ANNEX-8 Protection Of Personal Data

Clarification Text on the Protection and Processing of Personal Data  The purpose of this Information on the Protection and Processing of Personal Data (Information) is to fulfil the disclosure obligation imposed by Article 10 of the Law No. 6698 on the Protection of Personal Data (Personal Data Protection Law) regarding the use of personal data obtained and/or received from third parties during the use of the website located at (Portal) managed by BAYTII Gayrimenkul İnşaat ve Genel Ticaret Limited Şirketi (hereinafter referred to as BAYTII). In addition, it is to inform the Visitors in a transparent manner about the manner of collection, purposes of processing, legal reasons and rights of the personal data collected by BAYTII or entered into the Portal by the Visitors themselves regarding the use of the Portal., as a data controller within the scope of the Law on the Protection of Personal Data No. 6698 ("Law"), will record, classify, process, store, update, transfer and disclose the personal data of its Visitors and Members to third parties. With this information, we hereby inform you about our mutual rights and obligations in accordance with the provisions of the Law.  Those who offer services in various categories and post property advertisements and potential buyers meet and make purchases through the secure environment offered by BAYTII. Within this activity, personal data are processed as specified in this Information as a requirement for the use of BAYTII functions.  BAYTII constantly renews itself in order to provide better services to its Visitors in the field of internet with innovative products and services applications by investing in technology and strives to provide the best services and takes the highest possible security measures in order to ensure that personal data is collected, stored and shared in accordance with the law and to protect its confidentiality. In order to fulfil this purpose, the personal data of the Visitors are processed within the scope and under the conditions detailed below.  BAYTII may update and change the provisions of this Information at any time by publishing them on the Portal. Updates and amendments made by BAYTII shall be effective from the date of publication on the Portal.

a) Data Controller 

In accordance with the Law on the Protection of Personal Data, your personal data will be collected and processed by BAYTII as the data controller within the scope described below.

b) Personal Data Collected 

BAYTII collects various static (fixed) and dynamic (variable) data from Visitors using the methods described below. The data collected by BAYTII depends on the Services and features used by Visitors.  In this part , the data processed within the scope of the Services provided by BAYTII and considered as personal data in accordance with the Law on the Protection of Personal Data are listed in groups below. Unless explicitly stated otherwise, the terms "personal data" and "special categories of personal data" within the scope of the terms and conditions set forth in this Information include the following information:  Name and Contact Information: Name, surname, mobile phone, home phone, work phone, address, e-mail address, billing information, Turkish ID number (national ID number), photocopy of the front side of the ID and other similar documents.  Identity Verification Information: Visitors' account information, passwords used to authenticate and access the account, Visitor name, contact information, Visitor numbers, advertisement numbers,  front side information of identity card, front side information of  new identity card , front side information of new driving licence,  video of Visitor selfie, identity card hologram video, billing information.  Demographic Data: Date of birth, gender, marital status, education status, occupation, interests, preferred language data.  Usage Data and Favourites: Data collected from your devices by means of various software and technological tools, reasons for calling BAYTII or call Centres, voice recordings, property index, expertise, date and time of use of the product, province, district, neighbourhood, products viewed through the Portal, square metre prices, surveys of domestic or foreign companies, The data specified in the relevant survey or banner so that visitors can be directed to the relevant product and product supplier companies can contact the visitor through modules such as banner redirection, the information requested by the bank regarding the offer that banks want to receive for the real estate they put up for sale through the real estate module from the bank, data entered to obtain information about the projects of contractor companies through the Portal for real estate projects, usage habits in order to develop and customise the Services for you (prioritisation options, preferred return method and date, channels responded to, last login date to the Portal, type of post, websites visited, number of pages viewed, visit duration and target completion number, Visitor movements performed while using the services, search terms entered, categories of products and advertisements visited,) errors and similar problems that occur during the use of the Services in order to ensure the smooth provision of the Services.  Survey Answers: Responses to periodic surveys organised by BAYTII within the Portal and responses to surveys conducted by real and legal persons with whom BAYTII cooperates.  Where is Personal Data Stored and Processed? (Processing and Storing of Personal Data)   Your personal data we obtain may be stored at home or abroad in another country where BAYTII or its affiliates, subsidiaries or cooperating service providers have facilities and may be processed in line with and proportionate to the purposes set out in this Information.   Your personal data collected within the scope of this Information will be processed in accordance with the provisions contained herein and within the scope of the legislation in force in the country where the data is stored and processed and within the prescribed security measures.

