MULTINET KURUMSAL HIZMETLER A.S.

INFORMATION NOTICE FOR USERS

PURSUANT TO PERSONAL DATA PROTECTION LAW NO. 6698

PREAMBLE

As Multinet Kurumsal Hizmetler A.S., ("Multinet"/ "Company"), we show maximum responsibility about security of your personal data and accordingly, Multinet attaches great importance on processing and storage of all kinds of personal data of all real persons ("Data Subjects") in the best way and with care. Pursuant to Personal Data Protection Law No. 6698 ("Law") and applicable legislation, personal data owned by you and transferred or provided to our Company and/or obtained externally by our Company that acts as Data Controller may be processed for the purposes described below within the limits. This Multinet Kurumsal Hizmetler A.S., Information Notice for Users Pursuant to Personal Data Protection Law No. 6698 ("Information Notice") has been prepared in accordance with Article 10 "Data Controller's Obligation to Inform" in connection with your personal data processed by Multinet as "Data Controller".

In case you disclose personal data of the third persons to our Company, please note that you have obligation to obtain explicit consent of the Data Subjects in accordance with the Law in connection with the collection, processing and transfer of the data to us and in case any processing and/or transfer activity is without explicit consent, you have obligation to prove that processing and/or transfer conditions that do not require explicit consent are in place and provide information accordingly.

1. DATA CONTROLLER

Pursuant to sub-paragraph (i), paragraph 1 of article 3 in the Law, Data Controller means "real or legal person who is responsible to determine the objectives and means of processing personal data, and to establish and manage the data registry system". In this framework, our Company, Multinet, is Data Controller.

2. METHOD OF COLLECTING PERSONAL DATA

Our Company obtains personal data directly from the Data Subjects or indirectly from the third persons or from the data that are made public by the Data Subject for this purpose.

In addition, service provided or product supplied by Multinet varies depending on the business activity/ relationship between Multinet and Data Subject, and your personal data may be collected via channels specified below and in Table-1, through automatic or non-automatic means; in verbal, written or electronic for via call centre, internet site, social media, mobile applications and similar other means in accordance with the Law;

- with digital application forms published in printed or electronic form / survey;

- through negotiations held during execution of an agreement;

- through inquiries of Data Subjects sent via e-mail, courier, call centre and similar other means,

- during researches conducted by the Company and checks performed to confirm the information communicated by the data Subjects;

- via channels operated in the name of the Company through various social media channels,

- through mobile applications, QR-code and similar other means,

- via all kinds of communication channels with e-mail correspondences, short messages and multimedia messages, information forms and other communication methods.

3. YOUR PERSONAL DATA PROCESSED, METHOD OF COLLECTION, PURPOSES OF PROCESSING, DURATION OF STORAGE
AND LEGAL REASON

Your personal data that are in possession of our Company and specified in Table-1 below may be stored as long as you benefit from Multinet services and for the duration specified in the Law and below upon expiry of the existing relationship with Multinet and they may be processed for the purposes explained below and for the legal reasons.

Personal Data processed may vary depending on the Data Subject, Categories of Personal Data and Personal Data listed below may vary for each Data Subject and accordingly, they may vary depending on nature of the relevant service.

Table 1- Personal Data Processed and Categorized by Data Subject, Method of Collection, Purpose of Processing,

