Protection of Personal Data Disclosure Statement

Penta Teknoloji Ürünleri Dağıtım Ticaret A.Ş. ("Penta") respects your privacy and prioritizes the security of your data.Within this context, this document is intended to inform and clarify you regarding the Law on the Protection of Personal Data No. 6698 (“Law", or "LPPD”) and other applicable legislations.

Information

The Law on the Protection of Personal Data has been enacted on March 24, 2016, and came into force after being published in the Official Gazette dated April 07, 2016. However, according to the article 32 of the Law titled Effectiveness (Yürürlük), articles numbered 8, 9, 11, 13, 14, 15, 16, 17, and 18 of the Law came into force as of October 7, 2016.

The Law; has been enacted in order to protect the fundamental rights and freedoms of individuals, especially the right of privacy, and to regulate the responsibilities of legal entities and natural persons which process personal data, and the procedures and principles these legal entities and natural persons must comply with while processing personal data. Therefore, this document fulfills the obligation of disclosure resulting from the Law, and “The Protection of the Personal Data and Personal Data Sharing Permit” is submitted for the information and examination of the visitors.

Penta acknowledges, declares and undertakes that it shall under no circumstances sell, rent or let third parties use your name, e-mail address, business and home address, phone number and other personal data provided through forms on this website.

means any operation performed upon personal data, such as collection, recording, storage, maintenance, alteration, rearrangement, disclosure, transfer, acquisition, dissemination or otherwise making available, classification or blocking of personal data wholly or partially, by automatic means or nonautomatic means, where it is part of a filing system. Processing your personal data refers to all kinds of processes that are performed upon data such as collection, recording, storage, maintaining, alteration, rearranging, disclosure, transferring, acquisition, dissemination, classification or blocking its usage through fully or partially automatic, or non-automatic means provided that it is a part of any data filing system. Data Controller and Representative

In accordance with the Law, your personal data can be processed by Penta as the data controller within the scope clarified herein. Penta is responsible for setting up and managing data filing system and determining processing purposes and means of personal data recorded in its database. Penta declares that it shall register as the data controller and acquire the data controller title once the Data Controller Registry starts.

Purpose of Processing Personal Data

Your personal data is processed as per the articles 5 and 6 of the Law, in order to and including but not limited to; carry out necessary operational activities within our company to ensure that products and services provided by our company are offered to you; perform necessary operations with relevant business units and business associates to provide you with products and services suited to your consumption and purchase habits; ensure the rights of natural persons through carrying out human resources management by our Company; take necessary actions to make, implement, and execute commercial decisions by our Company; ensure the legal security of the natural persons our Company is associated with, and of our Company, arising from these associations, and for similar purposes.

Your Personal Data can be processed by Penta acting in its capacity as the Data Controller without further seeking your express consent in the event that:

• It is necessary for the protection of life or bodily integrity of a person himself/herself, or of someone else, who is unable to express his/her consent due to actual impossibility or whose consent is not legally recognized.
• It is necessary to process the personal data belonging to the contracting parties, on the condition that it is directly related to the fulfillment of the contract.
• It is mandatory in order to meet our obligations as the data controller.
• It is publicised by the related person himself.
• Processing of data is obligatory in order to establish, exercise or protect a right.
• Processing data is necessary for the legitimate interests of the data controller, provided that fundamental rights and freedoms of the relevant person are not impaired. Your personal data can be used, based upon any of the aforementioned conditions, for the purposes specified below.

