This "Customer/Subscriber – Prospective Customer/Subscriber Disclosure Notice" has been prepared pursuant to Article 10 of the Law on Protection of Personal Data No. 6698 ("Law") and the Communiqué on Procedures and Principles for Fulfilling the Obligation to Inform, by the data controller Netgsm İletişim ve Bilgi Teknolojileri A.Ş. ("Company" or "Netgsm"), whose identity is provided below, for the purpose of fulfilling the obligation to inform regarding the processing of your personal data.

1. Purpose and Identity of the Data Controller

Your personal data may be processed by Netgsm, headquartered at Batı Bulvarı ATB İş Merkezi G Blok No:194 Macunköy - Yenimahalle/ANKARA, acting as data controller, in accordance with the Law, within the scope of the purposes listed below, in a manner that is connected, limited and proportionate to those purposes, as received by us, through automated or non-automated means, while preserving the accuracy and currency of the personal data, to the extent described below.

2. Purposes for Processing Personal Data

Your personal data shared with the Company or collected by the Company through automated or non-automated means in connection with the sale of goods or services within the scope of the Company's activities may be processed by the Company for the purposes set out below, in compliance with the fundamental principles prescribed in the Law and within the conditions for processing personal data specified in Articles 5 and 6 of the Law.

Additionally, with your explicit consent, in addition to the information you have shared with the Company, data obtained through tracking technologies (cookies, web beacons, etc.) — such as information about pages viewed on third-party sites, links and advertisements clicked — may also be processed for purposes including direct marketing, online behavioral advertising, and location-based advertising based on profiles created from such data. Details are available in the Cookie Policy at https://www.netgsm.com.tr/gizlilik-ve-guvenlik/.

The personal data processed under this Disclosure Notice, the purposes of processing, and personal data categories are explained in detail in the table below.

Personal Data Category

Identity Information
Full Name, Signature, Turkish Republic Identity Number, Title, Photocopy of ID, Place of Birth, Date of Birth, National ID Card Serial Number and other personal data on older ID documents, Tax Identification Number

Purpose of Processing Personal Data

Conducting Meetings with Prospective Customers, Carrying Out Communication Activities, Conducting Sales Activities, Carrying Out Customer Satisfaction Activities, Responding to Requests and Inquiries, Conducting Business Activities, Preparing Ba/Bs Forms, Making Monthly Statutory Notifications, Conducting Audit and Ethics Activities, Ensuring Regulatory Compliance of Activities, Conducting Finance and Accounting Operations, Managing Goods/Service Sales Processes, Issuing and Storing Invoices Related to Goods/Service Sales, Providing Information to Authorized Public Institutions and Organizations, Managing and Tracking Notice and Notification Processes, Conducting Storage and Archiving Activities, Managing Contract Processes, Creating and Tracking Current Account Records, Tracking Bank and EFT Verification Processes, Conducting Information Security Processes, Managing Customer Relationship Management Processes, Executing Remuneration Policy, Informing Relevant Departments, Ensuring Business Continuity, Establishing Subscription Agreements, Ensuring Document Preservation, Scanning Documents and Records, Conducting Internal Audit Activities, Fulfilling Legal Obligations, Carrying Out Customer Satisfaction Activities, Providing After-Sales Support Services for Goods/Services, Tracking Requests/Complaints, Conducting Information Security Processes

Personal Data Category

Contact Information
Phone Number, E-Mail Address, Address, Subscriber Number

Purpose of Processing Personal Data

Managing Customer Relationship Management Processes, Carrying Out Customer Satisfaction Activities, Conducting/Auditing Business Activities, Ensuring Business Continuity, Managing Goods/Service Sales Processes, Providing After-Sales Support Services for Goods/Services, Managing Contract Processes, Tracking Requests/Complaints, Providing Information to Authorized Persons, Institutions and Organizations, Establishing Subscription Agreements, Organizing Archiving Activities, Ensuring Document Preservation, Conducting Audit and Ethics Activities, Conducting Internal Audit Activities, Fulfilling Legal Obligations, Informing Relevant Departments, Creating and Tracking Current Account Records, Conducting Finance and Accounting Activities, Ensuring Regulatory Compliance of Activities, Issuing and Storing Invoices Related to Goods/Service Sales, Managing and Tracking Notice and Notification Processes, Conducting Storage and Archiving Activities, Conducting Meetings with Prospective Customers, Carrying Out Communication Activities, Responding to Requests and Inquiries, Ensuring Customer/Subscriber Relationship Management, Ensuring the Security of Data Controller Operations, Ensuring Regulatory Compliance of Activities, Conducting Information Security Processes

