1. DATA CONTROLLER

Your personal data is processed by SANShine Digital Solutions within the scope of the purposes explained below in accordance with the Law No. 6698 on the Protection of Personal Data (“Law No. 6698”).

2. PURPOSE OF PROCESSING YOUR PERSONAL DATA

Your collected personal data may be processed by our Foundation within the purposes listed below, in accordance with the fundamental principles set out in Law No. 6698 and within the personal data processing conditions specified in Articles 5 and 6 of Law No. 6698.

• Conducting communication activities.

• Execution of Access Authorizations

• Conducting activities in compliance with the legislation

• Carrying out finance and accounting processes

• Ensuring physical space security

• Pursuit and execution of legal affairs

• Conducting business continuity activities

• Organization and event management

• Carrying out social responsibility and civil society activities

3. PURPOSES OF TRANSFERRING YOUR PERSONAL DATA

The collected data may be transferred to third parties foreseen for the execution of the Foundation’s activities (Public institutions and organizations in cooperation, Sanko Holding Companies, Business partners, Suppliers, Program Partners, Foundation Managers/Employees, Legally Authorized Private Law Persons, Authorized Private Persons) in accordance with the principles stipulated in the Law and within the scope of Articles 8 and 9 of Law No. 6698, for the purpose of fulfilling the data processing objectives.

4. METHOD OF COLLECTING YOUR PERSONAL DATA AND LEGAL BASIS

Your personal data will be collected by our Foundation within the scope of the purposes listed in Article 2 and in electronic media. Your collected personal data may be collected, processed, and transferred for the purposes specified in this Clarification Text within the personal data processing conditions set out in Articles 5 and 6 of Law No. 6698.

5. RIGHTS OF THE PERSONAL DATA SUBJECT UNDER ARTICLE 11 OF LAW NO. 6698

As a personal data subject, we inform you that you have the following rights under Article 11 of the Law:

• To learn whether your personal data is processed,

• If your personal data has been processed, to request information regarding this,

• To learn the purpose of the processing of your personal data and whether they are used in accordance with that purpose,

• To know the third parties to whom your personal data is transferred domestically or abroad,

• To request the correction of your personal data if they are incomplete or incorrectly processed, and to request that the third parties to whom your personal data has been transferred be notified of this action,

• To request the deletion or destruction of your personal data in case the reasons requiring their processing cease to exist, even if they have been processed in accordance with the Law and other relevant legislation, and to request that the third parties to whom your personal data has been transferred be notified of this action,

• To object to a result that is unfavorable to you arising from the analysis of the processed data exclusively through automated systems,

• To request compensation for damages if you suffer damage due to the unlawful processing of your personal data.