As per Article 10 “Notification Obligation of the Data Controller” of the Personal Data Protection Law No. 6698 (“KVKK”), published in the Official Gazette dated April 7, 2016 and numbered 29677, and signed into law to protect fundamental rights and liberties when processing personal data, particularly the right to privacy, and as per the “Communiqué on the Rules and Procedures to be Observed during Fulfillment of the Notification Obligation”, published in the Official Gazette dated March 10, 2018 and numbered 30356, this Clarification Text is intended to give you information about personal data processed by our Company BARLAS EĞİTİM DANIŞMANLIK BİLİŞİM HİZMETLERİ TURİZM SAN. VE DIŞ TİC. LTD. ŞTİ. (hereinafter referred to as “Barlas” or the “Company”).

1-WHO THE DATA CONTROLLER IS:

As per the Personal Data Protection Law and the related regulations, Barlas is entitled to the title of “Data Controller”. You can always contact us via the contact details below.

Address: Esentepe Mah. Mithat Ulu Ünlü Sok. 17 21 Plaza Şişli, Istanbul, Turkey

Tel.: 0212 280 86 36

Fax: 0212 280 33 37

Email: [email protected]

2-PROCESSING OF PERSONAL DATA:

Your personal data as given below is processed within the context of your relationship with Barlas:

• Your ID Details: name and last name, ID card, identity number, tax identification number
• Your Contact Details: work address, home address, email, landline, mobile phone, place of residence, address registration system records
• Data About Your Educational Background, Job History and Professional Life: work experience, alma mater, professional skills, CV details
• Data About Personal Status: marital status
• Data About Your Payment History and Financial Situation: risk of default, declaration of wealth
• Data About the Security of Our Company Headquarters: CCTV footage, visitor records, registries of persons entering and exiting the stations
• Data About Your Vehicle: license number
• Data that Identifies You as a Customer: customer number, customer transaction details
• Your Visual and Audio Recording Data: sound recordings
• Sensitive Personal Data: health status

3-WHY WE PROCESS YOUR PERSONAL DATA:

As part of your relationship with Barlas, your personal data is processed for purposes listed below.

• Follow-up and execution of legal procedures
• Uploading customer data into the system to perform archiving activities
• Execution of financial and accounting operations
• Execution of advertising / campaign / promotional processes
• Execution of contract processes
• Making a monthly Withholding Tax Return
• Management of requests and complaints
• Granting of a power of attorney on behalf of third parties (lawyer, customs consultant, company personnel, financial advisor, environmental advisor) to represent the company in various matters
• Ensuring the security of movable goods and resources
• Execution of activities in accordance with the legislation
• Execution of the wage policy
• Execution of marketing processes for goods / services
• Execution of procurement processes for goods / services
• Execution of sales processes for goods / services
• Execution of marketing and analysis activities
• Ensuring the security of physical spaces
• Execution of logistics activities
• Execution of strategic planning activities

4-TRANSFER OF PROCESSED PERSONAL DATA:

Within the framework of the provisions of the Law on the transfer of personal data and their transmission abroad and for purposes stated in Article 3 of this Clarification Text, your personal data may be shared with domestic official institutions and organizations, law enforcement agencies, courts and executive offices, third parties who may be natural and legal persons with whom we are associated, to service providers and their executives, business partners, banks, shareholders of our Company, to our Group companies and affiliated companies, suppliers and providers of support services.

5-HOW WE COLLECT PERSONAL DATA AND ITS LEGAL BASIS:

Barlas collects, stores and processes your personal data from you, third parties and legal authorities through internet, phone and email and through physical, written, oral and electronic platforms for the purposes stated above and on the basis of the below mentioned legal justifications also stipulated in the provisions of Articles 5, 6, and 8 of the Law, during the establishment of a legal relationship between our Company and you and during the maintenance of such relationship.

• Your express consent;
• Its clear citation in the laws to which our Company is subject, including the Tax Procedure Law, the Turkish Code of Obligations and the Turkish Commercial Code;
• Compliance with national and international principles and policies with regard to customer identification, as well as compliance with data retention, reporting and notification requirements as laid down by the legislation and official authorities;
• To the extent that it is directly related to the conclusion or performance of a contract, the necessity of processing the personal data of the contracting parties; to provide the products and services requested and to fulfil the requirements of the contracts concluded by you;
• In cases where it is compulsory to honor legal liabilities;
• If it has been disclosed by the concerned person;
• If data processing is mandatory for the granting, utilization or preservation of a right;
• If data processing is mandatory for the legitimate interests of the data controller, to the extent the fundamental rights and liberties of the concerned person are not violated.

Your sensitive personal data, on the other hand, is collected, stored and processed in conjunction with the legitimate reasons given below:

• Your express consent;
• Without your express consent, non-medical personal data may be collected, stored and processed in cases stipulated by laws;
• Also without your express consent, personal medical data may be collected, stored and processed by individuals that are under an obligation of confidentiality or authorized institutions and organizations only in order to protect public health, as well as for purposes of preventive medicine, medical diagnosis, execution of treatment and care services and planning and management of health services and financing.

6-RIGHTS OF THE PERSON WHOSE PERSONAL DATA IS PROCESSED:

You have the following rights in relation to your personal data in accordance with the provisions of Article 11 of the Law.

• The right to learn whether your personal data is processed or not;
• The right to request information if your personal data has been processed;
• The right to learn the purpose for the processing of personal data and whether such data is used for its intended purposes;
• The right to know the domestic or foreign third parties to whom personal data is transferred;
• The right to request the correction of any incompletely or incorrectly processed personal data;
• The right to request the deletion or destruction of personal data;
• The right to request the correction, deletion or destruction of personal data to be notified to third parties to whom personal data was transferred;
• The right to object to the occurrence of a result against you through the exclusive analysis of the processed data by automated systems;
• The right to claim compensation for any damages that you may have suffered due to the unlawful processing of personal data.

7-IF YOU WISH TO CONTACT US ABOUT YOUR RIGHTS AND REQUESTS:

In accordance with your legal rights as accorded by the relevant laws and other legislation, you can write a petition indicating your requests and deliver it to our abovementioned address either by hand or through a notary public. You can deliver a signed copy of your application to the address Esentepe Mah. Mithat Ulu Ünlü Sok. 17 21 Plaza Şişli, Istanbul, Turkey by hand, or as per Article 5 of the “Communiqué on the Rules and Procedures of Applying to the Data Controller” you can send it to [email protected] by using your registered email address (KEP), secure electronic signature, mobile signature or your email address held by us, which you have previously communicated to our company.

All concerned applications will be accepted only after they pass our identity verification process, and your requests will be dealt with as soon as possible and within 30 days at the latest, depending on the nature of the request.

The following must be included in your application:

a) Name, surname and, if it is a written application, your signature

b) TR identity number for Turkish citizens, nationality, passport number or ID number (if available) for foreigners

c) A residential address or workplace address for notification

d) Email address, telephone and fax number (if available) for notification

e) The subject of the request

Information and documents related to the application are also added to the application.

If your application brings extra costs, you may need to pay a fee imposed by the Personal Data Protection Board. Your requests in your application will be dealt with as soon as possible and no later than 30 (thirty) days after receipt of your application, depending on the nature of the request.

You can visit the website of the Personal Data Protection Agency (https://www.kvkk.gov.tr/en/) to get further information about your rights under Law No. 6698 and the related legislation.