Storage Period and Legal Reason of Processing

DATA SUBJECT	DATA CATEGORIES AND PROCESSED PERSONAL DATA	METHOD OF COLLECTING PERSONAL DATA	PURPOSES OF PROCESING PERSONAL DATA	STORAGE PERIOD	LEGAL REASON OF PROCESSING PERSONAL DATA
Users	Identification Details: Name- Surname, Birth Date, Gender,TCKN¹	• MultiPay Mobile Application. • Agreement(s) with the Customer.	• Performance of Sales of Goods and Services • Performance of Operational Processes About Goods/ Services • Recommendations and Evaluations About Improvement of Business Processes • Performance of Activities Aimed at Ensuring Business Continuity • Performance of Contractual Processes. • Performance of Operations in Compliance with the Legislation • Performance of Communication Processes. • Monitoring of Inquiries / Complaints • Ensuring Security of Data Controller Operations • Providing Information to Authorized Persons, Competent Organizations and Institutions • Conducting Risk Management Processes • Pursuing and Conducting Legal Affairs • Internal Audit/ Investigation / Intelligence Activities • Finance and Accounting Activities	During the term of legal Relationship with the Company and until the 10 th (tenth) Year starting from the date the legal relationship with the company ends	Article 5.2.c of the Law, 5.2.ç and 5.2.e: "In case it is required to process personal data of contractual parties provided that it is directly related with the execution and performance of an agreement", "Processing of personal data for the performance of legal obligations", "Personal data processing is compulsory to establish, exercise and protect a right".
	Contact Information: E-Mail Address, Telephone Number	• MultiPay Mobile Application. • Agreement(s) with the Customer. • Multinet Desktop-Help Line, Relevant Social Media Means.
	Location Information: - Mobile Application "Bugün Buradayim!" TatliPara Campaign Location Notification. - Real-time location data automatically obtained through the mobile device settings upon granting access to location services (GPS signal, POI data, physical location where beacon signal is received, city/district information, etc.).	• MultiPay Mobile Application.	• Performance of Marketing Activities and Analyses • Performance of Processes for Product/ Service Marketing • Conducting Advertisement / Campaign / Promotion Processes Planning and Performance of Activities Required for Customization of Products and Services Offered by the Company and/or its Business Partners based on your preferences, usage habits, needs and/or location, including the sending of instant notifications based on your preferences, offering the same to you, and conducting related promotion activities. • Planning and Performance of the Processes Aimed at Creating and Improving Loyalty About Products and/or Services Offered by the Company, • Planning and Performance of User/ Customer Satisfaction Activities.		Article 5.1 of the Law:"Explicit Consent".
	Financial Information: Bank/ Credit Card Information for "Top Up" Deposits	• MultiPay Mobile Application.
	Marketing Information: Purchase History Details	• MultiPay Mobile Application. • Multinet Desktop-Help Line, Relevant Social Media Means.
	Emotional State / Profiling Information: Emotional Analysis Information	• Multinet Solution Center
	Habits / Preferences: -Nutritional Habits and Preferences, Budget, Payment Method Preference -Career and Lifestyle -Eating and Drinking Habits -Transportation Preference and Budget -Sports Habits -Shopping and Usage Habits, Preferences -Activities, Hobbies and Interests -Event Preferences -Technological Innovation Approaches -Travel / Accommodation Frequency and Preferences -Gift Preferences	• MultiPay Mobile Application (via surveys)

¹a unique personal identification number that is assigned to every citizen of Türkiye. This data is processed only for users who make individual uploads via MultiPay and prefer to have their TCKN to be shown on their invoices..

Your explicit consent shall not be sought for the processing of your personal data
when:

Compulsory data processing for legal interests of the Data Controller/ Company provided that fundamental rights and freedoms of Data Subject are not violated.
Compulsory data procession necessary for vesting, using or protecting any right;
Personal data are made public by the Data Subject,
Compulsory data processing for the fulfilment of a legal obligation by the Company acting in the capacity of Data Controller,
It is required to process personal data of contractual parties in case such processing is directly related with execution or performance of an agreement;
Compulsory disclosure for protecting life and physical integrity of a person or any other person in case the relevant person is not able to provide consent due to actual incapability or his/her consent is not valid under the applicable law;
it is clearly required in the Laws;

For detailed information on the purposes of processing your personal data by Multinet, see Multinet Up Personal Data Protection and Processing Policy.

4. PURPOSES OF TRANSFERRING PERSONAL DATA PROCESSED

Your personal data provided to Multinet and provided in Table 1 may be transferred for the purposes of ensuring that activities of our Company are performed in accordance with the applicable legislation and agreements and performance of the required operational activities by our business units.

For detailed information on the purposes of processing your personal data by Multinet, see Multinet Up Personal Data Protection and Processing Policy.

5. TRANSFER OF PERSONAL DATA IN THE COUNTRY AND ABROAD

Our Company acting in the capacity of Data Controller informs you about the transfer personal data processed to third persons within the scope of the obligation to inform. However, identification of the third persons receiving the personal data may be considered as trade secret, it shall not be disclosed one by one pursuant to our Company's confidentiality obligation and these persons shall be disclosed solely as groups by activity/ sector categories.

