PDPL

Allbatross Portfolio Management Inc. ("Allbatross Portfolio" or "the Company") places great importance on the protection of personal data. Allbatross Portfolio processes personal data of individuals in accordance with the Personal Data Protection Law No. 6698 ("Law" or "KVKK"), secondary regulations, and the decisions of the Personal Data Protection Board, within the prescribed limits. This Policy has been prepared to fulfill the obligation of informing under Article 10 of the Law and to transparently inform data subjects about their rights under Article 11 of the Law.

This Policy covers all personal data processed by Allbatross Portfolio, either wholly or partially by automated means or non-automated means as part of a data recording system, including shareholders/partners, Board of Directors members, employees, family members of employees, job applicants, reference persons, individual suppliers, supplier employees, supplier representatives, individual customers, corporate customer representatives, investors, issuers, and other third parties.

This Policy provides general information about all personal data processing processes, and separate Clarification Texts are prepared for specific activities involving personal data processing, informing data subjects accordingly.

The processed personal data, the purpose of processing, collection method, legal basis, and the purposes for which it is transferred to whom are included in the Clarification Texts prepared for each data subject.

1. PROCESSING OF PERSONAL DATA

Allbatross Portfolio has adopted the following principles as working principles to ensure the processing and protection of personal data in accordance with Article 20 of the Constitution, the Personal Data Protection Law No. 6698, other secondary regulations, and the decisions of the Personal Data Protection Board.

1.1. General Principles

Personal Data may be processed by Allbatross Portfolio in accordance with the principles listed in Article 4 of the Law and the procedures and principles stipulated in other laws.

• Principle of Compliance with Law and Good Faith: Allbatross Portfolio processes the minimum amount of data necessary, considering the reasonable expectations of data subjects, without deviating from the purpose of data processing. The Company ensures transparency in data processing activities and fulfills the obligation to inform.

• Principle of Accuracy and Currency of Personal Data: Allbatross Portfolio attaches importance to the accuracy and currency of personal data. When necessary, data is updated and its accuracy is confirmed.

• Principle of Processing Personal Data for Specific, Explicit, and Legitimate Purposes: Personal data is processed for definite, clear, and legitimate purposes. Allbatross Portfolio does not process personal data for any purpose other than those specified to the data subject.

• Principle of Being Relevant, Limited, and Proportionate to the Purpose of Processing: Data processing activities are limited to the data necessary for achieving the purpose. The Company avoids processing data that is not relevant or necessary for the purpose.

• Principle of Retaining Personal Data for the Required Period: Allbatross Portfolio retains the personal data it processes in accordance with Article 138 of the Turkish Penal Code and Articles 4 and 7 of the KVKK, only for the period required by the relevant legislation or the purpose of processing. The Company first determines whether a specific period is stipulated by the relevant legislation for the retention of personal data. If a legal period is stipulated, the Company complies with it. If no legal period is stipulated, the necessary period for achieving the processing purpose is determined, and personal data is retained for this limited period. Personal data is destroyed by deletion, destruction, or anonymization at the end of the retention period or upon the request of the data subject.

1.2. Method of Collecting Personal Data

Your personal data may be collected by automated or non-automated methods, during physical visits to our Company, through our business units, oral communication, hand delivery, paper forms, contracts, information collection forms, email, KEP, fax, telephone, website, and similar other means, either verbally, in writing, or electronically. Your personal data will be processed as long as you benefit from Allbatross Portfolio services and may be updated when necessary to ensure the accuracy and currency of your data.

1.3. Legal Basis for Processing Personal Data

According to Article 5, Paragraph 1 of the Law, personal data cannot be processed without the explicit consent of the data subject. Explicit consent is obtained after the data subject is informed about the relevant issue and their free will is obtained. However, under Article 5, Paragraph 2 of the Law, personal data may be processed without the explicit consent of the data subject if one of the following conditions exists:

• Explicitly Provided for by Laws: If the processing of personal data is explicitly provided for by laws, personal data may be processed without the consent of the data subject.

