Identity of the Data Controller

Title: Anadolu Agency Turkish Joint Stock Company

Internet Address: aakitap.com.tr

Phone Number: +90 312 999 20 00

Email Address: info@aa.com.tr

Address: Eti District GMK Boulevard No:132 Çankaya ANKARA

General Principles of Data Protection

We process your personal data in accordance with the general principles of data protection law. These principles are as follows:

• Processing personal data transparently, lawfully and fairly,
• Processing of personal data for specific, clear and legitimate purposes,
• Processing of personal data only for the specified purposes,
• Keeping it accurate and up to date,
• Data is stored for the period related to processing purposes,
• Safe storage.

What Types of Data Do We Collect?

As Anadolu Agency Turkish Joint Stock Company ("Company"), we process your personal data within the scope of our activities, as per Article 4 of the Personal Data Protection Law ("PDPL") and the General Data Protection Regulation. We process your personal data in accordance with the general principles set forth in Article 5 of the Regulation. The personal data we process are as follows:

• Your identity information (name, surname, trade name for sole proprietorships, signature/signature circulars, TR ID No., gender, date of birth),
• Your contact information (telephone number, e-mail address, work and residence address information, area of residence information, telephone call information),
• Your professional experience information (position/title, authority, unit worked, institution-company worked, CV, educational information),
• Your financial information (Bank account-IBAN information, amount information, payment information, invoice information, tax office information, receivable-debit information, reconciliation information),
• Your marketing information (contact preference information, cookie records),
• Your customer transaction information (Order information, order history),
• Your legal transaction information (information included in correspondence with judicial authorities, personal data in case-enforcement files, contract information, consent information),
• Your request and complaint information (request, complaint and suggestion content information, social media account information).

Where Do We Get This Data?

We obtain the data we have processed:

• By automatic means through the aakitap.com.tr website and the forms on this address,
• Automatically through your order processes,
• By non-automatic and partially automatic means through lawsuit/execution files and notifications,
• With the documents you have sent us, through non-automatic means,
• From relevant public institutions and organizations through non-automatic and partially automatic means,
• By e-mail, partially by automated means,
• Verbally, through non-automatic means,
• Through non-automatic means, through documents physically delivered to us,
• With the applications made, partially automatic and non-automatic means,
• By non-automatic means through contracts,
• Partially automatically through accounting systems,
• By automatic means through relevant software and programs used.

What are our purposes in processing this data and what legal conditions do we rely on?

The data processing conditions stipulated within the scope of PDPL are as follows:

• Existence of explicit consent (Art. 5/1, Art. 6/3-a).
• It is clearly stated in the laws (Art. 5/2-a, Art. 6/3-b).
• If it is obligatory for the protection of the life or physical integrity of a person or of another person who is unable to give his/her consent due to a physical impossibility or whose consent is not legally valid (Article 5/2-b).
• The processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of a contract (Art. 5/2-c).
• It is obligatory for the data controller to fulfil its legal obligations (Art. 5/2-ç).
• It has been made public by the relevant person himself/herself (Art. 5/2-d).
• Data processing is obligatory for the establishment, exercise or protection of a right (Art. 5/2-e).
• Data processing is obligatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned (Article 5/2-f).

The data processing conditions stipulated under the General Data Protection Regulation ("GDPR") are as follows:

• The data subject consents to the processing of his or her personal data for one or more specific purposes (Art. 6/1-a),
• Processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract (Art. 6/1-b),
• Processing is necessary for compliance with a legal obligation to which the controller is subject (Art. 6/1-c),
• Processing is necessary to protect the vital interests of the data owner or another natural person (Article 6/1-d),
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6/1-e),
• Processing is necessary for the purposes of such interests, unless the legitimate interests pursued by a controller or a third party are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child (Art. 6/1-f).

We request this data from you to achieve the following purposes:

We process your identity information:

• In order to verify your identity (PDPL, art.5/2-ç, art.5/2-f) – (GDPR, art.6/1-c, art.6/1-f),
• In order to carry out and supervise business activities (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to carry out communication activities (PDPL, art.5/2-c, art.5/2-ç, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-c, art.6/1-f),
• In order to carry out processes regarding payments and payment requests (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to fulfill our legal obligations (PDPL, art.5/2-a, art.5/2-ç, art.5/2-e) – (GDPR, art.6/1-c),
• In order to follow legal and judicial processes (PDPL, art.5/2-a, art.5/2-ç, art.5/2-e) – (GDPR, art.6/1-c),
• In order to carry out contract processes (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to receive orders and deliver them to you (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to carry out invoice processes (PDPL, art.5/2-c, art.5/2-ç) – (GDPR, art.6/1-b, art.6/1-c),
• In order to carry out the summary declaration processes (PDPL, art.5/2-d) – (GDPR, art.6/1-c),
• In order to create current cards and make current reconciliations (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to carry out the request and complaint processes (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to send you commercial electronic messages and newsletters for advertising and marketing purposes (PDPL, art.5/1) – (GDPR, art.6/1-a).

