Protection, Processing, and Privacy Policy of Personal Data

INTRODUCTION The Personal Data Protection Law No. 6698 (“Law”) came into force on April 7, 2016. The Law defines personal data and establishes the principles and conditions for processing such data. According to the Law, personal data refers to any information relating to an identified or identifiable natural person. Processing personal data involves any operation performed on personal data through automatic or non-automatic means as part of a data recording system, including but not limited to collection, recording, storage, alteration, and sharing with third parties. Uzunpınar & Tüfek International Law Firm (“Law Firm”) implements necessary administrative and technical measures to ensure compliance with the Law. This Policy outlines the principles and processes for processing personal data by the Law Firm.

PRINCIPLES RELATING TO THE PROCESSING OF PERSONAL DATA In accordance with Article 20/III of the Constitution, personal data is processed only under circumstances provided by law or with the explicit consent of the individual concerned. Personal data is processed following these principles: • Lawfulness and fairness • Accuracy and being up-to-date • Specific, explicit, and legitimate purposes • Relevance, limitation, and proportionality to the purpose of processing • Retention only for the duration necessary for the purposes for which data was processed

PURPOSES OF PERSONAL DATA PROCESSING The Law Firm processes personal data for the following purposes: • Provision of legal advisory services • Tracking and management of legal processes • Management of financial processes • Management and fulfillment of requests from clients and prospective clients • Management of information security and technical infrastructure • Provision of legally required information to authorized public institutions and organizations

TRANSFER OF PERSONAL DATA The Law Firm may transfer personal data to third parties only when conditions set forth in the Law are met and appropriate security measures are taken. International transfers of data are conducted in compliance with conditions specified in the Law.

SECURITY AND STORAGE OF PERSONAL DATA The Law Firm adopts technical and administrative measures to ensure the security of personal data. Personal data is stored for the duration required by legal obligations and operational purposes, after which the data is deleted or anonymized.

RIGHTS OF PERSONAL DATA SUBJECTS AND APPLICATION Data subjects have the right to: • Learn whether their personal data is being processed • Request information about processed personal data • Request correction or deletion of their data • Know the third parties to whom their data has been transferred • Demand compensation for damages incurred due to unlawful processing of personal data

Data subjects may submit their requests to our Law Firm via email at in**@*************ng.com. Applications are concluded within thirty days.

ENFORCEMENT AND UPDATES This Policy is published on the Law Firm’s website (www.utlawconsulting.com) and made accessible to data subjects. The Policy may be updated in line with changing legislation and conditions, and the current version will be published on the same website.