c) Purpose of Processing Personal Data 

In line with the purposes set out in this Information and Account Agreement, your personal data will be processed in accordance with the Principles and Processing Conditions regulated by the Law No. 6698 on the Protection of Personal Data and for the purposes mentioned below:  Name and Contact Information: Internal evaluation, communication, visitor registration, obtaining potential customer information, development of after-sales processes, business development, collection, customer portfolio management, promotion, analysis, complaint management, managing customer satisfaction processes, marketing, advertising, research, invoicing, event information, conducting operational activities, measuring and improving the quality of Services, audit, control, optimizations', customer verification, sales, after-sales Services, detection and prevention of fraud, participation in online training meetings;  Authentication Information: Visitor registration, problem/error reporting, control, development and execution of operational activities, development of after-sales processes, business development, collection, internal evaluation, customer portfolio management, measurement of Services quality, communication, optimization, moderation, audit, risk management, digital authentication, customer verification, fraud detection and prevention;  Demographic Data: Promotion, internal evaluation, analysis, communication, development of after-sales processes, business development, collection, usage data and interests, favourites, marketing, sales, advertising, audit and control, risk management, internal evaluation, customer portfolio management, after-sales Services, measurement and development of Services quality, complaint management processes, execution and development of operational activities, registration, problem/error reporting;  Usage Data and Favorites: Visitor registration, problem/error notification, control, inquiry, execution and development of operational activities, after-sales Services and development of after-sales processes, business development, collection, internal evaluation, online behavioural advertising and marketing, customer portfolio management, measurement and development of Services quality, communication, optimization, audit, risk management and control, promotion, analysis, interest identification, scoring, profiling, marketing, sales, advertising, complaint management processes, registration, problem/error notification;  Location data: Utilization of location-based or location-related Portal functions, audit and control, risk management;  Payment Data: Managing the billing process, accounting, development of after-sales processes, business development, collection, internal evaluation, scoring, profiling, customer portfolio management, after-sales services, communication, marketing, audit, control, payment processes with service providers;  Content: Business development, optimization, customer portfolio management, audit, control, execution and development of operational activities, facilitation of advertisement processes, prevention of fraud and abuse that may occur during advertisement and collection of data in this direction, execution of advertisement operations, promotion, in-house evaluation, customer management, analysis, scoring, profiling, development of after-sales processes, collection, after-sales Services, communication, measurement and development of Service quality, fulfilment of regulatory compliance requirements, execution of complaint management processes;  BAYTII Survey and Test Answers: Information requested from Visitors who respond to periodic surveys or tests organized by BAYTII within the Portal, real and/or legal persons with whom BAYTII cooperates for the use of the Portal functions and the performance of these functions by BAYTII and third real and/or legal persons with whom BAYTII cooperates within the scope of all processing activities mentioned above in accordance with the purposes of use of the Portal, direct marketing to these Visitors, statistical analysis, improvement of processes and database creation;  Performing obligations, establishing rights, protecting rights arising from contracts made by BAYTII with its business partners/customers/suppliers in order to fulfill legal and commercial obligations within the framework of contracts made or activities carried out with third real or legal persons who have a business relationship with BAYTII and obligations arising from legal regulations, 5. and 6. of the Law No. 6698 for the purposes of conducting commercial and legal evaluation processes, conducting legal and commercial risk analyses, conducting the legal compliance process, finalizing the tests to determine whether the Visitor can receive the documents specified in the relevant legal regulations, conducting financial affairs, fulfilling legal requirements, fulfilling the decisions of competent institutions, organizations, and authorities, and responding to their requests. and 6. of Law No. 6698 for the purposes of fulfilling legal requirements, fulfilling the decisions of authorized institutions, organizations, and authorities, and answering their requests.  In-Site Messages that are Caught in Filters or Contrary to Terms of Use: Our Messaging Services are provided in order to facilitate our Visitors to communicate with the counterparty in purchase, sale and rental transactions. In messages within this scope; based on the legitimate interest in Article 5 of the Law, messages that contain insults, violate public morality, raise suspicion of fraudulent advertisements, may cause unfair competition, violate personal rights, intellectual and industrial property rights, and otherwise violate the law are filtered and moderated, and in-site messages with content contrary to the terms of use can be examined and blocked.  Personal Data Storage Period  BAYTII will retain the personal data it obtains for the period necessary for the purpose for which they are processed in order to enable the Visitors to make the best use of the Services and to fulfill the obligations arising from the nature of the Account Agreement within the framework of the conditions specified in this Information and the Account Agreement.  In addition, in the event of any dispute that may arise from the Account Agreement, BAYTII will retain personal data for the period of limitation determined in accordance with the relevant legislation and limited to the purpose of conducting administrative or judicial proceedings within the scope of the dispute.    Personal data will be retained as long as the purpose for providing this information is valid. In order to determine your needs related to our field of activity and to provide you with Services more quickly, your data will continue to be processed by us after the expiration of the Services you have received from us. Data shall be stored subject to legal deadlines and if it is required to be kept for reporting and informing purposes to legal authorities and other relevant public authorities, it shall be stored in compliance with these limits. Necessary security measures will be taken by us to prevent the loss of stored and recorded data, prevent unauthorized access, and prevent unlawful use.  In order to ensure security, the Company carries out personal data processing activities to monitor the entrances and exits of persons such as employees and visitors with closed-circuit camera surveillance in the Company's workplace and other areas (such as events, meetings, and training places) where we warn camera recording. Telephone conversations with customers are also recorded. Personal data processed within the scope of closed-circuit camera surveillance activities shall be retained for a maximum period of [90 days]. The voice recordings received are kept for 1 year. The information regarding the voice recording is notified at the time of the first contact with the customers. In addition, for security purposes, the VIP Center building management performs identity checks and keeps a visitor book when entering the company headquarters. In this context, necessary measures are taken regarding the processing and security of personal data. Disclosures regarding audio recordings, camera recordings, or guestbooks shall be made by the company in a manner that is easily accessible to those concerned.

