CFA BAĞIMSIZ DENETİM A.Ş. INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA

As CFA Bağımsız Denetim A.Ş. (the “Company”), we attach great importance to the security and privacy of your personal data. In this context, in accordance with the Law on the Protection of Personal Data No. 6698 (“KVKK”), as the “Data Controller”, we would like to inform you about the collection methods, processing purposes, legal grounds, and your rights regarding your personal data obtained through our website (contact forms, career pages, etc.).

1. Identity of the Data Controller

In accordance with the KVKK, the “Data Controller” is the legal entity of CFA Bağımsız Denetim A.Ş.

2. Your Processed Personal Data and Purposes of Processing

Your personal data processed due to your visit to our website and filling out the forms are processed for the purposes specified in the table below:

Data Category	Purpose of Processing
Identity and Contact Data (Name, surname, e-mail, phone, etc.)	Evaluating requests, complaints, and suggestions received via contact forms and providing feedback to you.
Professional Experience and Education Data (CV, educational background, etc.)	Conducting recruitment processes and evaluating applications via career forms and job application channels.
Transaction Security Data (IP address, log records, etc.)	Ensuring the security of the website and fulfilling legal obligations under Law No. 5651.

3. Transfer of Personal Data

Your personal data may be transferred in line with the realization of the purposes stated above and within the framework of the conditions specified in Articles 8 and 9 of the KVKK:

• To authorized public institutions and organizations in order to fulfill our legal obligations,
• To our technology and infrastructure suppliers and business partners located domestically or abroad (depending on your explicit consent or legal exceptions) in order to sustain the infrastructure, hosting, and e-mail services of our website.

4. Method and Legal Basis for Collecting Personal Data

Your personal data is collected by wholly or partially automated means through your completion of the electronic forms on our website. This data is processed based on the following legal grounds specified in Article 5 of the KVKK:

• “It is necessary to process the personal data of parties of a contract, provided that the processing is directly related to the execution or performance of the contract”,
• “It is mandatory for the data controller to be able to perform its legal obligation”,
• “Processing of data is mandatory for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject”,
• For matters such as long-term storage in the recruitment pool or secure cloud infrastructure transfers based abroad, processing is based on the legal ground of “Explicit consent”.

5. Rights of the Data Subject (KVKK Article 11)

Pursuant to Article 11 of the KVKK, you have the right to apply to our Company to:

• Learn whether your personal data is being processed, and request information if it has been processed,
• Learn the purpose of the processing and whether they are used in accordance with their purpose,
• Know the third parties to whom personal data is transferred domestically or abroad,
• Request correction of personal data if it is incomplete or improperly processed, and request notification of the operations made within this scope to third parties to whom your personal data has been transferred,
• Request the deletion or destruction of personal data in the event that the reasons for processing no longer exist, despite being processed in accordance with the provisions of the KVKK and other relevant laws.

You can submit your requests regarding your rights in writing to our Company’s address at Megapol Çarşı Kule Halkapınar Mah. 1203/11 Sk. No:5-7  Office 79 Konak, Izmir, 35170 TURKEY or via your registered e-mail address to infobd@cfadenetim.com.tr Depending on the nature of your request, it will be concluded free of charge as soon as possible and within thirty days at the latest.