ACCORDING TO THE LAW ON THE PROTECTION OF PERSONAL DATA

OUR PRIVACY POLICY AND USER DISCLOSURE TEXT

(“ViaRuuma”)

1. OUR POLICY AND BASIC EXPLANATIONS REGARDING THE PROCESSING OF YOUR PERSONAL DATA

As BYC BİLİŞİM HİZMETLERİ TİCARET LİMİTED ŞİRKETİ (“Company”), which is the data controller pursuant by the Personal Data Protection Law No. 6698 (“Law”), within the scope of all websites and applications we operate under the ViaRuuma brand (“our services”), the data categories specified in the second title of this text We process your personal data within the scope of the relevant legislation with due care and sensitivity. As you can see with this clarification text, we are very transparent about which data we process. We never hesitate to provide you with all kinds of information about your personal data processed at any time. Due to the importance we attach to the security of your personal data and our legal responsibilities, we protect our website with state-of-the-art security certificates and firewalls.

We have prepared this policy and clarification text to enlighten the people who use and purchase our services or contact for any support and suggestion requests, about the protection and processing of personal data. Before the details of the processing of your personal data specified in the other headings, we would like to make a statement on some issues in particular:

First of all, let us state that to inform you about our campaigns; In order to provide you with special products or services, to provide information and in all other cases where we require your explicit consent, we definitely obtain your explicit consent with the explicit consent information and approval text we share with you before processing your personal data. For example, we will never process this data if you do not consent to the use of marketing cookies that personalize your preferences. In some cases, you may share your personal data by making it public while using our services. For example, it is entirely up to you to mention something about yourself in the bio section of your user account.

In order to use our services, we do not offer you to share your personal data such as location information with us as a prerequisite when creating a user registration, but we may request you to share your location information with us through third party applications in order to benefit from our services after the registration stage. After you allowing your location information to be shared with us via your personal devices, we process your location information instantly with your explicit consent, but we never store it.

If you want to make purchases while using our services, we are obliged to request some information that we did not request during user registration due to our legal obligations. Our most primary legal obligation is our liability to issue an invoice for the product or service you have purchased. For this, we need your surname and your city-district information. If you would like to include a TR Identity Number on your invoice, you can share this information with us on your own initiative.

As can be seen in the "Data Category and Processed Personal Data" section of this clarification text, we do not process the credit or debit card information you make a payment. This information is processed and stored by organizations that ensure the successful execution of your payment and provide a secure payment system integrated with our website or mobile applications.

No one, including us, can access the passwords you create to log in to your account. The passwords you create are stored as encrypted with certain algorithms.

While using our services, we offer messaging with third parties for a limited time and then the entire message history is not possible for anyone to view, including the communicating parties. When your messaging with the third party ends, we encrypt all message records instantly and store them on our servers, where we take adequate security measures, for a certain period of time. The reason why we keep your message records for a certain period of time is to take precautions for your safety and to share them with law enforcement/legal authorities when necessary. We only store your messages encrypted for 15 days and then permanently delete them from all our servers, irretrievably.

When an application is made to us with the claim that you have used third-party photos or information on our website or mobile application, we may request you to share a certain part of your Republic of Turkey Identity Card in order to ensure transaction security and security confirmation. The personal data we process for this purpose is based on the reason for fulfilling our legal obligations.

Apart from all these explanations, which of your personal data is processed; We would like to inform you about the purposes for which your processed personal data is processed, with whom it can be shared, the method of collection of your data, and the right to apply, which is the data controller (“our company”) for legal reasons, with this clarification text prepared in accordance with Article 10 of the Law No. 6698. :

2. DATA CATEGORY AND PROCESSED PERSONAL DATA

We may not request some of your personal data categorized in the table below. However, we wanted to briefly inform you about the purposes for which you process this data when we request it. As explained in the relevant part of this text, you can use your rights listed in Article 11 of the relevant Law to obtain more detailed information about the processing of your personal data.

3. PURPOSE OF PROCESSING PERSONAL DATA

We process your personal data that you share with us electronically or physically, in accordance with the law and in accordance with the rules of good faith, in connection with the purposes of processing, in a limited and measured way, accurately and up-to-date, for certain clear and legitimate purposes. These purposes are as follows:

• To be able to fulfill the obligations arising from the contract and to use our services within the framework of the expected benefit
• Implementation of processes for the purchase and use of products or services
• Providing a better user experience
• Ensuring the security of the website where the purchased services will be performed
• Providing access to the website where the purchased services will be performed.
• Better functioning of the website/mobile applications through which the purchased services are accessed.
• Ensuring the security of access to the website.
• Performing e-mail verification processes
• Organizing, storing and archiving all records and documents.
• Managing the request and complaint processes
• Fulfillment of financial and financial obligations
• Requirement of data transfer to third parties in order to fulfill the obligations arising from the legislation and the contract
• Providing information to authorized persons, institutions and organizations
• Execution of business activities
• It is mandatory to share data with business partners in order to carry out business activities.
• Receiving and evaluating suggestions for improvement of business processes
• Execution of management activities
• Continuing the activities in accordance with the legislation
• Managing information security processes
• Execution of Audit/Ethics activities
• Carrying out internal audit activities