D) To Whom and For What Purpose the Processed Personal Data Can Be Transferred 

BAYTII shall use the personal data belonging to the Visitor and any new data obtained by using such personal data or any personal data entered into the Portal by the Visitors themselves through their positive actions, in particular to fulfill the requirements of the Account Agreement and the Services, to improve the Visitor experience (including improvement and personalization), to ensure the security of Visitors, to detect and prevent fraud, to improve the Services, Outsourcing Services providers, business partners, suppliers, appraisal and real estate consultancy firms in order to perform any of the purposes specified in the processing purposes section above, including performing query activities that may be important for the Services, conducting operational evaluation research, resolving errors, verifying Visitor identities, improving system performance, providing online training activities; corporate account holders, law offices, research companies, call centers, software companies for complaint management and security, agencies, consulting companies, companies in the printing sector, banks for real estate sales of banks, contracting companies for real estate projects, social media channels, third real and/or legal persons including certification bodies and authorized institutions, organizations, authorities, administrative, judicial bodies and independent audit companies within the scope of legal obligations.  In addition, the Visitor's Name and Contact Information will be shared with payment institutions for the purpose of identity verification in accordance with the payment institution framework agreement that the Visitor will approve at the payment stage and in accordance with the Regulation on Measures to Prevent Laundering Proceeds of Crime and Terrorist Financing published in the Official Gazette dated January 9, 2008, and numbered 26751.  Personal data obtained through cookies placed on your device may be shared with third parties for the scope and purposes specified in this Information.  BAYTII may transfer personal data to third parties within the above-mentioned categories and purposes, limited and proportionate to these purposes, as well as abroad.  In any purchase transaction, your credit card information is transferred to the account of our payment institution XX Ödeme Hizmetleri A.Ş. from which you receive payment services and is stored by the payment institution XX Ödeme Hizmetleri A.Ş. until the end of the installments.

E) Method and Legal Grounds for Collecting Personal Data 

BAYTII collects your personal data in order to work more effectively and provide you with the best experience. BAYTII collects your personal data directly from you (the data subject), your proxy acting on your behalf, and/or persons authorized to act on your behalf by using the following methods:  Data you provide directly to BAYTII: It refers to personal data provided to BAYTII by Visitors on their own initiative for the performance of the Services and before or during the use of the Portal. This personal data includes all personal data provided directly by Visitors to BAYTII as a result of their positive actions. For example, name surname, contact information, identity information, answers to surveys, demographic data, and content information are included in this type of data.  Data We Obtain When You Use Our Platform: During the Services provided by BAYTII, personal data relating to the usage habits of Visitors received through certain software or technological tools. For example, location data and favorites as well as interests and usage data are included in such data.  BAYTII collects usage data such as the number of pages viewed, the duration of the visit and the number of target completions by associating their behavior on the site with a cookie in the browser, even if they do not have an account, in order to enable online behavioral advertising and marketing. How to manage cookies is also specified in our Cookie Policy.

