PERSONAL DATA PROCESSING AND PROTECTION POLICY

## INTRODUCTION

The Personal Data Protection Law No. 6698 (KVKK) was published in the Official Gazette on April 7, 2016, to protect the fundamental rights and freedoms of individuals. The right to protection of personal data, which is one of the individual fundamental rights and freedoms, is safeguarded within the framework of Article 20 of the Constitution and Article 8 of the European Convention on Human Rights.

## 1. PURPOSE AND SCOPE

In order to protect fundamental rights and freedoms, especially the privacy of private life, and within the framework of the regulations regarding personal data in the Personal Data Protection Law No. 6698 (KVKK) and related legislation, this Personal Data Processing and Protection Policy has been prepared by EVOLVECHAT ARTIFICIAL INTELLIGENCE TECHNOLOGIES TRADE INC. (hereinafter referred to as EVOLVECHAT) to inform and enlighten individuals whose personal data are being processed and our valued customers.

## 2. PERSONAL DATA, DATA CONTROLLER, AND PROCESSING OF PERSONAL DATA

Personal data is defined in the KVKK No. 6698 as “any information relating to an identified or identifiable natural person.”

As the Data Controller, EVOLVECHAT, as defined in the KVKK No. 6698 as “the natural or legal person who determines the purposes and means of processing personal data, and who is responsible for the establishment and management of the data recording system,” has the right and responsibility to perform any processing activities on data, such as obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying, or preventing the use of personal data, whether fully or partially automatically, or through non-automatic means, provided that they are part of a data recording system.

## 3. GENERAL PRINCIPLES IN PROCESSING PERSONAL DATA

As EVOLVECHAT, our personal data processing activities are carried out in accordance with the following principles set out in Article 4 of the KVKK No. 6698:

– Lawfulness and fairness,

– Accuracy and, when necessary, being kept up to date,

– Processing for specified, explicit, and legitimate purposes,

– Being relevant, limited, and proportionate to the purposes for which they are processed,

– Retaining them only for the period provided for by relevant legislation or as required by the purpose for which they are processed.

## 4. CONDITIONS FOR PROCESSING PERSONAL DATA

According to Article 5 of the KVKK No. 6698, personal data cannot be processed without the explicit consent of the data subject. However, personal data may be processed without explicit consent under the following conditions:

– If it is explicitly stipulated by the law,

– If it is mandatory for the protection of life or physical integrity of a person who is unable to express their consent due to actual impossibility or whose consent is not legally valid,

– If it is necessary to process the personal data of the parties to a contract, provided that it is directly related to the establishment or performance of the contract,

– If it is mandatory for the data controller to fulfill their legal obligation,

– If the data subject has made their data public,

– If data processing is mandatory for the establishment, exercise, or protection of a right,

– If data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

In this context, EVOLVECHAT carries out personal data processing activities in accordance with Article 5 of the KVKK No. 6698 and does not engage in any personal data processing activities that do not fall within the conditions for processing personal data.

## 5. CONDITIONS FOR PROCESSING SPECIAL CATEGORIES OF PERSONAL DATA

According to Article 6 of the KVKK No. 6698, it is prohibited to process personal data of special nature, such as data relating to a person’s race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, clothing and attire, membership to associations, foundations or trade unions, health, sexual life, criminal convictions, and security measures, without the explicit consent of the data subject.

Personal data other than health and sexual life may be processed without explicit consent in the cases stipulated by the law. Personal data related to health and sexual life may only be processed without explicit consent for the purposes of protecting public health, performing preventive medicine, medical diagnosis, treatment, and care services, planning and managing health services and their financing, by persons under the obligation of keeping confidentiality or by authorized institutions and organizations.

EVOLVECHAT may process special categories of personal data under the conditions specified in Article 6 of the KVKK No. 6698 and takes additional security measures to ensure the security of special categories of personal data as stipulated by the relevant legislation.

## 6. CHANNELS AND TRANSFER OF PERSONAL DATA

Personal data acquired in compliance with the provisions of the KVKK No. 6698 may be transferred to EVOLVECHAT shareholders, authorities, legally authorized public institutions and organizations, and private law persons. All necessary measures are taken to ensure that personal data processing activities are conducted in compliance with personal data processing principles.

Personal data is obtained during sales made with subscribers by EVOLVECHAT; new channels for obtaining personal data may be added by EVOLVECHAT, and some of the existing channels may be discontinued. In case of changes in the personal data acquisition channels, this Personal Data Processing and Protection Policy will be updated to maintain transparency.

The acquired personal data are as follows:

– Identity data,

– Contact data,

– Education, work, and professional experience data,

– Employee data.

EVOLVECHAT may transfer personal data and special categories of personal data to third parties in compliance with lawful personal data processing purposes by taking all necessary security measures; this is conducted in accordance with the regulations stipulated in Article 8 of the KVKK.

