Privacy Notice

Bİ STRATEJİK YAZILIM SAN. VE TİC. A.Ş

PERSONAL DATA PROCESSING PRIVACY NOTICE

As Bİ Stratejik Yazılım San. ve Tic. A.Ş. (“Company”), we attach utmost importance to the security of your personal data. With this awareness, we place great importance on processing and preserving all personal data belonging to all individuals associated with the Company, including those who benefit from our products and services, in accordance with the Personal Data Protection Law No. 6698 (“PDPL”). With full understanding of this responsibility, and in our capacity as the “Data Controller” as defined under the PDPL, we process your personal data as explained below and within the limits prescribed by the applicable legislation.

1. Collection, Processing and Purposes of Processing Personal Data

Your personal data may vary depending on the services provided by our Company and our commercial activities. Such data may be collected verbally, in writing, or electronically through automatic or non-automatic methods via our Company units and offices, parent company, business partners, website, social media channels, mobile applications, and similar means.

Your personal data may be processed by being created and updated as long as you benefit from the products and services offered by our Company and its affiliated group companies. Additionally, your personal data may be processed when you use our call centers or website to benefit from our services, visit our Company or website, or participate in training sessions, seminars, or events organized by our Company.

Your collected personal data shall be processed within the personal data processing conditions and purposes specified in Articles 5 and 6 of the PDPL for the following purposes:

• Carrying out necessary work by our business units to enable you to benefit from the products and services offered by our Company,

• Customizing and recommending our products and services according to your preferences, usage habits, and needs,

• Ensuring the legal and commercial security of persons in business relations with our Company (including administrative operations related to communication, ensuring physical security and supervision of Company locations, customer evaluation/complaint management processes, reputation research processes, event management, legal compliance processes, audit and financial affairs, etc.),

• Determining and implementing our Company’s commercial and business strategies,

• Ensuring the execution of our Company’s human resources policies.

Personal Data Categories Processed by BI Stratejik

Identity Information: Name-surname, Turkish ID number, nationality, parents’ names, place and date of birth, gender, social security number, and all information contained in documents such as driver’s license, identity card, and residence certificate.

Contact Information: Telephone number, address, email address, fax number.

Customer Information: Information obtained and generated regarding the relevant person as a result of our commercial activities and operations carried out by our business units.

Employee/Candidate Information: Information of Company employees and individuals who have applied to become employees.

Marketing Information: Personal data processed for the purpose of marketing our products and services by customizing them according to the personal data subject’s usage habits, preferences, and needs, and reports and evaluations generated as a result of such processing.

Request / Complaint Management Information: Personal data relating to the receipt and evaluation of any request or complaint directed to the Company.

2. To Whom and for What Purposes Processed Personal Data May Be Transferred

Your collected personal data may be transferred, within the scope of the personal data processing conditions and purposes specified in Articles 8 and 9 of the PDPL, to our business partners, suppliers, parent company and its authorized persons/related units, Company executives, shareholders, legally authorized public institutions and private persons for the following purposes:

• Enabling you to benefit from the products and services offered by our Company,

• Customizing and recommending products and services according to your preferences and needs,

• Ensuring legal and commercial security (administrative communication operations, physical security of Company premises, evaluation processes of business partners/customers/suppliers/parent company officials or employees, reputation research, legal compliance processes, audit, financial affairs, etc.),

• Determination and implementation of our Company’s commercial and business strategies,

• Execution of our Company’s human resources policies.

Personal data processed within our Company are processed for purposes including but not limited to:

• Ensuring that our products and services are offered to customers in the most appropriate manner,

• Invitation to events and conducting promotional activities,

• Sharing post-training documentation and announcing new training programs,

• Carrying out financial transactions,

• Conducting operational activities, business relationships, and human resources processes,

• Performing processes arising from corporate law,

• Providing information to authorized institutions and organizations pursuant to legal obligations,

• Creating and tracking visitor records.

3. Method and Legal Basis of Personal Data Collection

Your personal data are collected in all kinds of verbal, written, or electronic environments for the purposes stated above, in order to provide our products and services within the determined legal framework and to fulfill our contractual and legal obligations completely and accurately.

Your personal data collected for these legal reasons may be processed and transferred within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the PDPL, for the purposes stated in Articles (1) and (2) of this text.

4. Rights of the Personal Data Subject Listed in Article 11 of the PDPL

As personal data subjects, if you submit your requests regarding your rights to our Company through the methods set out below in this Privacy Notice, our Company shall conclude the request free of charge within thirty (30) days at the latest, depending on the nature of the request. However, if a fee is stipulated by the Personal Data Protection Board, the fee determined in the tariff set by our Company may be charged.

Within this scope, personal data subjects have the right to:

• Learn whether personal data are processed,

• Request information if personal data have been processed,

• Learn the purpose of processing personal data and whether they are used in accordance with their purpose,

• Know the third parties to whom personal data are transferred domestically or abroad,

• Request correction of incomplete or inaccurate personal data and request notification of such correction to third parties to whom personal data have been transferred,

• Request deletion or destruction of personal data if the reasons requiring processing no longer exist, even though they were processed in accordance with the PDPL and other relevant laws, and request notification of such action to third parties,

• Object to the emergence of a result against the person by analyzing processed data exclusively through automated systems,

• Request compensation for damages in case of unlawful processing of personal data.

Pursuant to Article 13/1 of the PDPL, you may submit your request to exercise the above-mentioned rights to our Company in writing or by other methods determined by the Personal Data Protection Board. Since no alternative method has been determined by the Board at this stage, your application must be submitted to our Company in writing in accordance with the PDPL. Accordingly, you may submit your written application including the necessary identifying information and explanations regarding the right you request to exercise under Article 11 of the PDPL by Filling out the form available at www.bitechnology.com, signing it, and delivering a signed copy by hand with documents verifying your identity to: Atatürk Mah. Ertuğrul Gazi Sokak Metropol İstanbul Sitesi C1 Blok Apt. No: 2/B K: 23 34758 Ataşehir / Istanbul Sending it through a notary public or other methods specified in the PDPL, Sending the relevant form with a secure electronic signature to bistratejikyazilim@hs01.kep.tr.

4.1 Response Procedure

In accordance with Article 13 of the PDPL, our Company shall finalize application requests submitted by the personal data subject as soon as possible and within thirty (30) days at the latest, free of charge, depending on the nature of the request. However, if the process requires additional cost, the fee determined by the Personal Data Protection Board may be charged.

If the personal data subject’s application is rejected, the response is found insufficient, or no response is given within the prescribed period, the personal data subject has the right to file a complaint with the Personal Data Protection Board within thirty (30) days from the date of learning the response and in any case within sixty (60) days from the date of application.