ADDAYS PERSONAL DATA PROCESSING DISCLOSURE STATEMENT

Data Controller: Addays

At Addays, the security and privacy of your personal data is of utmost importance to us. In accordance with the Law on the Protection of Personal Data No. 6698 ("KVKK"), as the "Data Controller," we would like to inform you about the purposes of collecting your personal data, the legal grounds, processing methods, and your rights.

1. Personal Data Being Processed Within the scope of our services, the following personal data may be processed:

• Identity Information: Name, surname, title, etc.

• Contact Information: Phone number, email address, business address, etc.

• Customer Transaction Information: Invoice information, requests and complaints, contract details.

• Marketing and Digital Trace Data: Website usage data, cookie records, campaign performance data.

2. Purpose of Processing Personal Data Your personal data is processed for the following purposes in accordance with Articles 5 and 6 of KVKK:

• Provision and management of our web design, software development, and digital marketing services (Google Ads, SEO, etc.),

• Effective management of customer relationships and project tracking processes (via project management tools),

• Designing advertising and campaign materials and managing approval processes,

• Execution of contract processes and financial/accounting transactions,

• Receiving, evaluating, and resolving requests, suggestions, and complaints,

• Fulfilling our legal obligations arising from applicable legislation.

3. Methods of Collecting Personal Data and Legal Basis Your personal data is collected through automatic or non-automatic means via our website, email correspondence, phone calls, printed forms, digital project management applications, and face-to-face meetings.

These data are processed based on the following legal grounds:

• Directly related to the establishment or performance of a contract (KVKK Art. 5/2-c),

• Required for the data controller to fulfill its legal obligations (KVKK Art. 5/2-ç),

• Necessary for the legitimate interests of the data controller without harming the fundamental rights and freedoms of the data subject (KVKK Art. 5/2-f).

4. Recipients and Purposes of Personal Data Sharing Collected personal data may be shared for the purposes stated above with:

• Domestic and international partners providing infrastructure, server, hosting, and software support for our operations (including cloud-based project management systems),

• Legally authorized public institutions and organizations, and judicial and administrative authorities,

• Financial advisors and banks for the execution of financial and accounting processes, in accordance with the conditions and purposes of personal data transfer specified in Articles 8 and 9 of KVKK.

5. Rights of the Data Subject (KVKK Article 11) As data subjects under Article 11 of the Law, you have the following rights:

• To learn whether your personal data has been processed,

• To request information if your personal data has been processed,

• To learn the purpose of processing your personal data and whether it is being used in accordance with that purpose,

• To know the third parties to whom your personal data is transferred, domestically or abroad,

• To request correction of your personal data if it is incomplete or inaccurately processed,

• To request deletion or destruction of your personal data within the conditions specified in Article 7 of KVKK,

• To request notification of third parties to whom the personal data has been transferred about corrections, deletion, or destruction,

• To object to outcomes arising against you from the exclusive analysis of processed data through automatic systems,

• To claim compensation for damages if you suffer harm due to unlawful processing of your personal data.

You can exercise these rights by submitting your requests in writing or via other methods determined by the Personal Data Protection Board to Addays.