• Impossibility of Obtaining Explicit Consent Due to Actual Impossibility: If it is necessary to process personal data to protect the life or physical integrity of the data subject or another person who is unable to give consent due to actual impossibility or whose consent is not legally valid.

• Directly Related to the Establishment or Performance of a Contract: If the processing of personal data is necessary for the establishment or performance of a contract, personal data may be processed.

• Fulfillment of Legal Obligations by the Data Controller: If the processing of personal data is necessary for the data controller to fulfill its legal obligations, personal data may be processed.

• Publicization by the Data Subject: If personal data has been made public by the data subject, it may be processed limited to the purpose of publicization.

• Necessity of Data Processing for the Establishment, Exercise, or Protection of a Right: If data processing is necessary for the establishment, exercise, or protection of a right, personal data may be processed.

• Necessity of Data Processing for the Legitimate Interests of the Data Controller: The data controller first determines the legitimate interest it will obtain by processing personal data and evaluates the possible impact of data processing on the rights and freedoms of the data subject. If the balance of interests is not disrupted, the processing activity is carried out.

1.4. Processing of Special Categories of Personal Data

Allbatross Portfolio is sensitive to the processing of Special Categories of Personal Data, as additional measures are required for their protection and transfer compared to personal data. Special categories of personal data are data that, if learned, may lead to discrimination or victimization of the data subject. Special categories of personal data listed in Article 6 of the Law include data on race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress, association, foundation or union membership, health, sexual life, criminal conviction, and security measures, as well as biometric and genetic data.

Processing of special categories of personal data without the explicit consent of the data subject is prohibited.

Personal data other than health and sexual life may be processed without the explicit consent of the data subject in cases provided for by laws.

Personal data related to health and sexual life may only be processed without the explicit consent of the data subject by persons under the obligation of secrecy or authorized institutions and organizations for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing.

In the processing of special categories of personal data, sufficient measures determined by the Board must also be taken.

1.5. Categories of Processed Personal Data

Allbatross Portfolio may process personal data in the categories of identity, communication, location, personnel, legal transaction, customer transaction, transaction security, risk management, finance, professional experience, visual and audio recordings, health information, criminal conviction, and security measures, within the scope of the personal data processing conditions specified in Articles 5 and 6 of the Law. The processed personal data may vary depending on the activity conducted by Allbatross Portfolio, and data subjects are informed through separate Clarification Texts prepared for specific activities involving personal data processing.

1.6. Data Subjects

The Policy on the Processing and Protection of Personal Data covers all personal data processed by Allbatross Portfolio, either wholly or partially by automated means or non-automated means as part of a data recording system, including shareholders/partners, Board of Directors members, employees, family members of employees, job applicants, reference persons, individual suppliers, supplier employees, supplier representatives, individual customers, corporate customer representatives, investors, issuers, and other third parties.

1.7. Purposes of Processing Personal Data

Personal Data obtained by Allbatross Portfolio business units may be processed within the scope of the personal data processing conditions specified in Articles 5 and 6 of the Law.

2. TRANSFER OF PERSONAL DATA

The Company acts in accordance with the provisions of Article 8 of the Law regarding the transfer of personal data within the country.

Allbatross Portfolio does not transfer data abroad.

Data transfer is carried out in a manner that is relevant, limited, and proportionate to the purpose of transfer.

This Policy provides general information about all personal data processing processes, and separate Clarification Texts are prepared for specific activities involving personal data processing, informing data subjects about the processed personal data, the purpose of processing, collection method, legal basis, recipient groups, and transfer purposes, as well as their rights under the Law, and obtaining their explicit consent when necessary.

3. ENSURING THE SECURITY AND CONFIDENTIALITY OF PERSONAL DATA

The right to request the protection of personal data was constitutionally guaranteed with the addition of a paragraph to Article 20 of the Constitution by Law No. 5982 in 2010, within the scope of the "right to privacy and protection of private life."

