Protection of Personal Data

Koç Finansman Anonim Şirketi Processing of Personal Data

Explanatory Statement

A) Data Responsible and Representative

As per Law No. 66988 on Protection of Personal Data (“PPD Law”), Koç Finansman Anonim Şirketi (“Company”) shall be entitled to and solely responsible for processing your personal data under the scope explained below.

B) Purposes for Personal Data Processing

Collected personal data will be processed as per the terms and purposes of personal data processing stipulated in the fifth and sixth articles of PPD Law to ensure the legal and commercial security of our Company and the persons in a business relationship with our Company, to enable our business departments to conduct the activities necessary for allowing you to benefit from products and services offered by our Company, to allow products and services of our Company to be recommended to you as personalized according to your liking, usage habits and needs, to determine and implement commercial and business strategies of our Company, and to carry out our Company’s human resources policies.

C) Persons and Purposes for the Transfer of Processed Personal Data

Within the scope of the personal data processing terms and purposes set forth in the eighth and ninth articles of PPD Law and in line with stipulated principles, collected personal data can be transferred mainly to manufacturer; supplier and seller companies of goods or services subject to loan, organizations inland and abroad providing services in automotive, consumer durables, telecommunications, insurance, finance, retail, health, human resources, education, consultancy, delivery and archiving; to persons and institutions legally authorized to obtain information; organizations worked with as suppliers, advisers, persons and institutions authorized for audit, business partners, Group Companies and stakeholders in order to ensure the legal and commercial security of our Company and the persons in a business relationship with our Company, to enable our business departments to conduct necessary activities for allowing you to benefit from products and services offered by our Company, to allow products and services of our Company to be recommended and personalized for you according to your preferences, usage habits and needs, to determine and implement commercial and business strategies of our Company, and to carry out our Company’s human resources policies.

D) Method and Legal Reason for Personal Data Collection

Personal data is collected by our Company, through different channels and based on different legal reasoning, to conduct our commercial activities. Personal data collected through any of the aforementioned legal methods shall also be processed and transferred for the purposes specified in the (b) and (c) articles of this statement on personal data processing conditions and for purposes specified in the fifth and sixth articles of PPD Law.

E) Rights of Personal Data Holder Stated in the Eleventh Article of PPD Law

As the holder of personal data, if you submit requests related to your rights to our Company using the methods specified below in this Explanatory Statement, according to the qualifications of the request, it will be addressed as soon as possible and within thirty days at most, free of charge. However, if any fee is foreseen by Personal Data Protection Committee, such fee shall be collected by our Company. The personal data holders shall, under this scope, have the right to:

• Learn whether his/her personal data has been processed,
• Obtain information regarding how his/her Personal Data has been processed,
• Learn the purpose of processing personal data and whether said data was relevant to the purpose,
• Learn which third parties inland or abroad received transfers of personal data,
• Request a correction to personal data processed incompletely or inaccurately, and request the notification of any parties performing transactions with this data under an inaccurate scope
• Request deletion or erasure of personal data when there is no longer a need to process it even though the data was processed according to the conditions of PPD Law and other relevant laws; and inform third parties to whom personal data was transferred that terms have changed
• Object to exclusive analysis of the processed data via automatic systems and request recovery of any loss which might arise due to unlawful processing of personal data.
• Claim the indemnification of the loss incurred in case of unlawful processing of the personal data.

As per the first sub-clause of the thirteenth article of PPD Law, submit any requests related to use your above-stated rights in writing or by using other methods specified by the Personal Data Protection Committee of our Company. Since the Personal Data Protection Committee has yet to specify a method, submit your application to our Company in writing as per PPD Law. Channels and forms for submitting your requests to our Company under this framework and the eleventh article of PPD Law are explained below.

In order to exercise your above-stated rights, submit a request containing your explanation regarding the right you would like to exercise under the eleventh article of PPD Law, together with information necessary for identification, by completing the Application and by delivering a signed copy of the form to Ünalan Mahallesi Ayazma Caddesi Koç Çamlıca İş Merkezi A Blok 34700 Üsküdar / İstanbul. Deliver the form either by hand, through a notary or using other methods specified by PPD Law, or electronically sign and send the relevant form to kocfinans@kocfinans.hs02.kep.tr