Your personal data collected by these methods are based on the following legal grounds specified in Articles 5 and 6 of Law No. 6698:  It is expressly provided for in the law,  It is mandatory to fulfill its legal obligation (legal regulations regulating electronic commerce activities, financial and tax issues, consumer protection, and other issues),  It is directly related to the conclusion or performance of the contract and processing is necessary (Account Agreement, Terms of Use and the performance of the contract based on them, establishment and protection of the right),  Processing is mandatory for its legitimate interest (BAYTII collects the data necessary for BAYTII to carry out the Services, in particular, to prevent fraud, in its activities related to the Portal),  It has been made public by you,  Processing is necessary for the establishment, exercise, or protection of a right,  Explicit consent.  Your personal data collected by these methods may be processed and transferred for the purposes specified in this Information within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of Law No. 6698.  Legal grounds for collecting personal data are as follows:  Account Agreement, Terms of Use, and the performance of the contract, establishment, and protection of the right based on them  Legal regulations governing electronic commerce activities, financial and tax matters, consumer protection, and other issues  It is based on BAYTII's legitimate interest in collecting the data necessary for BAYTII to carry out the Services, in particular, to prevent fraud, in its activities related to the Portal.

F) Our Measures and Commitments Regarding Data Security 

BAYTII undertakes to protect personal data in a secure manner. In order to prevent unlawful processing and access to personal data and to ensure the protection of personal data, BAYTII takes technical and administrative measures to ensure the appropriate level of security by using various methods and security technologies.  BAYTII shall not disclose the personal data it obtains to anyone else in violation of the provisions of this Information and the Law No. 6698 on the Protection of Personal Data and shall not use it for purposes other than processing. BAYTII declares that in the event that personal data belonging to Visitors are shared with outsourcing service providers in accordance with this Information, BAYTII will carry out the necessary warning and auditing activities to ensure that such outsourcing suppliers also comply with the commitments under this article.  In case of linking to other applications through the Portal, BAYTII does not bear any responsibility for the privacy policies and contents of the linked applications.  The Visitor hereby undertakes that the information subject to this Information is complete, accurate, and up-to-date and that in case of any changes in this information, he/she will immediately update it on his/her Personal Page. BAYTII shall not be liable in case the Visitor fails to provide updated information.

G) Rights of the Personal Data Owner listed in Article 11 of Law No. 6698 

As personal data owners, if you submit your requests regarding your rights to BAYTII by the methods set out below, BAYTII will finalize the request as soon as possible and within thirty days at the latest, depending on the nature of the request. No fee will be charged for up to ten pages in the response. A transaction fee of 1 Turkish Lira will be charged for each page over ten pages. If the response to the application is given in a recording medium such as CD, or flash memory, the fee that may be requested by BAYTII shall not exceed the cost of the recording medium.  In this context, personal data subjects have the following rights:  Learn whether their personal data is being processed,  Request information if personal data has been processed,  To learn the purpose of processing personal data and whether they are used in accordance with their purpose,  To know the third parties to whom personal data are transferred domestically or abroad,  To request correction of personal data in case of incomplete or incorrect processing and to request notification of the transaction made within this scope to third parties to whom personal data is transferred,  Although it has been processed in accordance with the provisions of Law No. 6698 and other relevant laws, to request the deletion or destruction of personal data in the event that the reasons requiring its processing disappear and to request notification of the transaction made within this scope to third parties to whom personal data is transferred,  To object to the emergence of a result to the detriment of the person himself/herself by analyzing the processed data exclusively through automated systems,  In case of damage due to unlawful processing of personal data, to demand compensation for the damage.  In accordance with Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your request to exercise your rights stated above; in writing to BAYTII's address Cumhuriyet Mahallesi Nazım Hikmet Blv. Concepta Plaza Apt. No:91/1/39 Esenyurt Istanbul address in writing with information and documents certifying your identity, to xxx e-mail address with secure electronic signature, mobile signature or by using the e-mail address registered in BAYTII system by the relevant person.  BAYTII reserves the right to verify your identity in order to prevent unlawful sharing of your personal data.  The following items must be included in your application and relevant information and documents, if any, must be attached to the application.  Your name, surname, and signature if the application is in writing,  For citizens of the Republic of Turkey, your Turkish ID number; if you are a foreigner, your nationality, passport number, or ID number if any,  Your residential or workplace address for notification,  Your e-mail address, telephone and fax numbers, if any,  Your request subject.