YYH NOVA SA PRIVACY POLICY

FOREWORD

As YYH NOVA SA, we attach great importance to the protection of your personal data and/or special categories of personal data within the scope of the protection of personal data. We exercise utmost care in storing all personal data and/or special categories of personal data belonging to you that are provided to our Company through various means. In this regard, YYH NOVA SA has taken the necessary technical and administrative measures to ensure compliance with applicable legislation. We would also like to emphasize that we will protect your rights guaranteed by law. Accordingly, you may safely share your personal data with YYH NOVA SA and communicate your suggestions, complaints, and concerns to us.

In particular, we hereby share with you our Privacy Policy, which has been implemented within YYH NOVA SA and which is of particular importance with regard to the protection of your personal data.

YYH NOVA SA

1.DEFINITIONS

Definition	Description
Data Controller	Means YYH NOVA SA, which determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.
Data Subject	Means the natural person whose personal data is processed.
Company	Means YYH NOVA SA under this Policy.
Law	Means the Law on the Protection of Personal Data.
Personal Data	Means any information relating to an identified or identifiable natural person.
Special Categories of Personal Data	Means data relating to a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, membership of an association, foundation or trade union, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
Board	Means the Personal Data Protection Board.
Policy	Means this Privacy Policy.
Processing of Personal Data	Means any operation performed on personal data, including obtaining, recording, storing, retaining, modifying, rearranging, disclosing, transferring, acquiring, making available, classifying, or preventing the use of personal data, whether wholly or partially by automated means or by non-automated means as part of a data recording system.
Explicit Consent	Means consent relating to a specific subject, based on being informed and freely given.
Destruction	Means rendering personal data inaccessible, irretrievable, and unusable by anyone in any manner.
Deletion	Means rendering personal data inaccessible and unusable for the relevant users in any manner.
Anonymization	Means rendering personal data incapable of being associated, in any manner whatsoever, with an identified or identifiable natural person, even when matched with other data.
Disposal	Means the deletion, destruction, or anonymization of personal data.
Data	Means personal data and special categories of personal data collectively.

2.PURPOSE OF THE PRIVACY POLICY

The protection of personal data and compliance with the law constitute our fundamental principles. As YYH NOVA SA (hereinafter referred to as “YYH NOVA SA” or the “Company”), all personal data and/or special categories of personal data obtained from you in the course of our activities have been kept confidential and have not been shared with third parties. In this regard, our Company has always exercised the necessary care regarding the protection of personal data and/or special categories of personal data. Furthermore, our internal regulations have been revised in accordance with the Law on the Protection of Personal Data (hereinafter referred to as the “Law” ), and the necessary technical and administrative measures have been taken. Going forward, YYH NOVA SA accepts, declares, and undertakes to comply with all obligations imposed by the Law.

3.SCOPE OF THE PRIVACY POLICY

This Privacy Policy has been prepared in accordance with the Law on the Protection of Personal Data.

Your personal data and/or special categories of personal data are processed with your consent or under circumstances permitted by law.

Such data is used for the following purposes:

Ensuring the security of the Company;
Providing you with complete services;
Carrying out our commercial activities;
Resolving your problems promptly;
Improving our quality.

Certain personal data and/or special categories of personal data received from you are de-identified and anonymized in accordance with the procedures prescribed by the Law. Data used for statistical purposes is not subject to the provisions of the Law and does not fall within the scope of this Policy. As YYH NOVA SA, we reserve the right to amend this Policy in order to protect personal data in compliance with the Law.

The purpose of this Privacy Policy is to protect the data obtained by YYH NOVA SA through any means from natural and legal persons with whom YYH NOVA SA cooperates, its customers, employees, and all other persons. In this regard, this Policy contains various provisions intended to achieve this objective.

4.FUNDAMENTAL PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA

Our fundamental principles regarding the processing of personal data and/or special categories of personal data are as follows. Accordingly, these principles shall apply to data processed by YYH NOVA SA based on explicit consent or under circumstances permitted by law.

