Personal Data Protection, Processing and Information Policy

1. PURPOSE, SCOPE AND LEGAL BASIS

1.1. This Personal Data Protection, Processing and Information Policy (the “Policy”) has been prepared in accordance with the Law on the Protection of Personal Data No. 6698 (“KVKK” or the “Law”), the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform (the “Communiqué”), the related secondary legislation, the decisions of the Personal Data Protection Board (the “Board”) and, to the extent applicable by analogy, the European Union General Data Protection Regulation (“GDPR”).

1.2. This Policy aims to manage the processes for obtaining, recording, processing, transferring, storing and destroying the personal data of dealers, sub-dealers, their authorised persons, employees and users (“User” or “Data Subject”) and potential business partners who access the collection/financial technology application named “Tahsildar”, operated by THS Finansal Teknolojiler Anonim Şirketi (the “Company”), through web and mobile interfaces or integrated services, and to fulfil the obligation to inform under Article 10 of the Law.

2. IDENTITY OF THE DATA CONTROLLER

Under subparagraph (ı) of paragraph 1 of Article 3 of the Law, the Data Controller with respect to the personal data collected and processed within the Tahsildar application is:

• Company name: THS Finansal Teknolojiler Anonim Şirketi
• Address: İnkılap Mah. Dr. Adnan Büyükdeniz Cd 2. Blok No:4/7 Ümraniye/İstanbul
• Trade Registry / MERSIS No: 1012273
• Email / KEP address: info@tahsildar.com.tr / thsfinansal@hs03.kep.tr
• Phone: 0850 532 75 05

3. CATEGORIES OF PERSONAL DATA, PURPOSES OF PROCESSING AND LEGAL GROUNDS (ACTIVITY-BASED MATRIX)

In line with the fundamental principles in Article 4 of the Law (lawfulness and fairness; accuracy and, where necessary, being kept up to date; processing for specified, explicit and legitimate purposes; being relevant, limited and proportionate to the purposes for which it is processed; and being retained only for as long as necessary for the purpose of processing), your personal data is processed, without general or vague statements, on the legal grounds set out in the activity-based matrix below:

4. DATA COLLECTION METHODS, DATA MINIMISATION AND SIGN-IN (LOGIN) SECURITY

4.1. Collection Channels: Personal data is collected by automatic or partly automatic means through the Tahsildar web portal, the Tahsildar mobile applications (iOS/Android), API integrations, call centre records, the Identity Sharing System (KPS) integration and dealer application agreements.

4.2. Data Minimisation and Masking: In line with the principle of proportionality, sensitive fields such as the Turkish ID number and bank account/card details are displayed masked on Tahsildar platform interfaces and dealer screens (for example: 111******12, TR** **** **** 1234); the system does not request more data than is operationally necessary.

4.3. Sign-in Security (Two-Factor Authentication): Two-factor authentication (2FA - SMS/email verification code or dynamic OTP password) is mandatory for dealer and sub-dealer sign-ins to the Tahsildar application. Biometric data (fingerprint/face scan templates) is not collected on the Company’s central servers for identity verification; biometric verifications stored in the operating system’s local security hardware on the device are not transferred to the Company database.

4.4. Logging and Burden of Proof for Information: Digital traces showing that the User has reviewed this Policy/Privacy Notice on the login screen are recorded, together with the user ID, IP address, time stamp and the version number of the approved text, as conclusive evidence in line with Law No. 5651 and KVKK Art. 10/12 standards.

5. TRANSFER OF PERSONAL DATA AND THE REGIME FOR TRANSFERS ABROAD

5.1. Domestic Recipient Groups and Transfer Conditions:

Within the conditions set out in Article 8 of the Law, your personal data is transferred only to the following specified categories and for the stated purposes:

• Competent Public Institutions and Organisations: To the BRSA (BDDK), CBRT (TCMB), MASAK, the Revenue Administration, the Personal Data Protection Authority, judicial authorities and enforcement offices, to fulfil legal notification, audit and judicial request obligations (KVKK Art. 5/2-ç),
• Payment Institutions and Partner Banks: To execute collection orders, operate POS/virtual POS infrastructure and perform reconciliation (KVKK Art. 5/2-c),
• External Service Providers and Consultants: To service providers supporting us in legal, tax, independent audit, cyber security testing (pentest) and call centre services, under confidentiality and data processing agreements (KVKK Art. 5/2-e and Art. 5/2-f).

5.2. Regime for Transfers of Data Abroad:

The servers, databases and backup systems used in the Tahsildar application infrastructure are primarily hosted within the borders of the Republic of Türkiye. Where cloud computing, server or email service providers resident abroad are used, the transfer is carried out:

• To “safe countries with adequate protection” announced by the Board under Article 9 of the Law, or,
• Where standard contracts/undertakings signed between the Company and the data processor/data controller abroad and approved by/notified to the Board exist, or,
• Where these legal safeguards do not exist, within the scope of an independent and separate Explicit Consent Statement obtained from the user at the login stage or in profile settings, without making it a precondition for the provision of the core service.

6. COOKIES AND TRACKING TECHNOLOGIES

6.1. Essential Cookies:

Cookies that are strictly necessary for the Tahsildar web platform to work, ensure session security and balance load are processed automatically on the grounds of legitimate interest (KVKK Art. 5/2-f) and performance of a contract (Art. 5/2-c).