We process your contact information:

• In order to carry out and supervise business activities (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to carry out communication activities (PDPL, art.5/2-c, art.5/2-ç, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-c, art.6/1-f),
• In order to fulfill our legal obligations (PDPL, art.5/2-a, art.5/2-ç, art.5/2-e) – (GDPR, art.6/1-c),
• In order to follow legal and judicial processes (PDPL, art.5/2-a, art.5/2-ç, art.5/2-e) – (GDPR, art.6/1-c),
• In order to carry out contract processes (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to receive orders and deliver them to you (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to carry out invoice processes (PDPL, art.5/2-c, art.5/2-ç) – (GDPR, art.6/1-b, art.6/1-c),
• In order to carry out the summary declaration processes (PDPL, art.5/2-d) – (GDPR, art.6/1-c),
• In order to carry out processes regarding payments and payment requests (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to create current cards and make current reconciliations (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to carry out the request and complaint processes (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to send you commercial electronic messages and newsletters for advertising and marketing purposes (PDPL, art.5/1) – (GDPR, art.6/1-a).

We process your professional experience information:

• In order to carry out and supervise business activities (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to carry out communication activities (PDPL, art.5/2-c, art.5/2-ç, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-c, art.6/1-f),
• In order to carry out contract processes (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to follow legal and judicial processes (PDPL, art.5/2-a, art.5/2-ç, art.5/2-e) – (GDPR, art.6/1-c),
• In order to create current cards and make current reconciliations (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f).

We process your financial information:

• In order to carry out and supervise business activities (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to carry out processes regarding payments and payment requests (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to follow legal and judicial processes (PDPL, art.5/2-a, art.5/2-ç, art.5/2-e) – (GDPR, art.6/1-c),
• In order to carry out contract processes (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to receive orders and deliver them to you (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to carry out invoice processes (PDPL, art.5/2-c, art.5/2-ç) – (GDPR, art.6/1-b, art.6/1-c),
• In order to carry out the summary declaration processes (PDPL, art.5/2-d) – (GDPR, art.6/1-c),
• In order to create current cards and make current reconciliations (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f).

We process your marketing information:

• In order to carry out contract processes (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to carry out communication activities (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to carry out the request and complaint processes (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f).

We process your legal transaction information:

• In order to carry out and supervise business activities (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to fulfill our legal obligations (PDPL, art.5/2-a, art.5/2-ç, art.5/2-e) – (GDPR, art.6/1-c),
• In order to follow legal and judicial processes (PDPL, art.5/2-a, art.5/2-ç, art.5/2-e) – (GDPR, art.6/1-c),
• In order to carry out contract processes (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to carry out invoice processes (PDPL, art.5/2-c, art.5/2-ç) – (GDPR, art.6/1-b, art.6/1-c).

We process your customer transaction information:

• In order to carry out contract processes (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to receive orders and deliver them to you (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to carry out communication activities (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to carry out the request and complaint processes (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f).

We process your request/complaint information:

• In order to carry out the request and complaint processes (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f),
• In order to receive and meet hardware, software and technical support requests (PDPL, art.5/2-c, art.5/2-f) – (GDPR, art.6/1-b, art.6/1-f).

The data processing conditions we rely on when processing this data are stated in parentheses.

Who Do We Share Data With?

We can share the personal data we have processed with:

• Courts and authorized public institutions and organizations in order to follow legal and judicial processes,
• Authorized public institutions and organizations in order to fulfill our legal obligations,
• Law firms for the purpose of carrying out legal processes,
• Banks for the purpose of carrying out payment processes,
• Auditors in order to carry out audit processes,
• Cargo companies for the purpose of carrying out shipping processes,
• Relevant suppliers for the purpose of conducting and auditing business activities,
• Private and legal persons to whom the necessary correspondence and communication activities are to be carried out.

We do not share personal data with unrelated and unauthorized third parties other than the specified third parties.

Storage and Destruction of Personal Data

As a company, we process and store your personal data in accordance with general principles, in a manner proportionate to the purpose of processing your personal data, and in accordance with these general principles. We take all technical and administrative measures to ensure the security of your stored personal data, and we also monitor the compliance of third parties to whom we transfer your data with these measures.

We retain your personal data by taking into account factors such as the purpose and reason for processing, the period required by applicable legislation, and our legal obligations. If we no longer need your personal data based on the specified criteria and are not legally obligated to retain it, we destroy your personal data.

What are your rights under PDPL?

By applying to us, interested parties have the following rights:

• To learn whether personal data is being processed,
• To request information regarding personal data if it has been processed,
• To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
• To know the third parties to whom personal data is transferred, either domestically or abroad,
• To request correction of personal data if it is processed incompletely or incorrectly and to request that the action taken in this context be notified to third parties to whom personal data has been transferred,
• To request the deletion or destruction of personal data in case the reasons requiring processing are eliminated, even though it has been processed in accordance with the provisions of the Law and other relevant laws, and to request that the action taken within this scope be notified to third parties to whom personal data has been transferred,
• To object to the emergence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems,
• To request compensation for damages in case of damages due to unlawful processing of personal data.

You can submit your requests regarding your rights to the Data Controller in accordance with the Communiqué on Application Procedures and Principles. Your requests will be evaluated and decided upon free of charge as soon as possible and ultimately within thirty (30) days. If the evaluation and decision-making process requires additional costs, the fee set by the Personal Data Protection Board will apply. You can also contact us for detailed information regarding your data processing procedures.

This Privacy Policy and Disclosure Text has been prepared in Turkish and English, and in case of conflict, the Turkish text will prevail.