PDPL DISCLOSURE STATEMENT

This Disclosure Text has been prepared by SBM Elektronik Para ve Ödeme Kuruluşu A.Ş. (hereinafter referred to as the “Company”), which is the "Data Controller" under the Law No. 6698 on the Protection of Personal Data (briefly referred to as the “Law”), to provide information to our valued Users and Representatives, pursuant to Article 10 of the Law, regarding the personal data that may be obtained and processed during the execution of activities and services provided.

Scope of Personal Data, Methods of Collection, and Legal Reasons:

Under the Law, Personal Data refers to any information related to an identified or identifiable natural person. Your Personal Data may be collected by SBM Elektronik Para ve Ödeme Kuruluşu A.Ş. via the digital platforms under its name and brands by downloading these applications to your devices and/or using them online on our website while acting as a Representative of our Company, or in other physical or electronic environments while using our services. This data may be collected through various institutional databases, within the limits permitted by the legislation and, where legally required, with your consent. Your Personal Data may be collected for the purpose of appointing you as a Representative in accordance with Law No. 6493 on Payment and Securities Settlement Systems, Payment Services, and Electronic Money Institutions, and in compliance with all national and international regulations that require the collection, recording, and retention of identity information of the person performing the transaction. This data may be collected through electronic channels or paper media for the purpose of preparing all records and documents that serve as the legal basis for the transactions you perform with our Company.

Purpose of Processing Personal Data:

Processing of Personal Data refers to any operation performed on personal data, such as collection, recording, storage, retention, alteration, reorganization, disclosure, transfer, acquisition, making available, classification, or preventing its use, whether fully or partially automated or not, as part of any data recording system. Your Personal Data collected through the methods mentioned above may be processed for the following purposes in accordance with the personal data processing conditions and purposes set forth in Articles 5 and 6 of the Law: to fulfill the obligations imposed by domestic and international legislation regarding the storage, reporting, risk monitoring, and information disclosure obligations of the Company; to enhance customer satisfaction and service quality; to prevent fraud; to ensure security; to perform assessments regarding the credit limits, intelligence, and suitability of the products and services you will provide as a Representative; to manage legal processes; to fulfill mutual rights and obligations regarding the transactions you perform with the Company; to contact you regarding the products and services you have received or will receive; to conduct new product development, market research, and customer segmentation studies of the Company, its business partners, and its domestic and international affiliates.

Transfer of Processed Personal Data to Third Parties:

Your Personal Data may be shared with domestic or foreign regulatory and supervisory authorities, independent audit companies, the Company’s domestic and foreign affiliates and parent companies, service providers, business partners, the Payment Institutions and Electronic Money Institutions that the Company represents, consultants, suppliers, agents acting on behalf of the Company domestically or abroad, insurance companies, public legal entities, private persons, or judicial authorities in accordance with the personal data transfer conditions stipulated in Articles 8 and 9 of the Law.

Rights Regarding Your Personal Data Under Article 11 of the Law:

You have the right to learn whether your Personal Data is processed, request information about it, learn the purpose of its processing and whether it is used in accordance with its purpose, know the third parties to whom your data is transferred domestically or abroad, request correction of your Personal Data if it is incomplete or incorrectly processed, request deletion or destruction of your Personal Data, request notification of such correction, deletion, or destruction to third parties to whom your data has been transferred, object to any negative consequence arising from the exclusive analysis of your data by automated systems, and claim compensation for damages if you suffer a loss due to the unlawful processing of your Personal Data. To exercise your rights regarding your Personal Data, you may submit your questions and requests in accordance with the conditions and methods described in Article 13 of the Law, titled “Application to the Data Controller,” to the addresses of our Company provided below.

Postal Address:

Murat Reis Mahallesi Yeni Ocak Sokak, No:35 Üsküdar 34664 İstanbul

Registered Electronic Mail Address:

sbmteknoloji@hs01.kep.tr