ESAS PORTFÖY YÖNETİMİ ANONİM ŞİRKETİ (“ESAS PORTFÖY” or the “Company”) places the utmost importance on the security of your personal data. With this awareness, we attach great importance to the processing and preservation of personal data belonging to natural persons with whom the Company interacts, in accordance with the Law No. 6698 on the Protection of Personal Data (the “Law”), secondary legislation enacted or to be enacted pursuant to the Law (regulations, communiqués, circulars), and binding decisions made or to be made by the Personal Data Protection Board.

In full awareness of this responsibility, acting as the “Data Controller” as defined under the Law, we process your personal data within the scope and limitations prescribed by the applicable legislation and as described below.

1. Information on the Data Controller

Pursuant to the Law, ESAS PORTFÖY YÖNETİMİ ANONİM ŞİRKETİ, registered with the Istanbul Trade Registry under registration number 1047122 and MERSIS number 0377101766100001, having its registered office at Esas Plaza, Rüzgarlıbahçe Mah. Çam Pınarı Sk. No:8 İç Kapı No:7, 34805 Beykoz / ISTANBUL, is the Data Controller.

2. Purposes of Processing Personal Data

Your personal data are processed by the Company for the following purposes:

• Ensuring that the Company’s business units perform the necessary operations in compliance with legislation and corporate policies;
• Execution of activities aligned with the Company’s short-, medium-, and long-term commercial strategies;
• Design and execution of human resources policies;
• Fulfillment of obligations arising from applicable legislation;
• Management of customer relations and corporate communication processes;
• Ensuring the commercial and legal security of the Company and of the real and legal persons with whom it has business relations.

Your personal data are processed lawfully, fairly, and in a manner that is relevant, limited, and proportionate to these purposes, in line with the principles and limitations set forth in the Law.

3. Transfer of Personal Data

Within the scope of the above-mentioned purposes and in accordance with Articles 8 and 9 of the Law, your personal data may be transferred to:

• Public authorities, judicial and administrative bodies legally authorized to receive such data;
• Private legal or natural persons permitted by applicable legislation;
• Regulatory and supervisory institutions authorized to audit the Company;
• Contracted payment service providers for the fulfillment of financial obligations;
• Business partners and service providers to support and enhance Company operations;
• And, where necessary, to suppliers—provided that adequate security measures are taken in accordance with the Law.

In case your personal data are transferred to foreign-based entities or stored on servers located abroad, the conditions stated in Article 9 of the Law are strictly observed.

4. Method and Legal Basis of Collecting Personal Data

Your personal data are collected by the Company’s authorized units and employees through automatic, semi-automatic, and non-automatic methods in verbal, written, or electronic formats.

In this context, personal data categories may include: identity, contact, location, employment, legal transaction, customer transaction, physical space security, transaction security, risk management, finance, professional experience, marketing, and visual/audio recordings.

These data are processed based on the legal grounds outlined in Article 5/2 of the Law, such as:

• Being explicitly provided for by the laws;
• Being necessary for the establishment or performance of a contract;
• Fulfillment of legal obligations of the data controller;
• Data having been made public by the data subject;
• Necessity for the legitimate interests of the Company, provided it does not harm the fundamental rights and freedoms of the data subject.

5. Rights of Data Subjects Under the Law

According to Article 11 of the Law, you have the following rights regarding your personal data by applying to ESAS PORTFÖY:

• To learn whether your personal data are processed;
• If processed, to request information regarding such processing;
• To learn the purpose of processing and whether they are used in accordance with that purpose;
• To know the third parties to whom your personal data are transferred domestically or abroad;
• To request the correction of incomplete or inaccurate data;
• To request deletion or destruction of your personal data under the conditions stipulated in Article 7 of the Law;
• To request notification to third parties to whom data have been transferred regarding corrections or deletions;
• To object to the emergence of a result against you through the analysis of personal data exclusively via automated systems;
• To claim compensation for damages in case of unlawful processing.

Application Procedures

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests regarding your rights and the implementation of the Law by:

• Completing and signing the application form, which you can obtain from our office or from our website;
• Delivering the form with wet signature in person, via a notary, or registered mail to: Esas Plaza, Rüzgarlıbahçe Mah. Çam Pınarı Sk. No:8 İç Kapı No:7, 34805 Beykoz / ISTANBUL;
• Or, by filling in the form electronically and signing it with your secure electronic signature, and sending it via your KEP (Registered Electronic Mail) address or the email address already registered in the Company’s system to info@esasportfoy.com.

Your requests will be concluded as soon as possible and at the latest within thirty (30) days depending on the nature of the request. If a written response is required, the first ten (10) pages will be provided free of charge, and a fee of 1 Turkish Lira will be charged per page for each additional page. If the response is provided via a storage medium (CD, flash drive), the cost of such medium will be reflected.

ESAS PORTFÖY YÖNETİMİ ANONİM ŞİRKETİ