6.2. Optional (Analytics, Performance and Advertising) Cookies:

Non-essential cookies for measuring and personalising the user experience are kept “off” by default. These cookies are activated only if the user gives active consent (opt-in) through the Cookie Management Panel. The user has the right to withdraw this consent through the panel at any time; rejecting non-essential cookies does not prevent access to the core collection functions of the Tahsildar application.

7. DATA RETENTION, DESTRUCTION POLICY AND ACCOUNT STATUSES

7.1. Retention Periods: Personal data is retained for the legal retention periods set out in the applicable sector legislation (Turkish Commercial Code, Tax Procedure Law, MASAK legislation No. 5549, Law No. 6493) and for the 10-year general limitation period under the Turkish Code of Obligations.

7.2. Periodic Destruction: When the purposes and conditions of processing have completely ceased, data is securely deleted, destroyed or anonymised under the Company’s Personal Data Retention and Destruction Policy, ex officio at intervals of at most 6 (six) months or within 30 (thirty) days upon the Data Subject’s justified request. These destruction operations are recorded with an auditable destruction report.

7.3. Deactivated / Frozen Accounts: The end of the dealership relationship or the deactivation of a user does not directly result in the immediate deletion of data; the account is moved to passive status and kept in the archive with restricted access during the legal limitation period, solely for the exercise of the right of defence in possible legal disputes (KVKK Art. 5/2-e).

8. DATA SECURITY, AUDIT AND JOINT RESPONSIBILITIES OF DEALERS/SUB-DEALERS

8.1. Technical Measures: The Company fully applies network security, application security, end-to-end encryption (SSL/TLS), database-level cryptographic protection, periodic penetration tests (pentest), the immutability of access logs and authorisation matrix controls.

8.2. Dealer / Sub-Dealer Obligations:

• Dealers and sub-dealers accept, declare and undertake that, when entering data into the Tahsildar application (customer/debtor/cardholder information, etc.), they have informed the data subjects in accordance with Law No. 6698 and, where required by legislation, obtained valid explicit consent.
• Dealers and sub-dealers are personally responsible for the security of the user names and passwords allocated to them by the Company; transferring these credentials to third parties is prohibited. When authorised staff change roles or leave, the dealer is obliged to remove the relevant user’s permissions from the system immediately.
• All administrative fines, compensation and litigation costs imposed on the Company due to the fault, unlawful data entry or unauthorised data sharing of a dealer or sub-dealer are recourse to the relevant dealer in proportion to its fault.

9. RIGHTS OF THE DATA SUBJECT UNDER ARTICLE 11 OF THE LAW

Each User has the right to apply to the Company to:

1. Learn whether their personal data is being processed,
2. Request information if their personal data has been processed,
3. Learn the purpose of processing their personal data and whether it is used in line with that purpose,
4. Know the third parties to whom their personal data is transferred in Türkiye or abroad,
5. Request the correction of personal data that is incomplete or inaccurately processed,
6. Request the deletion or destruction of personal data under the conditions set out in Article 7 of KVKK,
7. Request that the correction, deletion and destruction be notified to the third parties to whom the data has been transferred,
8. Object to an outcome against them arising from the analysis of the processed data exclusively through automated systems,
9. Claim compensation for damages if they suffer loss due to the unlawful processing of their personal data.

10. APPLICATION PROCEDURE TO THE DATA CONTROLLER AND RESPONSE PROCESS

10.1. How to Apply: Data Subjects may submit their requests relating to the rights listed above through the following channels, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:

• Written Application with Wet Signature: To the Company’s address at İnkılap Mah. Dr. Adnan Büyükdeniz Cd 2. Blok No:4/7 Ümraniye/İstanbul, in person with proof of identity or through a notary public,
• Registered Electronic Mail (KEP): To thsfinansal@hs03.kep.tr with a secure electronic signature,
• Email Registered in the System: By a message sent from the User’s email address registered in the Tahsildar system to info@tahsildar.com.tr, with “KVKK Information Request” in the subject line.

10.2. Mandatory Elements of the Application:

The application must clearly include the name-surname, signature (for written applications), Turkish ID number (for foreigners, nationality, passport number/foreign ID number), place of residence or workplace address for notification, email/phone number for notifications and the specific subject of the request. For applications made through an attorney, no special authority is required; attaching a copy of a power of attorney with general representation authority is sufficient.

10.3. Conclusion of Applications:

Depending on the nature of the request, the Company concludes the application effectively, with reasons and in good faith, free of charge within 30 (thirty) days at the latest. Responses are sent electronically in a verifiable secure manner or by registered mail. If the process requires an additional cost, the fee in the tariff set by the Board may be charged.

11. SEPARATION OF THE PRIVACY NOTICE AND THE EXPLICIT CONSENT MECHANISM

11.1. This text is provided to fulfil the obligation to inform under Article 10 of the Law and does not replace any explicit consent statement.

11.2. On the Tahsildar platform login screen, the User Agreement, the Privacy Notice and any Explicit Consent Texts are presented as separate, independent checkboxes. Explicit consent boxes cannot be presented pre-ticked.

11.3. Operations subject to explicit consent, such as sending marketing messages, profiling/personalisation or transferring data abroad, cannot be made a precondition or binding condition (bundling/take-it-or-leave-it) for the provision of core Tahsildar collection services.

12. ENTRY INTO FORCE AND PRECEDENCE OF THE TEXT

This Policy enters into force on the date it is published by the Company on Tahsildar digital platforms. Where translations of the Policy text exist in foreign languages, the Turkish text prevails in the event of any difference in meaning or interpretation.

DATA CONTROLLER THS FİNANSAL TEKNOLOJİLER ANONİM ŞİRKETİ