POSTA VE TELGRAF TEŞKİLATI ANONİM ŞİRKETİ

CLARIFICATION TEXT ON THE

PROCESSING OF PERSONAL DATA OF

TÜRKİYE CARD HOLDERS

As Posta ve Telgraf Teşkilatı Anonim Şirketi (‘PTT’), having the title of ‘data controller’ in accordance with the Personal Data Protection Law No. 6698 (“PDPL” or “Law”), we collect, process and transfer your personal data under the conditions detailed below.

With this text, PTT enlightens you, the Türkiye Card holder customers defined as the ‘related person’ in the Law, about the processes of collecting, processing and transferring your personal data and your rights under the Law.

1. Data Controller

Within the scope of Türkiye Kart, PTT determines the purposes and means of processing your personal data by acting as the ‘data controller’ defined in Article 3/1-(ı) of the Law in the processing of your personal data.

As the data controller, PTT is responsible for installing and managing the data recording system and taking administrative and technical measures regarding data security. In this context, PTT may also process your data with third parties who have the title of 'data processor' as defined in Article 3/1-(ı) of the Law.

2. Methods and Purposes of Collection of Your Personal Data

Your personal data is collected in writing, verbally or electronically, automatically or non-automatically, through your personal application via PTT offices, website and mobile channels, through the Türkiye Card delivered to you, within the scope of the legal reasons and processing purposes explained below.

3. Processing of Your Personal Data, Legal Reasons and Purposes of Processing

Your personal data collected by PTT is processed for the purposes of fulfilling the obligations arising from the PTT's Postal Services Law No. 6475, the Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institution, the Law No. 5549 on Prevention of Laundering Proceeds of Crime, all relevant national/international legislation and secondary regulations published based on these by national/international competent authorities (Information and Communication Technologies Authority, Banking Regulation and Supervision Agency, Central Bank of Türkiye, Financial Crimes Investigation Board in Türkiye, Union of Municipalities of Türkiye etc.), as well as all agreements to which PTT is a party, the PTT Postal Check Account Opening Agreement and the Türkiye Cart User Agreement; printing Türkiye Card in your name; carrying out the necessary operational activities of the PTT General Directorate Units, ensuring legal and commercial security in accordance with the principles in Article 4 of the Law, within the scope of the processing conditions stipulated in Article 5/II.

You can http://www.ptt.gov.traccess more detailed information on this matter in the “PTT A.Ş. Personal Data Protection and Processing Policy” under the “Confidentiality” tab at www.ptt.gov.tr.

4. Persons to Whom Your Personal Data is Transferred and the Purposes of Transfer

Your personal data collected by PTT may be transferred to persons or organizations that have the permission, right and authority to request and process personal information within the scope of all national/international legislation referred to above and/or the relevant legislation or agreements to which it is a party (Banking Regulation and Supervision Agency, Capital Markets Board, Central Bank of Türkiye, Financial Crimes Investigation Board in Türkiye, Banks Association Risk Center of Türkiye, judicial and administrative authorities, other official institutions and organizations and individuals), primarily but not limited to municipalities, public institutions and organizations and other third party real/legal persons for the purpose of using Türkiye Kart, and to business partners such as subcontractors and operator companies that carry out the supply of hardware and software development and technical service processes of hardware, within the scope of the personal data processing conditions and purposes specified in Article 8 of the Law, within the scope of third parties that have the title of business partners and data processors of PTT, for the purpose of operating the Türkiye Kart system.

5. Your Legal Rights

As the personal data owner, by applying to PTT as the data controller in accordance with Article 11 of the Law, you have to right to;

• Learn whether your personal data has been processed or not,
• Request information about it if your personal data has been processed,
• Learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
• Know the third parties to whom your personal data is transferred, either domestically or abroad,
• Request correction of your personal data if it has been processed incompletely or incorrectly and request notification of the action taken to third parties to whom your personal data has been transferred,
• Request the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the Law (the situation where the reasons requiring the processing of your personal data are eliminated, despite the fact that it has been processed in accordance with the Law and other relevant legal provisions) and request that the action taken within this scope be notified to third parties to whom personal data has been transferred,
• Object to a result that is to your detriment as a result of your processed data being analyzed exclusively through automated systems,
• Request compensation for damages in case you suffer damages due to the unlawful processing of your personal data

. The exceptional cases stipulated in Article 28 of the Law are reserved.

You can submit your requests regarding these rights by filling out the “Data Owner Application Form” under the ‘Confidentiality’ tab on ptt.gov.tr ​​and using the methods included in this form. Your request will be finalized as soon as possible and in any case within thirty (30) days at the latest, as a rule free of charge, but exceptionally if it requires an additional cost, it will be finalized for a fee determined by the Personal Data Protection Board.

BEST REGARDS,

POSTA VE TELGRAF TEŞKİLATI ANONİM ŞİRKETİ

CATEGORIES OF PROCESSED DATA