Compliance with the Law: YYH NOVA SA verifies the source and lawfulness of personal data and/or special categories of personal data received from natural and legal persons and collected through various means. Accordingly, obtaining data lawfully is of particular importance to YYH NOVA SA.
Compliance with the Principles of Good Faith: YYH NOVA SA verifies the source of personal data and/or special categories of personal data received from natural and legal persons and collected through various means. Accordingly, obtaining data in accordance with the principles of good faith is of particular importance to YYH NOVA SA.
Being Relevant, Limited, and Proportionate to the Purpose for Which They Are Processed: YYH NOVA SA uses personal data and/or special categories of personal data obtained through various means in accordance with the purpose for which they are processed, limited to such purpose, in a proportionate manner, and to the extent required for the provision of the relevant service.
Accuracy of Personal Data and/or Special Categories of Personal Data: YYH NOVA SA attaches importance to ensuring that personal data and/or special categories of personal data received from natural and legal persons and collected through various means do not contain inaccurate information and are accurate. However, YYH NOVA SA is not obliged to verify the accuracy of personal data and/or special categories of personal data declared by its customers or by natural and legal persons with whom it is in contact, as such verification is not legally or operationally feasible.
Keeping Data Up to Date Where Necessary: If there has been any change in personal data and/or special categories of personal data obtained by YYH NOVA SA through various means, YYH NOVA SA attaches importance to such changes being communicated to the Company and to updating the relevant data once the change has been communicated.
Processing for Specific and Legitimate Purposes: YYH NOVA SA processes personal data and/or special categories of personal data based on the explicit consent provided by the data subject or, where permitted by law, without obtaining explicit consent. The purpose of processing each category of data is specific, and no personal data processing activity is carried out for any illegitimate purpose.
Retention for the Period Prescribed by Law and/or Required for the Purpose for Which the Data Is Processed: YYH NOVA SA retains personal data and/or special categories of personal data for the periods prescribed by the relevant laws and/or for the periods necessary for the purposes for which they are processed. Once such purposes cease to exist, the data is anonymized, destroyed, or deleted.

5.DELETION, DESTRUCTION, AND ANONYMIZATION OF PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA

Your personal data and/or special categories of personal data shall be deleted, destroyed, or anonymized upon the expiry of the applicable statutory limitation and retention periods prescribed by law, completion of judicial proceedings, or cessation of other requirements relating to the purpose for which the data was processed. Deletion, destruction, and anonymization may be carried out upon the request of the relevant data subject or ex officio by YYH NOVA SA.

6.DATA MINIMIZATION PRINCIPLE

The data minimization principle, also referred to as the principle of maximum economy, means that personal data and/or special categories of personal data received through various means are transferred to our Company's systems only to the extent necessary.

The data to be collected by YYH NOVA SA is determined according to the purpose for which it is collected and may vary accordingly. In this context, data is collected in accordance with the relevant purpose, and data unrelated to such purpose is not collected. Excess data unrelated to the purpose is not recorded in the Company's systems and is deleted, destroyed, or anonymized. However, such data may be used for statistical purposes.

7.CONFIDENTIALITY AND SECURITY OF DATA

As YYH NOVA SA, we attach importance to the confidentiality of your personal data and/or special categories of personal data. Accordingly, any personal data and/or special categories of personal data received by our Company through any means shall be treated as confidential. YYH NOVA SA respects the confidentiality of such data at every stage of its commercial activities and fully complies with this Privacy Policy.

Necessary technical and administrative measures are taken to prevent personal data and/or special categories of personal data collected through various means from falling into the hands of unauthorized persons, to prevent any harm or victimization of data subjects, and to ensure the protection of such data. In addition, where necessary, data protection requirements are imposed on third parties to whom we disclose personal data and/or special categories of personal data in accordance with applicable law. Our software programs are also regularly updated and continuously renewed. All technological requirements are fulfilled and compliance with applicable standards is ensured in order to provide a high level of protection.

8.UP-TO-DATENESS OF DATA

The principle of keeping data up to date is fundamental within YYH NOVA SA. Accordingly, personal data and/or special categories of personal data obtained through various means may be updated where necessary or upon request. YYH NOVA SA also takes the necessary measures regarding the updating of data.

9.ACCURACY OF DATA

YYH NOVA SA has adopted the principle that declared personal data and/or special categories of personal data must be accurate. YYH NOVA SA is not obliged to verify the accuracy of personal data and/or special categories of personal data declared by its customers or by natural and legal persons with whom it is in contact, as such verification is not legally or operationally feasible. Accordingly, transactions are carried out on the basis that the declared data is accurate.