Allbatross Portfolio takes the necessary measures to ensure an appropriate level of security to prevent the unlawful processing of personal data, prevent unlawful access to personal data, and ensure the retention of personal data, in accordance with Article 12 of the Law.

4. PROCESS MANAGEMENT REGARDING THE PROTECTION OF PERSONAL DATA

Our Company attaches great importance to the protection of personal data. Employees are encouraged to participate in KVKK training and to raise awareness. KVKK Policies have been established for our Company, and personal data-related activities are carried out in accordance with the procedures and principles set forth in these policies. Responsible persons and task distributions have been determined for the implementation of the policies, monitoring employee compliance with the policies, publication and updating of the policies, and execution of data destruction processes. Our Company has the authority to make necessary updates in line with legal changes and Board Decisions regarding the processing of personal data and information security. The Company conducts/conducts the necessary audits within the scope of the KVKK. Expert support can be obtained for the execution of the process.

5. RETENTION AND DESTRUCTION OF PERSONAL DATA

Allbatross Portfolio retains personal data for the period required by the purpose of processing and the legal regulations applicable to the relevant activity. In this context, our Company first determines whether a specific period is stipulated by the relevant legislation for the retention of personal data. If a period is stipulated, the Company complies with it. If no legal period is stipulated, personal data is retained for the period necessary for the purpose of processing. Personal data is destroyed by deletion, destruction, or anonymization at the end of the retention period or upon the request of the data subject.

6. INFORMING DATA SUBJECTS

Our Company informs the relevant persons whose data is processed during personal data processing activities about the processed data categories, data processing purposes, data collection method and legal basis, recipient groups and transfer purposes, their rights as data subjects, and the Company as the Data Controller. Our Company fulfills the obligation to inform under Article 10 of the Law in accordance with the procedures and principles set forth in the Guide to Fulfilling the Obligation to Inform published by the Institution. The necessary clarifications are published in electronic or physical environments in accordance with the data collection method.

7. RIGHTS OF DATA SUBJECTS AND THE EXERCISE OF THESE RIGHTS

7.1. Rights of the Data Subject

• Learn whether your personal data is being processed,

• Request information if your personal data has been processed,

• Learn the purpose of processing your personal data and whether they are used in accordance with their purpose,

• Know the third parties to whom your personal data is transferred, domestically or abroad,

• Request the correction of your personal data if it is incomplete or inaccurate, and request that the action taken in this context be notified to third parties to whom your personal data has been transferred,

• Request the deletion or destruction of your personal data if the reasons requiring its processing cease to exist, despite being processed in accordance with the Law and other relevant legal provisions, and request that the action taken in this context be notified to third parties to whom your personal data has been transferred,

• Object to the emergence of a result against you by analyzing the processed data exclusively through automated systems,

• Request compensation for damages if you suffer damage due to the unlawful processing of your personal data.

7.2. Exercise of Rights by the Data Subject

You can submit your applications and requests listed above by filling out the Data Subject Application Form published on our website at https://www.allbatrossportfoy.com/ and delivering a wet-signed copy to our address at Adalet Mah. Şehit Polis Fethi Sekin Cad. No:6 İç Kapı No:202 Bayraklı/İZMİR in person or via notary. You can send your applications via email to kvkk@allbatrossportfoy.com or via KEP using a secure electronic signature or mobile signature to allbatrossportfoy@hs03.kep.tr.

The application must include your name and surname, and if the application is written, your signature, for Turkish Republic citizens, your T.R. identity number, for foreigners, nationality, passport number or, if any, identity number, your residence or workplace address for notification, if any, your email address, telephone and fax number, and the subject of your request. Information and documents related to the subject must be attached to the application. If the application is prepared without filling out the application form, the issues listed in this paragraph must be fully communicated to our Company. Otherwise, the application will not be considered a valid application.

Third parties may submit application requests on behalf of the relevant person whose personal data is processed, provided that a special power of attorney issued through a notary public is available.