Your personal data can be processed for the purposes below:

• Communicating with you or others as a part of the business.
• Sending you important information regarding the changes to our terms of service, electronic services, and other administrative pieces of information.
• Making quality, training and security improvements (e.g., related to the recorded or monitored phone calls made to our contact numbers)
• Resolving complaints and putting data access or data correction requests into the process.
• Complying with applicable laws and regulatory obligations in force (including those outside of your country of residence); complying with the legal process and responding to the incoming demands from official and public authorities (including those outside of your country of residence), including the anti-money laundering and counter-terrorism laws.
• Managing our infrastructure and conforming to internal policies and procedures including commercial activities and auditing, accounting and finance; invoicing and collections; information technology systems; data and website hosting; business continuity and records, document and print management.
• Determining and defending legal rights; protecting the operations of our Company or its business partners, our rights, privacy, property or safety and/or protecting the aforementioned assets of you or others and utilizing available remedies, or limiting our losses.
• Conducting market research and analysis, including satisfaction surveys.
• Facilitating social media sharing functionality.
• Personalising your electronic services experience by providing you with information and advertisements tailored to you.

Your collected personal data can be transferred to our business associates, suppliers, shareholders, Yıldız Holding and its participations, legally authorised public bodies and natural persons for the purposes of; ensuring legal and commercial security of our Company and persons in a business relationship with our Company; enabling necessary operations carried out by our business units in order to make you benefit from products and services offered by Our Company; customizing and recommending products and services provided by our Company according to your likes, usage habits and needs; determining and implementing commercial and business strategies of our Company and ensuring the execution of the human resources policies of our Company within the scope of the personal data processing conditions and purposes pursuant to the articles 8 and 9 of LPPD.

Method and Legal Grounds of Collecting Personal Data

Your personal data is collected by our Company in order to carry out our commercial operations through various channels and based on various legal grounds. Your personal data that has been collected with this legal reason can also be processed and transferred for purposes specified in articles (b) and (c) of this document within the scope of personal data processing conditions and purposes set out in the articles 5 and 6 of LPPD.

Rights of the Personal Data Owner as Set Forth by Article 11 of LPPD

As personal data owners, in the event that you submit your requests regarding your rights to our Company by the methods laid out below in this Disclosure Statement, our Company shall conclude the request as soon as possible and within thirty days depending on the nature of the request, free of charge. However, in the case that a fee is set forth by the Personal Data Protection Board, the fee will be charged at the rate determined by our Company. Within this context, data owners have the right to;

• Learn whether personal data is being processed,
• Request information regarding personal data if it has been processed,
• Learn the purpose of processing personal data and whether processed data is being used in accordance with its purpose,
• Know the third parties to whom personal data are being transferred within the country or abroad,
• Request correction of personal data in the case that it was processed incompletely or improperly, and request that the process carried out in this context to be notified to the third parties to whom the personal data had been transferred,
• Request the deletion or destruction of personal data in the event that the reasons for its processing are no longer present, despite having been processed in accordance with the provisions of the LPPD and other related laws, and request that the process carried out in this context to be notified to the third parties to whom the personal data had been transferred,
• Object to the occurrence of a result to the detriment of the person himself/herself, by means of analyzing the processed data exclusively through automated systems,
• Seek compensation for his/her loss in the case that personal data owner suffers a loss due to the unlawful processing of data.

In accordance with the article 13, paragraph 1 of LPPD, you can submit your requests to our Company regarding the exercise of your aforementioned rights in written form or by means of any other methods determined by the Personal Data Protection Board. By reason of the fact that the Personal Data Protection Board has not determined a method at this stage, you must submit your applications to our Company in written form, in pursuance of the LPPD. Within this framework, channels and methods through which you will submit your application in written form to our Company, within the scope of the article 11 of LPPD, are specified below:

In order to exercise your above-mentioned rights, you can submit your request which includes your necessary identification information and your explanations regarding the specific right you request to exercise among the rights set forth in the article 11 of LPPD; by filling in the form and delivering a signed copy of the form to the Penta Penta Teknoloji A.Ş. Organize Sanayi Bölgesi Nato Yolu 4.Cadde No:1 Yukarı Dudullu - Ümraniye/İSTANBUL with your identity documents personally, via notary public, through other methods set out in the LPPD or by sending the related form to the e-mail addresspentateknoloji@hs03.kep.tr with a secure electronic signature.

HEADQUARTERS