FİBA TİCARİ GAYRİMENKUL YATIRIMLARI A.Ş. INFORMATION ABOUT THE LAW ON PERSONAL DATA PROTECTION

Fiba Ticari Gayrimenkul Yatırımları A.Ş. takes safety measures at the highest level possible in order to enable that your personal data are collected, stored and shared in accordance with the law and to protect your privacy.

Our purpose is to inform you in the most transparent way about the way your personal data are collected, the purposes of processing, with whom they are shared, legal reasons and your rights pursuant to the 10th article of Personal Data Protection Law numbered 6698 and in line with your satisfaction.

1. a) Data Supervisor

Pursuant to Personal Data Protection Law numbered 6698 (“Law numbered 6698”), your personal data shall be collected and processed for the purposes mentioned below by Fiba Ticari Gayrimenkul Yatırımları A.Ş. (“THE COMPANY”) as data supervisor.

1. b) For Which Purposes the Data Can Be Processed

THE COMPANY may collect personal data in the categories such as identity information, contact information, customer information, customer transaction information, transaction safety information, legal transaction, compatibility information and marketing information from the parties such as its customers, employees, potential customers, employee candidates, business partners and suppliers.

Your collected personal data shall be processed for the following purposes;

– In order to provide COMPANY’s products and services to you, to fulfil our obligations towards you, to arrange records and documents, to comply with obligations such as data storage, reporting, informing, taxes etc. stipulated by local and international legal regulations,

– In order to offer advertisements, campaigns, advantages and other benefits specific to you for sale and marketing activities to improve the quality of services and products,

– In order to communicate with you for sending necessary information related to the requirements and systemic structure of data processing, the necessity of data processing support services and these services and products,

– In order to carry out traffic measurement, statistical analyses, segmentation/profiling and CRM works for sale and marketing activities,

– In order to measure and improve customer satisfaction, to manage complaints, to receive your opinions and suggestions about new services and products, to receive your problem and fault notifications, to inform you regarding products and services, your complaints and requests,

– In order to take your orders, to make payment transactions, to send products by making logistical cooperation with third parties, to offer products and services which may draw your attention, for online behavioural advertising and marketing, customer portfolio management, to measure and develop service quality, for communication, optimization, audit, risk management and control, promotion, analysis, to determine fields of interest, for scoring, profiling, marketing, sale, advertisement, communication

– In order to use your personal data for comparative product and/or service offers, modelling, existing or new product works and/or developments and all products and services to be offered to you pursuant to the law and relevant legislations regulating the works specified in the COMPANY’s Articles of Association, which is the subject of disclosing your personal data to the COMPANY,

– In order to comply with information storage, reporting, informing obligations stipulated by official institutions, to fulfil requirements of the contracts and to execute legal obligations, to which the COMPANY is subject, for benefiting from these services,

– In line with the purpose of determining and applying commercial and business strategies of the COMPANY, managing finance operations, communication, market research and social responsibility activities, purchasing operations (request, offer, evaluation, order, budgeting, contract), internal system and application management operations, legal operations carried out by the COMPANY,

– In order to review, evaluate and reply to the requests coming from official authorities and you, according to personal data processing conditions and purposes specified in the articles 5 and 6 of Law no. 6698.

1. c) To Whom and For Which Reason Processed Personal Data Can Be Transferred

Being limited to the achievement of above-mentioned purposes, your collected personal data may be transferred to

– The COMPANY’s business partners, shareholders, subsidiaries,

– The people or organisations permitted by Tax Procedure Law, Social Security Institution Legislation, Supreme Court of Public Accounts, The Law Regarding The Prevention of Laundering of Crime Revenues, Turkish Commercial Code, The Law of Obligations and other legislation provisions,

– Legally authorized public institutions and organisations, administrative agencies and legal authorities,

– Foreign companies and subsidiaries,

– Natural or legal entities from whom we obtain services in order to implement product/service comparison, analysis, evaluation, advertising and above-mentioned purposes and with whom we make cooperation, program partner institutions and organisations, the organisations with whom we have an agreement for sending messages to our customers, the courier companies which deliver placed orders to you, pursuant to personal data processing conditions and purposes specified in the articles 8 and 9 of Law no. 6698.

