensation for damages incurred due to unlawful processing of your personal data.

You may submit your requests related to these rights by filling out the application form available at www.taneva.com.tr, signing it, and sending it via notary public, registered mail, or in person to the address: Bostancı Mah. Oramiral Celal Eyiceoğlu Sk. Urcun Palas Apt. No:5 B Blok D:1 Suadiye / Istanbul. Alternatively, you can send the digitally signed application form via your secure electronic signature or registered email address to kvkk@taneva.com.tr.

The company will respond to requests in writing, free of charge for up to ten pages; for each page exceeding ten, a fee of 1 Turkish Lira will be charged. If the response is provided in a medium such as a CD or flash drive, the company may charge an amount not exceeding the cost of the medium.