## 7. OBLIGATION TO INFORM

EVOLVECHAT will fulfill its obligation to inform, as specified in Article 10 of the KVKK No. 6698, by providing the following information to data subjects at the time of obtaining personal data:

– The identity of the data controller and its representative, if any,

– The purposes for which personal data will be processed,

– To whom and for what purposes personal data can be transferred,

– The method and legal reason for collecting personal data,

– Other rights of the data subject as listed in Article 11.

However, pursuant to Article 28 of the KVKK No. 6698, EVOLVECHAT does not have the obligation to inform in cases where:

– Processing of personal data is necessary for the prevention of a crime or crime investigation,

– Processing of personal data made public by the data subject,

– Processing of personal data is necessary for the performance of supervisory or regulatory duties and for disciplinary investigation or prosecution by authorized and competent public institutions and organizations and professional organizations that have the status of a public institution, based on the authority granted by the law,

– Processing of personal data is necessary for the protection of the economic and financial interests of the State in relation to budget, tax, and financial matters.

## 8. STORAGE AND DESTRUCTION OF PERSONAL DATA

As EVOLVECHAT, personal data of data subjects are stored in electronic and physical environments by taking necessary technical and administrative security measures. Personal data is stored for the minimum duration necessary. After determining whether there is a period stipulated for the retention of personal data in the relevant legislation, EVOLVECHAT will store the data for the period specified in the legislation; if no period is specified, it will store the data for the period required by the purpose for which it was processed.

When the purposes for which personal data processing conditions cease to exist as stated in the KVKK No. 6698, personal data will be destroyed by EVOLVECHAT. Such destruction processes are carried out ex officio in six-month periods or at the request of data subjects, in accordance with the provisions of the relevant legislation.

EVOLVECHAT will carry out the destruction of personal data using deletion, anonymization, or destruction techniques, depending on the environment in which the personal data is stored. Detailed information about these techniques can be found in the Guide on Deletion, Destruction, or Anonymization of Personal Data published by the Board (https://www.kvkk.gov.tr/SharedFolderServer/CMSFiles/bc1cb353-ef85-4e58-bb99-3bba31258508.pdf).

## 9. RIGHTS OF THE DATA SUBJECT

The rights granted to data subjects under Article 11 of the KVKK No. 6698 are listed below:

– To learn whether personal data is processed,

– To request information if personal data has been processed,

– To learn the purpose of processing personal data and whether they are used in accordance with their purpose,

– To know the third parties to whom personal data is transferred domestically or abroad,

– To request the rectification of incomplete or inaccurate data, if any,

– To request the deletion or destruction of personal data in accordance with the conditions provided for in the KVKK and other relevant laws, and to request that the third parties to whom personal data has been transferred be notified of the actions taken within this scope,

– To object to the occurrence of a result against the person by analyzing the processed data exclusively through automated systems,

– To request compensation for the damages arising from the unlawful processing of personal data.

EVOLVECHAT takes all necessary administrative and technical measures to enable data subjects to exercise their rights granted under the KVKK No. 6698.

Data subjects may send their requests regarding the rights stated in this Personal Data Processing and Protection Policy to the EVOLVECHAT address by registered mail or notary public, or via e-mail with a secure electronic signature to [email protected].

EVOLVECHAT will conclude the requests of personal data owners regarding their above-mentioned rights, free of charge, within thirty days from the date of receipt. If the transaction requires an additional cost, the requests of the

 personal data owners may be charged in accordance with the tariff determined by the Personal Data Protection Board.

## 10. SECURITY MEASURES

As EVOLVECHAT, we take all necessary technical and administrative measures to ensure the security of personal data in accordance with the regulations in Article 12 of the KVKK No. 6698 and to prevent the unlawful processing and access of personal data.

In this context, the measures taken by EVOLVECHAT are as follows:

– Establishing policies and procedures regarding data security,

– Providing necessary training to ensure data security awareness,

– Regular internal audits,

– Using up-to-date and secure technologies for data storage and processing,

– Managing the access to data storage areas and systems where personal data is processed with defined roles and responsibilities,

– Implementing encryption techniques in data storage and processing environments,

– Implementing measures against unauthorized access,

– Monitoring and controlling personal data processing activities,

– Ensuring that data security measures are also applied to third parties from whom services are received.

## 11. CHANGES TO THE PERSONAL DATA PROCESSING AND PROTECTION POLICY

EVOLVECHAT reserves the right to make changes to this Personal Data Processing and Protection Policy due to new requirements that may arise as a result of legislative changes or changes in data processing purposes and methods.

In case of any changes, the updated version of the Personal Data Processing and Protection Policy will be published on the official website of EVOLVECHAT (https://www.hukukchat.com).

This Personal Data Processing and Protection Policy is updated as of [Date] and is made available to data subjects via publication on the website of EVOLVECHAT.

## CONTACT INFORMATION

For any questions regarding this Personal Data Processing and Protection Policy, data subjects can contact EVOLVECHAT through the following contact details:

**EVOLVECHAT ARTIFICIAL INTELLIGENCE TECHNOLOGIES TRADE INC.**

Email: [email protected]