Personal Data Category

Customer Transaction
Request Information, Invoice and Related Documents

Purpose of Processing Personal Data

Managing Goods/Service Sales Processes, Customer Relationship Management, Carrying Out Communication Activities, Ensuring the Security of Data Controller Operations, Ensuring Regulatory Compliance of Activities, Providing After-Sales Support Services for Goods/Services, Establishment and Performance of the Contract, Issuing and Storing Invoices Related to Goods/Service Sales, Providing Information to Authorized Public Institutions and Organizations, Managing and Tracking Notice and Notification Processes, Conducting Audit/Ethics Activities, Conducting Finance and Accounting Operations, Conducting/Auditing Business Activities, Managing Contract Processes, Scanning, Archiving and Ensuring Preservation of Documents and Records, Conducting Internal Audit Activities, Fulfilling Legal Obligations, Carrying Out Customer Satisfaction Activities, Ensuring Business Continuity Activities, Providing After-Sales Support Services for Goods/Services, Conducting Information Security Processes

Personal Data Category

Finance
Account Information, Card Information, Payment Information

Purpose of Processing Personal Data

Creating and Tracking Current Account Records, Conducting Finance and Accounting Activities, Carrying Out Business Activities, Providing Information to Authorized Public Institutions and Organizations Where Required, Ensuring Regulatory Compliance of Activities, Bank and EFT Verification Processes, Conducting Information Security Processes, Conducting Audit/Ethics Activities, Carrying Out Communication Activities, Managing Goods/Service Sales Processes, Managing Customer Relationship Management Processes, Executing Remuneration Policy, Ensuring the Security of Data Controller Operations, Providing After-Sales Support Services for Goods/Services, Establishment and Performance of the Contract

Personal Data Category

Transaction Security
IP Address, Log Records, Cookie Records, Internet Access Log Records (for everyone accessing the internet via the Company network), IP address information, IP Address Monitoring, Website login/logout information

Purpose of Processing Personal Data

Conducting Information Security Processes, Carrying Out Marketing Activities, Carrying Out Product Promotion Processes, Conducting Advertising Activities, Carrying Out Goods/Service Sales Processes, Managing Customer Relationship Management Processes, Carrying Out Customer Satisfaction Activities, Conducting/Auditing Business Activities, Ensuring Business Continuity Activities, Providing After-Sales Support Services for Goods/Services, Managing Contract Processes, Tracking Requests/Complaints, Providing Information to Authorized Persons, Institutions and Organizations

Personal Data Category

Visual and Audio Records
Video Recording, Audio Recording

Purpose of Processing Personal Data

Managing Customer Relationship Management Processes, Carrying Out Customer Satisfaction Activities, Conducting/Auditing Business Activities, Ensuring Business Continuity Activities, Providing After-Sales Support Services for Goods/Services, Managing Contract Processes, Tracking Requests/Complaints, Providing Information to Authorized Persons, Institutions and Organizations, Conducting Information Security Processes

3. Parties to Whom Your Personal Data Is Transferred and the Purposes of Transfer

Your collected personal data may be transferred to third parties within the scope of the purposes set out below, in compliance with the fundamental principles prescribed in the Law and within the conditions specified in Articles 8 and 9 of the Law.

Personal Data Category	Identity Information Full Name, Signature, Turkish Republic Identity Number, Title, Photocopy of ID, Place of Birth, Date of Birth, National ID Card Serial Number and other personal data on older ID documents, Tax Identification Number
Domestic Transfer	Real persons or private law legal entities, Authorized public institutions and organizations, Business partners
International Transfer	No international transfer.

Personal Data Category	Contact Information Phone Number, Email Address, Address, Subscription Number
Domestic Transfer	Real persons or private law legal entities, Authorized public institutions and organizations, Business partners
International Transfer	No international transfer.

Personal Data Category	Customer Transaction Request Information, Invoice and Related Documents
Domestic Transfer	Real persons or private law legal entities, Authorized public institutions and organizations, Business partners
International Transfer	No international transfer.

Personal Data Category	Finance Account Information, Card Information, Payment Information
Domestic Transfer	No transfer to third parties.
International Transfer	No international transfer.

Personal Data Category	Transaction Security IP Address, Log Records, Cookie Records
Domestic Transfer	Authorized public institutions and organizations
International Transfer	No international transfer.

Personal Data Category	Visual and Audio Records Video Recording, Audio Recording
Domestic Transfer	Authorized public institutions and organizations
International Transfer	No international transfer.

4. Method of Collection of Your Personal Data and Legal Basis

Your personal data is obtained and processed by Netgsm based on the conditions regulated under Articles 5 and 6 of the Law, and, in the absence of any such condition, within the scope of your explicit consent.

Personal Data Category	Identity Information Full Name, Signature, Turkish Republic Identity Number, Title, Photocopy of ID, Place of Birth, Date of Birth, National ID Card Serial Number and other personal data on older ID documents, Tax Identification Number
Collection Method	Shared by the customer from the beginning of customer/subscriber transactions.
Legal Basis	Article 5/1: Explicit Consent Article 5/2 (a): Where expressly provided for by law, Article 5/2 (b): Where it is necessary to protect the life or physical integrity of the individual or another person, in cases where the individual is unable to express consent due to actual impossibility or where their consent is not legally valid, Article 5/2 (c): The conclusion or performance of a contract, Article 5/2 (ç): Where it is necessary for the data controller to fulfill its legal obligations, Article 5/2 (e): Where data processing is necessary for the establishment, exercise, or defense of a legal claim, Article 5/2 (f): Where processing is necessary for the legitimate interests of the data controller, provided that such processing does not infringe upon the fundamental rights and freedoms of the data subject.

