1. Purpose of the Information Notice and Our Company’s Position as Data Controller:

Our company, Nar Bulut Information Technologies Industry and Trade Inc. ( (“Narbulut” and/or “Company”), is the “data controller” within the scope of the Law on the Protection of Personal Data No. 6698 (“Law”) regarding personal data related to customers. This Information Notice aims to inform customers about the personal data processing activities carried out by Narbulut in accordance with the Law.

2. Purpose of Processing Personal Data of Customers:

The personal data of customers are processed by the relevant business units for the purpose of conducting the necessary studies to benefit the relevant individuals from the products and services provided by Narbulut, carrying out the related business processes, conducting the necessary studies by the relevant business units for the realization of commercial activities carried out by Narbulut, and the execution of related business processes. The processing also includes planning and execution of Narbulut’s commercial and/or business strategies, as well as ensuring the legal, technical, and commercial security of Narbulut and individuals in business relationship with Narbulut, within the framework of the personal data processing conditions and purposes specified in Articles 5 and 6 of the Law.

3. Personal Data to be Processed with the Explicit Consent of Customers and Processing Purposes:

For situations where the conditions for processing personal data specified in Articles 5/2 and 6/3 of the Law cannot be met, explicit consent from customers is required for Narbulut to process personal data. Data processing activities for processes that do not require explicit consent are continuing under the Information Notice, and for processes that require explicit consent, data is processed in accordance with the fundamental principles stated in the Information Notice.

In this context, customers’ personal data is processed by Narbulut in accordance with the purposes specified in the Personal Data Processing and Protection Policy created by Narbulut within the scope of Law No. 6698. Accordingly, personal data is processed for the purposes of creating campaigns for customers, offering special opportunities that Narbulut customers can use for Narbulut by Narbulut business partners, cross-selling, determining target audiences, conducting activities to enhance user experience by tracking customer movements, improving the operation of Narbulut’s website and mobile application, personalizing them according to customer needs, conducting direct and indirect marketing, personalized marketing, and remarketing activities, as well as performing personalized segmentation, targeting, analysis, and in-house reporting activities, planning and executing market research, customer satisfaction activities, planning and executing customer relationship management processes, planning, and executing sales and marketing processes for Narbulut’s products and/or services in general. In line with the consent provided by the customer, data may be processed and shared with the parties specified in the Information Notice for these purposes. With respect to the consent of personal data owners located outside of Turkey, their consents are subject to the data protection regulations/laws applicable in their respective countries. The consent provided to Narbulut is considered to be the broadest and most comprehensive consent possible within the framework of the relevant legal provisions.

4. Transfer of Personal Data of Customers:

The personal data of customers may be shared by Nar Bulut Information Technologies Industry and Trade Inc. (“Narbulut” and/or “Company”) with the relevant business units to carry out the necessary activities for providing individuals with the products and services offered by Narbulut and for the execution of related business processes. Additionally, personal data may be shared with the relevant business units for the realization of commercial activities conducted by Narbulut, and the execution of associated business processes, as well as for the planning and execution of Narbulut’s commercial and/or business strategies. In line with the conditions and purposes of personal data processing specified in Articles 8 and 9 of the Law, activities necessary for ensuring the legal, technical, and commercial security of Nar Bulut Information Technologies Industry and Trade Inc. and individuals in a business relationship with Narbulut, including Company officials, our subsidiaries, business partners, suppliers, shareholders, and legally authorized public institutions and organizations, may be shared.

5. Method of Collection and Legal Basis for Processing Personal Data:

Personal data is collected from customers through electronic means. The personal data collected for the purposes stated above can be processed and transferred in accordance with the legal grounds specified in Articles 5 and 6 of the Law, as well as the purposes indicated in Article 3 of this Information Notice, and in cases where explicit consent is required.

6. Rights of Customers as Personal Data Owners:

In accordance with Article 11 of the Law, data owners have the following rights:

1. Learn whether their personal data is being processed,
2. Request information if their personal data has been processed,
3. Learn the purpose of processing personal data and whether they are used in accordance with that purpose,
4. Be informed about third parties to whom personal data is transferred, domestically or internationally,
5. Request correction of personal data in case it is incomplete or inaccurately processed, and request notification of this correction to third parties to whom the personal data has been transferred,
6. Request the deletion or destruction of personal data in case the reasons requiring processing cease to exist, even if the data has been processed in compliance with the Law and other relevant regulations, and request notification of this deletion or destruction to third parties to whom the personal data has been transferred,
7. Object to a result that is to the detriment of the individual, arising from the analysis of personal data exclusively through automated systems,
8. Request compensation if personal data is damaged due to the unlawful processing.

Requests related to the exercise of these rights can be communicated to Narbulut by the data owners through the methods specified in the Personal Data Processing and Protection Policy created by Narbulut within the scope of Law No. 6698. Narbulut will evaluate such requests and provide results within 30 days.

Narbulut reserves the right to charge fees according to the fee schedule determined by the Personal Data Protection Board (if any) in relation to these requests.