1. d) The Method and Legal Purpose of Personal Data Collection Verbally, in writing or electronically,

through the applications made to the COMPANY’s General Directorate or via contracted websites, through other organisations to / from which we provide / obtain support services and natural and / or legal entities to be processed under all kinds of legislations or contracts, via channels such as our website and mobile application, our call centres, social media accounts or other channels that may be established/created in the future, being in the first place;

your personal data are collected by the COMPANY for the above-mentioned purposes, pursuant to the legal regulation within the performance of the contract.

1. e) The Rights of Personal Data Owner Stipulated By Article 11 of Law no. 6698

In case, as personal data owners, you send your requests regarding your rights by using below-mentioned methods, the COMPANY shall reply to your request as soon as possible and within thirty days at the latest according to the nature of the request. Up to ten pages shall not be charged for the reply. For each page over 10 pages, 1 Turkish Lira transaction fee shall be charged. In case the reply to the application is given on a recording medium like a CD or flash memory, the price that will be requested by our company shall not exceed the cost of the recording medium.

Within this scope, the personal data owners are entitled to the following:

• To learn whether their personal data have been processed or not,
• If their personal data have been processed, to demand information regarding this,
• To learn the purpose of processing their personal data and whether those data have been used for their intended purpose or not,
• To know third parties, at home or abroad, to whom their personal data have been transferred,
• In case of incomplete or inaccurate processing of their personal data, to demand correction of them and to demand that the transaction as such is notified to the third parties, to whom personal data are transferred,
• Although they are processed pursuant to Law no. 6698 and other relevant provisions of the law, in case the reasons for processing no longer exist, to demand deletion or destruction of their personal data and to demand that the transaction as such is notified to the third parties, to whom personal data are transferred,
• To object to the emergence of a result against the person himself by analysis of processed data exclusively through automatic systems,
• In case they incur losses for the reason that their personal data are processed illegally, to demand indemnification of those losses.

You can send your request about using your above-mentioned rights, in Turkish language and writing or by using registered electronic mail (KEP) address, safe electronic signature, mobile signature or the electronic mail address that has been notified previously to the COMPANY and is registered in our system pursuant to article 13 paragraph 1 of the Law no. 6698 and The Notice On Procedures and Principles of Applying To the Data Supervisor numbered 30356 and dated 10.03.2018. Only information about the applicant shall be given during the applications and it shall not be possible to obtain information about the family members and third parties. The COMPANY reserves the right to verify your identity before replying.

In your application; the following information should be available:

1. Your name and surname and if the application is in writing, your signature,
2. Turkish identity number for the citizens of the Republic of Turkey, if you are a foreigner, your nationality, passport number or if available, your identity number,
3. Residential area for notification or your workplace address, d) If available, your electronic mail address, telephone and fax number,
4. Your request subject.
5. and if available, information and documents about the subject should also be attached to the application.

By attaching the necessary documents, you can give your applications, that you want to make in writing, to our Company’s Büyükdere Cad.1. Levent Plaza No:173/A 34330 Levent/Istanbul address, which is the data supervisor. From here, you can reach the application form. You can send your applications, that you want to make via e-mail, to the following email address: info@fibacp.com.tr   According to the nature of your request, the information and documents, that shall determine the identity, should be provided to us completely and correctly. In case the requested documents are not provided as required, there may be inconveniences in the full and qualified conduct of the researches that shall be carried out by the COMPANY based on your request. In this case, the COMPANY states that it reserves its legal rights. For this reason, your application should be sent completely and in a way that includes the requested information and documents according to the nature of your request.