Our Company may request confirmatory information to verify that the applicant is the relevant person and to ensure that the application results are communicated to the correct person. (For example, additional confirmations such as sending a message to your registered phone number or calling you may be requested.)

Your request in the application will be concluded as soon as possible and within 30 days at the latest, free of charge. However, if the process requires an additional cost for the Company, the fee determined by the Personal Data Protection Board will be charged by our Company. If your request is accepted, the necessary action will be taken. However, if your request is rejected as a result of the examination and evaluation, the reason for rejection will be communicated to you in writing or electronically.

For detailed information about your rights to apply to the data controller and to file a complaint with the Board, you can refer to Articles 13, 14, and 15 of the Fourth Part of the Law.

7.3. Rejection of the Data Subject's Application

Allbatross Portfolio may reject the application of the data subject by explaining the reason, in the following cases, in accordance with Article 28 of the Law:

• Processing of personal data by natural persons within the scope of activities related to themselves or their family members living in the same residence, provided that it is not disclosed to third parties and data security obligations are complied with.

• Processing of personal data for purposes such as research, planning, and statistics by anonymizing them for official statistics.

• Processing of personal data for artistic, historical, literary, or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public safety, public order, economic security, privacy of private life, or personal rights, or constitute a crime.

• Processing of personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public safety, public order, or economic security.

• Processing of personal data by judicial authorities or enforcement agencies in relation to investigation, prosecution, trial, or execution proceedings.

• The provisions of Articles 10, 11 (except for the right to demand compensation for damages), and 16 of the Law regarding the obligation to inform, the rights of the relevant person, and the obligation to register with the Data Controllers Registry, respectively, shall not apply in the following cases, provided that they are in compliance with the purpose and basic principles of this Law and are proportionate:

• Processing of personal data is necessary for the prevention of crime or criminal investigation.

• Processing of personal data made public by the relevant person.

• Processing of personal data is necessary for the execution of auditing or regulatory duties and disciplinary investigation or prosecution by public institutions and organizations and professional organizations with the nature of public institutions authorized by law.

• Processing of personal data is necessary for the protection of the economic and financial interests of the State with regard to budget, tax, and financial matters.

8. ENTRY INTO FORCE AND IMPLEMENTATION OF THE POLICY

This Policy enters into force on the date of its publication. Allbatross Portfolio reserves the right to make changes to the Policy to provide up-to-date information on practices and legal regulations regarding the protection of personal data. Updates to the Policy or specific articles enter into force on the date of their publication.

The implementation of the Policy is the responsibility of Allbatross Portfolio as the data controller, and the contact person is responsible for tracking, coordinating, and auditing all actions and processes related to compliance with the Law. The relevant legal regulations in force regarding the processing and protection of personal data will primarily apply. In case of any inconsistency between the current legislation and the Policy, Allbatross Portfolio accepts that the current legislation will apply.

DEFINITIONS

EXPLANATION

Personal Data

Any information relating to an identified or identifiable natural person.

Special Categories of Personal Data

Data on race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress, association, foundation or union membership, health, sexual life, criminal conviction, and security measures, as well as biometric and genetic data.

Explicit Consent

Consent that is specific to a particular issue, based on information, and declared with free will. The data subject has the right to withdraw their consent at any time.

Data Controller

The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

Relevant Person/Data Subject

The natural person whose personal data is processed.

Contact Person

The person responsible for ensuring communication between the data controller and the relevant person or the Personal Data Protection Authority.

Processing of Personal Data

Any operation performed on personal data, such as collection, recording, storage, preservation, alteration, reorganization, disclosure, transfer, acquisition, making available, classification, or prevention of use, by wholly or partially automated means or non-automated means as part of a data recording system.

Data Recording System

A recording system in which personal data is structured and processed according to certain criteria.

Anonymization

Making personal data impossible to associate with an identified or identifiable natural person, even by matching with other data.

Board

The Personal Data Protection Board.

Institution

The Personal Data Protection Authority.

Data Processor

It refers to the natural or legal person who processes personal data on behalf of the data controller, based on the authority granted by them.