Personal Data Protection (KVKK)

ADSERA BİLİŞİM VE YAZILIM HİZMETLERİ LİMİTED ŞİRKETİ (hereinafter referred to as "ADSERA" or the "Company") attaches importance to the protection of your personal data and special categories of personal data. Accordingly, acting as Data Controller, the Company takes all due care to process your personal data in compliance with the Personal Data Protection Law No. 6698 ("PDP Law") — by using, recording, storing, updating, transferring and/or classifying it within the framework described below and in connection with its business purposes.

Within this scope, all technical and administrative measures are taken to ensure an appropriate level of security in order to prevent unlawful processing of and access to your personal data and to safeguard it, in accordance with the laws and regulations enacted to protect the fundamental rights and freedoms of individuals, primarily the privacy of private life.

This notice is addressed to all natural persons whose personal data is processed by the Company on our websites and in the course of operating our corporate processes.

Personal information recorded while visiting our website is processed in accordance with the legislation on the protection of personal data. However, no guarantee can be given regarding data security on other websites linked from ADSERA's website (adsera.co). You should carefully review the data security policy of the relevant page.

Legal Nature and Scope

Pursuant to Article 10 of the PDP Law titled "Obligation of the Data Controller to Inform", persons whose data is processed must be informed when their consent is obtained.

Under the PDP Law, personal data means any information relating to an identified or identifiable natural person ("Personal Data"); its special category, Special Categories of Personal Data, means data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data ("Special Categories of Personal Data"). Within this Notice, the explanations made for your Personal Data also cover your Special Categories of Personal Data.

Pursuant to Article 3/1-ı of the PDP Law, ADSERA is the "Data Controller". In this context, the obligation to inform requires that data subjects be informed about the identity of the data controller, the purposes of processing, the recipients of the personal data and the purposes of transfer, the legal grounds for collection, to whom and by which methods data may be transferred, and the rights listed in Article 11 of the PDP Law such as updating, erasure or anonymisation that the data subject may exercise against the data controller.

With this Notice on the Processing of Personal Data and pursuant to Article 10 of the PDP Law, ADSERA, as Data Controller, informs data subjects that it processes their personal data within the limits and conditions set out in the legislation.

This notice does not cover the data processing activities that ADSERA carries out as a "data processor" or "sub-processor" in the context of the IT services it provides.

Identity of the Data Controller

Article 3/1-(ı) of the PDP Law defines the data controller as "the natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system". In this context, the data controller is ADSERA, whose web pages listed above you have visited.

Address: Maslak Mah. AOS 55. Sk. 42 Maslak B Blok No:4 İç Kapı No: 542 Sarıyer / İstanbul

Website: https://www.adsera.co/

Phone: +90 850 304 37 10

E-mail: [email protected]

Data Processor

Article 3/1-ğ of the PDP Law defines the "Data Processor" as the natural or legal person who processes personal data on behalf of the data controller based on the authority granted by it.

Natural and legal persons who carry out, on behalf of the data processor and the data controller, the operations entrusted to them by the data processor are considered "sub-processors".

Purposes of Processing Your Personal Data

Your personal data is processed in line with the principles of the PDP Law for the following purposes:

1. Informing our customers about the products and services offered by ADSERA and providing better opportunities to benefit from them;
2. Improving the quality of the products/services offered, customising them and making recommendations according to our customers' needs, preferences and usage habits in line with our customer satisfaction priorities;
3. Correctly planning and executing our commercial partnerships and strategies;
4. Helping our customers protect, manage and transfer their digital assets and the rights related to them;
5. Carrying out online and tele-sales transactions of our online services for our customers;
6. Enabling customers to use and manage our online services;
7. Verifying and managing user identities;
8. Ensuring the legal, commercial and physical security of our Company and our business partners;
9. Ensuring the highest level of personal and commercial data security, establishing the appropriate IT infrastructure and databases, and taking administrative and technical measures;
10. Developing the services offered on our Company's websites, responding to future requests and complaints, resolving errors occurring in this medium, and ensuring compliance with the Privacy Policy published on our websites;
11. Carrying out, by the relevant business units, all necessary work for the Company's commercial activities — including campaign, discount, promotion, additional and/or side benefit offers and the assignment of consultants or support specialists — and running the related business processes;
12. Adding new features to the products and services offered to customers and developing existing ones;
13. Creating and presenting the most beneficial product, service and price offers to customers across all marketing and commercial channels, including our digital business partners (Google, Facebook, Instagram, etc.) and tele-sales operations;
14. Determining the Company's strategies and ensuring the corporate functioning of the Company in line with our strategic plans and goals.

These purposes are pursued within the personal data processing conditions set out in Articles 5 and 6 of the PDP Law.

Our Principles on Processing Personal Data

As ADSERA, the principles we adopt in processing personal data are:

1. Processing lawfully and in good faith;
2. Striving to keep data accurate and up to date;
3. Processing for specific, explicit and legitimate purposes;
4. Being relevant, limited and proportionate to the purposes of processing;
5. Retaining data only for the period stipulated in the relevant legislation or required for the purpose of processing.