10.PURPOSES OF PROCESSING PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA

Personal data and/or special categories of personal data are processed in line with the purposes set out in the Information Notices issued by YYH NOVA SA. Such Information Notices may vary depending on the personal data and/or special categories of personal data being processed. Accordingly, the purposes of processing personal data and/or special categories of personal data may also vary depending on the content of the relevant Information Notice.

11.PROCESSING OF PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA FOR ADVERTISING PURPOSES

Consent must be obtained from recipients before sending electronic communications for advertising purposes. Accordingly, electronic communications for advertising purposes may only be sent to persons whose prior consent has been obtained.

YYH NOVA SA acts in compliance with applicable legislation when sending commercial electronic communications for advertising purposes. Consent is obtained and the details of such consent are observed in accordance with the applicable legislation. Such consent may be obtained through any means of electronic communication or in writing in a physical environment. The essential elements of the consent are the affirmative declaration of will of the recipient of the commercial electronic communication agreeing to receive such communication, together with the recipient's electronic communication address and name and surname.

The consent obtained from the recipient covers all commercial electronic communications sent to electronic communication addresses for purposes such as marketing and promoting the Company's goods and services, promoting its business, increasing its recognition, and sending messages containing greetings, good wishes, congratulations, and similar content.

In addition, before commercial electronic communications are sent, individuals are informed that their personal data may be processed and, where necessary, their explicit consent is obtained. Such commercial communications are also sent in compliance with the provisions of applicable legislation.

12.COLLECTION AND PROCESSING OF PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA WITHIN THE SCOPE OF A CONTRACTUAL RELATIONSHIP

Where a contractual relationship has been established with customers or prospective customers, personal data collected pursuant to the contract may be processed by YYH NOVA SA without obtaining explicit consent. Where the processing of special categories of personal data is involved, such data may be processed based on explicit consent or on the legal grounds set forth under Article 6 of the Law. Such data is used for the provision of goods and/or services, performance of the contract, and conduct of commercial activities. Such data may be updated at any time by contacting the customers.

13.PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA PROCESSED THROUGH AUTOMATED SYSTEMS

Data obtained from information collected through automated systems without the explicit consent of individuals may not be used against such individuals. YYH NOVA SA acts in compliance with the provisions of applicable legislation when processing personal data and/or special categories of personal data through automated systems.

14.PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA OF YYH NOVA SA EMPLOYEES

PROCESSING WITHIN THE SCOPE OF LEGAL OBLIGATIONS: Employees' personal data may be processed by YYH NOVA SA without obtaining explicit consent where the relevant Law expressly provides for the processing of such data or where processing is necessary for the fulfillment of the data controller's legal obligations.

PROCESSING OF PERSONAL DATA IN ACCORDANCE WITH THE EMPLOYMENT CONTRACT AND EMPLOYMENT RELATIONSHIP: Employees' personal data may be processed without obtaining their explicit consent to the extent necessary and proportionate to establish and maintain the employment relationship between the employees and the Company. YYH NOVA SA undertakes to protect the personal data of its employees, maintain its confidentiality, and take the necessary measures in this regard under all circumstances.

PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA OF EMPLOYEES: Pursuant to the Law No. 6698 on the Protection of Personal Data, the processing of special categories of personal data requires the explicit consent of the person whose data is to be processed, as well as the implementation of the necessary measures prescribed by the Board. When processing special categories of personal data, YYH NOVA SA takes both the explicit consent of the data subject, where necessary, and the measures determined by the Board, in accordance with the Law and the principles established by the Board. However, special categories of personal data may be processed without the explicit consent of the data subject in limited circumstances stipulated by the Law, provided that such processing is limited and proportionate.

PERSONAL DATA PROCESSED THROUGH AUTOMATED SYSTEMS: Certain personal data of employees may be processed through automated systems. Such data may be used for employee performance evaluations, maintaining statistical records, promotions within the Company, and scoring. Employees have the right to object to adverse outcomes concerning them. Such objections must be made in accordance with the Company's internal rules and procedures and shall be evaluated within the Company.