Personal Data Category	Contact Information Phone Number, E-Mail Address, Address, Subscriber Number
Collection Method	Shared by the customer from the beginning of customer/subscriber transactions.
Legal Basis	Article 5/2 (a): Where expressly provided for by law, Article 5/2 (b): Where it is necessary to protect the life or physical integrity of the individual or another person, in cases where the individual is unable to express consent due to actual impossibility or where their consent is not legally valid, Article 5/2 (c): The conclusion and performance of a contract, Article 5/2 (ç): It is necessary for the data controller to fulfill its legal obligations, Article 5/2 (e): Data processing is necessary for the establishment, exercise, or defense of a legal claim Article 5/2 (f): Where processing is necessary for the legitimate interests of the data controller, provided that such processing does not infringe upon the fundamental rights and freedoms of the data subject.

Personal Data Category	Customer Transaction Request Information, Invoice and Related Documents
Collection Method	Shared by the customer/subscriber within the scope of the performance of contracts.
Legal Basis	Article 5/1: Explicit Consent Article 5/2 (a): Where expressly provided for by law, Article 5/2 (b): Where it is necessary to protect the life or physical integrity of the individual or another person, in cases where the individual is unable to express consent due to actual impossibility or where their consent is not legally valid, Article 5/2 (c): The conclusion and performance of a contract, Article 5/2 (ç): Where it is necessary for the data controller to fulfill its legal obligations, Article 5/2 (e): Where data processing is necessary for the establishment, exercise, or defense of a legal claim

Personal Data Category	Finance Account Information, Card Information, Payment Information
Collection Method	Shared by the customer/subscriber within the scope of the performance of contracts.
Legal Basis	Section 5/2 (a): Where expressly provided for by law, Article 5/2 (c): The conclusion or performance of a contract, Article 5/2 (ç): It is necessary for the data controller to fulfill its legal obligations, Article 5/2 (e): Data processing is necessary for the establishment, exercise, or defense of a legal claim

Personal Data Category	Transaction Security IP Address, Log Records, Cookie Records
Collection Method	Obtained when the customer/subscriber or prospective customer/subscriber visits the website for the purpose of entering into a contract or performs account management operations.
Legal Basis	Article 5/1: Explicit Consent Article 5/2 (a): Where expressly provided for by law, Article 5/2 (b): Where it is necessary to protect the life or physical integrity of the individual or another person, in cases where the individual is unable to express consent due to actual impossibility or where their consent is not legally valid, Article 5/2 (c): The conclusion and performance of a contract, Article 5/2 (ç): Where it is necessary for the data controller to fulfill its legal obligations, Article 5/2 (e): Where data processing is necessary for the establishment, exercise, or defense of a legal claim

Personal Data Category	Visual and Audio Records Video Recording, Audio Recording
Collection Method	Video recordings are captured at the start of a digital subscription, while audio recordings are captured during phone or PBX calls.
Legal Basis	Article 5/1: Explicit Consent, Article 5/2 (c): The conclusion and performance of a contract, Article 5/2 (ç): Necessary for the data controller to fulfill its legal obligations, Article 5/2 (e): Necessary for the establishment, exercise, or defense of a legal claim

5. Your Rights as a Personal Data Owner and How to Exercise Them

Pursuant to Article 11 of the Law, subject to the exceptions set out in Article 28, we hereby inform you that as data owners you have the following rights:

To learn whether your personal data is being processed,
To request information if your personal data has been processed,
To learn the purpose of processing your personal data and whether it is being used in accordance with its purpose,
To know the third parties to whom your personal data has been transferred, domestically or abroad,
To request correction of your personal data if it has been processed incompletely or inaccurately, and to request that the correction be notified to the third parties to whom your personal data has been transferred,
To request deletion or destruction of your personal data in the event that the reasons requiring its processing cease to exist, even if it has been processed in accordance with the Law and other relevant legislation, and to request that this action be notified to the third parties to whom your personal data has been transferred,
To object to a result that is to your detriment arising from the analysis of processed data exclusively through automated systems,
To claim compensation for damages in the event that your personal data is processed unlawfully.

Regarding your requests related to the rights listed above, you may submit your written and wet-signed petition — containing the minimum requirements set out in the Communiqué on Procedures and Principles for Applications to the Data Controller — in person to the Company's headquarters at Batı Bulvarı ATB İş Merkezi G Blok No:194 Macunköy - Yenimahalle/ANKARA, send it via notary public, submit it with an electronic signature via our KEP (registered electronic mail) address at [email protected], or if your e-mail address is registered in our systems, send it to us at [email protected].