• Risk management
• Managing contract processes
• Realization of advertising, campaign, marketing and personalized product/service delivery activities in case of your explicit consent.
• Managing the processes of commitment to our company's services or products
• Follow-up and execution of legal affairs
• Performing the necessary identity confirmation procedures upon the application of the person concerned about the processing of personal data.
• Carrying out the registration and follow-up procedures of our company visitors
• Performing marketing analysis studies
• Ability to carry out statistical studies
• Managing customer relations and carrying out service satisfaction practices.

4. TRANSFER OF PERSONAL DATA

Your collected personal data is limited only to the purposes described in the first article of this information text and the reasons that require it to be transferred within the scope of the relevant legal regulations, and in accordance with Articles 8 and 9 of the Law on the Protection of Personal Data No. 6698; supervisory and regulatory public institutions and organizations, judicial units and real or legal persons and business partners from whom the data controller receives services for their legitimate interests, provided that it does not harm the fundamental rights and freedoms of the data subject. Since express consent is required for your personal data to be shared with third parties, except for the reasons listed in the law, no data transfer is carried out at home or abroad without obtaining your explicit consent confirmation text. We share the table below with you as an example to the third parties to whom your data is transferred.

5. METHOD AND LEGAL REASON FOR COLLECTING PERSONAL DATA

Your personal data, for the above-mentioned purposes, in accordance with the basic personal data processing principles stipulated in the Law; Based on legitimate interests and legal grounds, provided that it does not harm the fundamental rights and freedoms of the person concerned, if it is clearly stipulated in the law, for the data controller to fulfill its legal obligation, to be made public by you, for the establishment, use or protection of a right; In cases where data processing is not possible without express consent, it is collected by automatic or non-automatic methods by obtaining explicit consent:

• By contacting us via the Call Center
• Through the agreements signed with you through our mobile applications or our website,
• By purchasing a virtual product or service from all internet environments we provide services or using all services and related features offered free of charge
• Via electronic forms available in all internet environments that we provide services,
• Through documents delivered by you physically,
• Applications, orders, requests, complaints, interviews, information and all kinds of document and record transfer activities made via e-mail, telephone, mail or other telecommunication and communication software
• By contacting us through our social media accounts
• With physical banking transactions or mobile banking applications

6. YOUR RIGHTS UNDER THE LAW

Provided that it remains within the framework of KVKK and other applicable legislation,

• Learning whether your personal data is processed or not,
• If your personal data has been processed, requesting information about it,
• To learn the purpose of processing personal data and whether they are used in accordance with its purpose,
• Knowing the third parties to whom your personal data is transferred, up country or abroad,
• Requesting correction of your personal data if it is incomplete or incorrectly processed,
• Requesting the deletion or destruction of your personal data within the framework of the conditions stipulated in the KVKK legislation,
• When you request the deletion or destruction of your personal data by correcting incomplete or inaccurate data, requesting that this situation be notified to the third parties to whom your personal data has been transferred,
• Objecting to the emergence of a result against you by analyzing the processed data exclusively through automated systems,
• Requesting the removal of this damage in case you suffer damage due to unlawful processing of personal data

you have rights.

7. HOW TO APPLY TO US

Your requests within the scope of Article 11 of the Law "regulating the rights of the person concerned", in accordance with the Communiqué on Application Procedures and Principles to the Data Controller, with the text of the "Relevant Person Application Form" that you can obtain on our website, provided that you have your wet signature, to Bulgurlu Mah. Technical Sk. Küçük Camlica Uzunlar Apt. C Block No:1C/36 address; or to kvkk@viaruuma.com or bycbilisim@hs01.kep.tr in writing and by providing your identity confirmation. (If you apply through your approved e-mail address, identity confirmation will be deemed to have been realized. The current version of the e-mail address should be notified to our company.) Our company will finalize the application requests in accordance with the 13th article of the Law, according to the nature of the request and within 30 (thirty) days at the latest.

If the transaction requires cost, the tariff determined by the Personal Data Protection Authority will be applied. If the request is rejected, the reason(s) for the refusal will be justified in writing or electronically.

In the application containing your explanations regarding the right you have as the personal data owner and you will make and request to use the above-mentioned rights; The subject you request must be clear and understandable, the subject you request is related to yourself or if you are acting on behalf of someone else, you must be specifically authorized in this regard and document your authority, the application must include identity and address information, and documents confirming your identity must be attached to the application.