Protection of Personal Data

We, as T. Garanti Bankası A.Ş., are showing respect to security of your personal data and your right of privacy, and giving importance to protection of them. Accordingly, we are presenting to your kind consideration this information text prepared in order to inform you about processing, transfer, storage and destruction of your personal data you have shared with us in the software developer development portal process of T. Garanti Bankası A.Ş., and about use and protection of your personal data pursuant to and under the Personal Data Protection Law no. 6698 (“KVKK” / “Law”).

As described in this information text, your personal data and special personal data may be registered, archived, updated, transferred and classified pursuant to and under the related laws and regulations, and be processed by any means as listed in the Law and other applicable laws.

I. Data Supervisor

This disclosure is issued by T. Garanti Bankası A.Ş. as and in the capacity of data supervisor in accordance with the Personal Data Protection Law no. 6698 and other applicable laws and regulations. As per the Law, “Data Processing” means all kinds of actions taken on data, such as acquisition, collection, registration, storage, update, classification, and sharing with or transfer to third parties to the extent permitted by applicable laws, of personal data fully or partially by automatic ways or non-automatic ways, providing that they are a part of any data registration system.

We, as Data Supervisor, are keeping and storing all kinds of personal data disclosed by you in strict compliance with the applicable laws and regulations and by taking all kinds of technical and administrative actions and measures for providing security for your personal data at an appropriate level.

II. Personal Data Collected by Us

Within the frame of relations you are going to establish with our Bank, personal data which vary according to the type, kind and history of the relations between the Bank and the related person, and the method of collection of data, and depending on the following purposes, and are processed in accordance with the principles set down in the Law and in our Bank’s Personal Data Processing and Protection Policy, are generally comprised of the following data, not however being limited thereto:

III. Personal Data Collection Method

Your personal data are collected within the software developer development portal provided by T. Garanti Bankası A.Ş., and may also be obtained via internet site prepared and used specifically for that process.

IV. Personal Data Processing Purposes and Legal Causes

Your personal data obtained by T. Garanti Bankası A.Ş. are processed for the following purposes and legal causes:

Our Processing Purposes	Legal Causes
Identification of the related person, and answering the questions asked to our Bank, and evaluation and assessment of opinions and suggestions	- It is required for the Bank’s performing its legal obligations and liabilities - It is clearly specified in the applicable laws - Data processing is essentially required for establishment, use or protection of a right - In the case of existence of explicit consent
Analysis and development of bank systems, and conduct of information security processes, and establishment, management and use of information systems infrastructures	- It is required for the Bank’s performing its legal obligations and liabilities - Data processing is essentially required for legitimate interests of the Bank, providing that the fundamental rights and freedoms of the related person are not damaged
Establishment of business processes and activities of the Bank, and planning and conduct of operational processes and purchasing operations	- Personal data belonging to parties to contract are required to be processed, providing that it is directly associated with establishment or enforcement of contract -Data processing is essentially required for legitimate interests of the Bank, providing that the fundamental rights and freedoms of the related person are not damaged
Conduct of lawsuits and execution proceedings and handling and follow-up of other legal processes the Bank is involved in	- It is required for the Bank’s performing its legal obligations and liabilities - It is clearly specified in the applicable laws
Planning, supervision and implementation of our corporate sustainability, corporate governance, strategic planning and information security processes	- It is clearly specified in the applicable laws - It is required for the Bank’s performing its legal obligations and liabilities - Data processing is essentially required for legitimate interests of the Bank, providing that the fundamental rights and freedoms of the related person are not damaged

Your personal data are obtained in all kinds of verbal, visual, written and electronic media, and for the purposes cited hereinabove, and accordingly, for full performance of all of the contractual and legal obligations and liabilities of T. Garanti Bankası A.Ş. as required. Legal cause of collection of your personal data is KVKK and other applicable laws pertaining thereto. Your personal data are processed by T. Garanti Bankası A.Ş. only in case of your explicit consent pursuant to Article 5/1 of KVKK or by automatic and non-automatic ways and methods in reliance upon legal reasons pursuant to Article 5/2 of KVKK.

V. Transfer of Personal Data

Where it is essentially required by laws and permitted by you, your personal data may be shared with third party persons or entities in line with the purposes set down in Section III of this Information Text, providing that all kinds of technical and administrative actions and measures are taken for appropriate security level pursuant to and under KVKK and other applicable laws. Such persons and entities may vary depending on the revisions in the applicable laws and regulations, but are generally the following parties.

Your personal data are transferred to the following parties for the following purposes and legal reasons:

Data Recipients	Our Transfer Purposes
Public administrations and entities and juridical authorities legally authorized to get information	Legal reporting purposes, conduct of regulation and supervision activities, management of complaints and legal processes, etc. legal reasons

VI. Your Rights for Protection of Personal Data

At any time you wish, you may apply to our Bank and:

a) Ask whether your personal data are processed or not, and if processed, learn the purpose of processing and whether they are used for the intended purposes or not, and if processed, request information thereabout; and

b) Learn the identity of third parties with whom your personal data are shared in Turkey and abroad in accordance with the laws; and

c) If you think your personal data are processed deficiently or inaccurately, may request completion or correction of them; and

d) Request the deletion or destruction of your personal data within the frame of terms and conditions set down in Article 7 of the Law; and

e) Request that your requests in subparagraphs (c) and (d) hereinabove be notified also to third parties to whom your personal data are transferred, for their taking the same actions; and

f) Raise an opposition against any consequences which may arise against you due to analysis of your personal data by automatic systems, or if you think your personal data are registered or used in conflict with laws, and you have incurred damages for that reason, you may claim compensation of your damages.

In the event that you use your rights to ask whether your personal data are processed or not, and if processed, request information thereabout, and have access to and request your personal data, and learn the purpose of processing and whether they are used for the intended purposes or not, and learn the identity of third parties with whom your personal data are shared in Turkey and abroad in accordance with the laws, the requested information will be provided to you in writing in electronic media or by using the communication data supplied by you.

VII. Data Security and Right of Application

Your personal data are carefully protected to the extent of technical and administrative opportunities, and the security measures required thereinfor are taken at a level appropriate for probable risks by also considering the technologic opportunities.

You may transmit your requests under KVKK:

- By personally delivering them in writing by hand to our Head Offices or branches, or

- Via a notary public, or

- With secure electronic or mobile signature, to garantibankasi@hs02.kep.tr KEP address, through the registered electronic mail address or your electronic e-mail address registered in our system.

If an application filed by you for the aforesaid purposes causes an additional cost, you may have to pay the amount of fee over tariff rates determined by the Personal Data Protection Board. Your requests in your application will be responded as soon as possible and in any case within 30 (thirty) days, depending on the kind of request

* In the case of a change in personal data inventory work, our Bank will update this information text.