How Personal Data Is Processed

Your data is kept and processed at ADSERA only with your consent or where one of the lawful grounds exists. Your explicit consent is not required for processing where one or more of the following applies:

1. Cases expressly provided for by law (personnel file, invoicing, etc.);
2. Operations directly related to the establishment or performance of a contract (contract, consent form, etc.);
3. Data made public by the data subject (unilateral sharing, business cards, social networks, etc.);
4. Legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed.

To Whom and for What Purpose Personal Data May Be Transferred

Your personal data collected and processed by our Company in accordance with the PDP Law may be transferred, for the purposes explained and under confidentiality agreements, within the scope of the PDP Law and other legislation on the security of personal data, to:

1. Our business partners, suppliers and shareholders;
2. Our authorised sales partners acting in the name and on behalf of our Company;
3. Legally authorised public institutions and private persons;
4. Our solution partners in Turkey and abroad, and companies and organisations acting as data processors and sub-processors assisting in performance.

Method and Legal Basis of Collecting Personal Data

Depending on the service, product or commercial activity carried out by our Company, your personal data may be collected and processed — verbally, in writing or electronically — through automatic or non-automatic methods via call centre, website, social media channels, mobile applications and similar means, in accordance with Articles 4, 5 and 6 of the PDP Law.

Your personal data is obtained in any verbal, written or electronic medium for the purposes stated above, so that the products and/or services offered by the Company can be provided within the defined legal framework and the Company can fully and correctly fulfil its contractual and statutory obligations. Personal data collected on this legal basis may also be processed and transferred for the purposes stated in this Notice, within the processing conditions and purposes set out in Articles 5 and 6 of the PDP Law.

How We Protect Personal Data

All necessary technical and administrative measures are taken to protect the personal data collected by ADSERA, to prevent it from falling into the hands of unauthorised persons, and to prevent harm to our customers and prospective customers. In this context, software is kept compliant with standards, third parties are carefully selected, and our Privacy Policy is observed within the company.

Rights of the Data Subject and Applications

If, as a data subject, you submit your requests regarding the rights listed in Article 11 of the PDP Law to our Company through the methods set out below, our Company will conclude the request free of charge within thirty days at the latest, depending on its nature. However, where a fee is prescribed by the Personal Data Protection Board, the fee in the tariff determined by our Company will be charged. Furthermore, since applications regarding personal data must be made by the data subject in person under the applicable legislation, only the part of your application concerning you will be answered; applications made on behalf of third parties such as your spouse, relative or friend will not be accepted. You do have the right to apply on behalf of persons under your custody or guardianship.

In this context, by applying through the contact channels announced on our website, data subjects have the right to:

1. Learn whether their personal data is processed;
2. Request information if their personal data has been processed;
3. Learn the purpose of processing and whether the data is used in accordance with that purpose;
4. Know the third parties in Turkey or abroad to whom their personal data has been transferred;
5. Request correction of incomplete or inaccurately processed personal data and request that the correction be notified to the third parties to whom the data has been transferred;
6. Request erasure or destruction of personal data where the reasons requiring processing have ceased to exist, even though it was processed in accordance with the PDP Law and other relevant laws, and request that this be notified to the third parties to whom the data has been transferred;
7. Object to a result arising against the person through the analysis of processed data exclusively by automated systems;
8. Claim compensation for damages suffered due to unlawful processing of personal data.

Making an Application

Pursuant to Article 13/1 of the PDP Law, you may submit your request to exercise the rights set out in Article 11 of the same law to [email protected] via a registered electronic mail (KEP) address or the e-mail address you previously notified to our Company and which is registered in our system, or in writing in person, through a notary public or by registered mail with return receipt.

The application must include:

1. Your name, surname and — if the application is in writing — your signature;
2. Your Turkish ID number if you are a citizen of the Republic of Turkey; your nationality, passport number or ID number (if any) if you are a foreign national;
3. Your residential or workplace address for notification;
4. Your e-mail address, telephone and fax number for notification, if any;
5. The subject of your request.

Information and documents relating to the subject must be attached to the application.

Obtaining and Processing Personal Data

1. Processing of Personal Data of Website Users (Online Visitors)

Users of the websites may submit information such as name, surname, e-mail, telephone, profession and product of interest by filling in membership, support, contact and other forms on the websites operated by ADSERA in order to make a request.

Users acknowledge that they share this personal data on the site entirely of their own free will. This personal data will be processed solely for the purpose of evaluating and/or fulfilling the request and/or membership submitted by the user.

In addition, "traffic information" consisting of the IP address of users visiting the website, the start and end time of every service provided (even a trial account), the type of service used, the usage limit and/or quota and/or usage right of the service, the amount of data transferred and subscriber identity information (if any) is also processed pursuant to Law No. 5651.

2. Processing of Personal Data of Suppliers and Customers

ADSERA processes a minimum level of personal data belonging to natural-person suppliers, supplier employees and/or supplier representatives, and the representatives and officers of customer organisations, for the purpose of monitoring and executing product, service or goods procurement processes.

The relevant data (name-surname, telephone, e-mail, profession) is kept in database environments, exchange environments, CRM environments containing customer information and/or on company telephones.