(i) Transfer of Your Personal Data In the Country

The aforementioned personal data may be transferred to the relevant internal departments, subsidiaries, business partners, suppliers, Company officials, shareholders, and governmental authorities, independent audit companies, contracted attorneys and other third persons in case of legal obligation, in accordance with the Law and for the purposes described above.

(ii) Transfer of Your Personal Data Abroad

By ensuring one of the appropriate safeguards provided under the Law, including the execution of standard contract or contracts with contractual business partners, or by fulfilling any of the other transfer conditions set forth in Article 9 of the Law regarding the transfer of personal data abroad, your personal data may be transferred abroad and/or stored abroad. Within the scope of the purposes stated above, including the administration of the Company, the conduct of business operations and the implementation of Company policies, your personal data may be transferred abroad and/or stored abroad by being input into cloud based applications, cloud solutions and backup systems whose databases are located abroad, such as MS Office and CRM applications, in countries with or without an adequate level of protection.

In addition, your personal data may also be transferred abroad and/or stored abroad because the servers of our business partners located in Türkiye, as well as those of our business partners located abroad, may be located outside Türkiye.

6. COOKIES

"Cookies" are used based on your "explicit consent" in order to collect, process, disclose to third persons and securely store your browsing details and/or use and browsing history over the website within the limits of the legal obligations specified in this Information Notice for the purpose of ensuring that visitors use Multinet website, mobile application and other platforms with increased efficiency in parallel with their interests and requirements, offering customized experience to visitors, making special promotions to visitors, offering promotions and marketing campaigns, improving contents of websites and/or our Company's mobile application for visitors and/or determining preferences/ priorities of visitors.

A cookie is a small text or image files consisting of letters and numbers stored in the device (computer, tablet, mobile phone, etc.) or network server used via web browsers, by the websites visited. The main objectives of using cookies in Multinet website are as provided below:

=> Improving the services offered to you through improvement of the functionality and performance of the Multinet website and other platforms,

=> Improving the Multinet website and other platforms, offering new features over the websites and customizing the features offered based on your preferences,

=> Ensuring the legal and commercial security of Multinet website and other platforms, you and our company.

For detailed information about cookies, see Cookies Policy.

7. SECURITY OF YOUR PERSONAL DATA

Our Company takes technical and administrative measures to:

a)prevent processing of the personal data in breach of the law,

b)prevent illegal access to personal data;

c)ensure safe storage of the personal data

for the purpose of establishing the proper security level during the performance of data processing activities.

Further, it is important that your personal data are accurate and up to date. In case any personal data is not accurate or up to date, you have right and obligation to contact our Company immediately. Our Company shall update or delete or destroy the data in question immediately.

8. YOUR RIGHTS ABOUR PROTECTION OF YOUR PERSONAL DATA (RIGHTS OF DATA SUBJECT)

Pursuant to the applicable article of the Law, you have right to:

(i)Get information as to whether personal data are processed or not;

(ii)Get information if your personal information is processed;

(iii)Get information on the purpose of processing personal data and as to whether they were used in accordance with the purpose;

(iv)Get information on local and/or foreign third parties who were transferred personal data;

(v)Request correction if personal data were processed inaccurately or incompletely;

(vi)Request deletion or destruction of your personal data,

(vii)Request correction in case your personal data are processed in an incomplete or inaccurate manner and request notification of such corrections to the third persons who received your personal data;

(viii)File objection against unfavourable results obtained through analysis using automatic systems only;

(ix)Claim compensation of losses and damages that may arise from illegal processing of personal data

9. CONTACT US

You can forward your request for exercising the aforementioned rights under the Law and your questions about your personal data in Application From "Contact Us" section in our website by using your registered electronic mail (KEP) address, secure electronic signature, mobile signature or electronic address previously notified to our Company and recorded by our Company, or complete the application form;

(i)make an application to Multinet in person or send the form with wet signature to Esentepe Mah. Kore Sehitleri Cad. Propa Plaza No:4-6 K:3 Sisli / Istanbul, Türkiye address (via notary public or by reply-paid registered mail) or send the relevant application form to

(ii) multinet.hukuk@hs02.kep.tr or kvkk@multinet.com.tr

For information on application procedure, see Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ

Our Company will process your requests free of charge in the shortest time possible and latest within 30 (thirty) days depending on the nature of your request. However, the following fee may be charged in case any cost is incurred during the processing of application. Our Company reserves right to verify your identity before responding any request.