PROCESSING OF PERSONAL DATA FOR THE BENEFIT OF EMPLOYEES: Employees' personal data may be processed by YYH NOVA SA without obtaining explicit consent where such processing is necessary for transactions benefiting the employee within the scope of the employment relationship established by the employment contract. YYH NOVA SA may also process employees' personal data in disputes relating to the employment relationship between YYH NOVA SA and its employees.

INTERNAL TELECOMMUNICATION, INTERNET, AND COMMUNICATION: For the purpose of facilitating the performance of work, YYH NOVA SA may allocate computers, telephones, vehicles, applications, software, and e-mail accounts to employees. YYH NOVA SA may monitor and audit personal data contained in or processed through the tools allocated to employees. However, YYH NOVA SA also fulfills its obligation to provide the necessary Information Notice in this regard.

Employees may not use the tools allocated to them for private purposes. Such tools must be used solely for the performance of their duties. Employees further accept, declare, and undertake that, from the commencement of their employment relationship with YYH NOVA SA, they will not store any data or information on the allocated tools other than data or information related to their work and required for the performance of their duties.

15.TRANSFER OF PERSONAL DATA AND/OR SPECIAL CATEGORIES OF PERSONAL DATA WITHIN AND OUTSIDE THE COUNTRY

YYH NOVA SA, may transfer data domestically and internationally in accordance with the conditions stipulated under the Law on the Protection of Personal Data and the principles established by the Board, where legally.

YYH NOVA SA, acts in compliance with applicable legislation when transferring personal data and/or special categories of personal data.

16.AUDIT AND DATA PROCESSING SECURITY

Necessary technical and administrative measures are taken to prevent personal data and/or special categories of personal data collected through various means from falling into the hands of unauthorized persons, to prevent harm or victimization of data subjects, and to ensure the protection of such data. In addition, where necessary and in accordance with applicable law, data protection requirements are imposed on companies to which we disclose personal data and/or special categories of personal data. Our software programs are regularly updated, continuously renewed, and developed. All technological requirements necessary to ensure a high level of protection are fulfilled and compliance with applicable standards is ensured. In parallel with all of the foregoing, YYH NOVA SA has all necessary internal and external audits conducted to ensure the protection of personal data and/or special categories of personal data.

17.NOTIFICATION OF DATA BREACHES

In the event of any data breach, YYH NOVA SA immediately takes the necessary action to remedy the breach reported to it. It takes the necessary measures to minimize any harm suffered by the data subject. You may submit a notification regarding breaches in accordance with the procedures specified on our Company's website. In addition, where personal data and/or special categories of personal data are obtained by unauthorized third parties from outside the Company, the Company shall directly notify the Personal Data Protection Board of the matter.

18.RIGHTS OF THE DATA SUBJECT REQUESTING INFORMATION

YYH NOVA SA acknowledges that, in accordance with the Law, the data subject must be informed before data processing takes place and, where necessary, explicit consent must be obtained. Following the processing of data, the data subject has the right to request information regarding their data, as well as to have such data updated, deleted, destroyed, or anonymized.

Data subjects have the following rights regarding their personal data:

a) To learn whether personal data is being processed;
b) To request information if personal data has been processed;
c) To learn the purpose of processing personal data and whether such data is being used in accordance with that purpose;
ç) To know the third parties to whom personal data is transferred, whether within Türkiye or abroad;
d) To request the correction of personal data if it has been processed incompletely or inaccurately;
e) To request the deletion or destruction of personal data;
f) To request that third parties to whom personal data has been transferred be notified that incomplete or inaccurate data has been corrected or that, upon the request of the data subject, such data has been deleted or destroyed;
g) To object to the occurrence of a result against the person arising from the analysis of processed data exclusively through automated systems;
h) To request compensation for damages in the event that the person suffers damage.

Requests for information made on behalf of another person shall not be answered by the Company. If YYH NOVA SA determines that an application has been made on behalf of another person, all rights of YYH NOVA SA to bring legal proceedings and make claims shall be reserved. Requests of data subjects shall be answered as soon as possible and no later than thirty days from the date on which the relevant request reaches YYH NOVA SA. Where deemed necessary, YYH NOVA SA may request additional information and documents from the applicant.

19.UPDATES

Any amendments made to this Privacy Policy are listed and shown in the table below.

Policy Update Date	Amendments