Information Notice on the Protection of Personal Data

NRD Menkul Değerler A.Ş. ("NRD" or the "Company") acts as the data controller within the meaning of Turkish Personal Data Protection Law No. 6698 ("KVKK").

• Legal name: NRD Menkul Değerler A.Ş.
• Address: Finans Cd, 34760 Ümraniye/İstanbul, Türkiye
• Contact: info@nrdmenkuldegerler.com

The following categories of personal data may be processed in the course of our services:

• Identity data: name, surname, Turkish national ID number, date of birth.
• Contact data: e-mail address, phone number, postal address.
• Customer transaction data: account movements, buy/sell orders, portfolio information.
• Financial data: bank-account details, declared income, investment profile.
• Transaction-security data: IP address, session logs, device information.
• Request / complaint data: messages submitted via the contact form.
• Marketing data (only with explicit consent): preferences and feedback on marketing communications.

Your personal data are processed for the following purposes:

• conducting capital-markets activities and brokerage services;
• fulfilling Know-Your-Customer (KYC) and customer-suitability obligations;
• complying with the legal obligations imposed by the relevant regulator, MASAK (Financial Crimes Investigation Board / Mali Suçları Araştırma Kurulu), the BDDK (Banking Regulation and Supervision Agency / Bankacılık Düzenleme ve Denetleme Kurumu) and other competent authorities;
• managing account opening, request and complaint processes;
• operating information-security processes and preventing fraud;
• managing legal proceedings and disputes;
• conducting marketing communications where you have provided explicit consent.

Your personal data are processed on the following legal grounds set out in Articles 5 and 6 of the KVKK:

• necessity for the conclusion or performance of a contract;
• being expressly provided for by law (notably the Capital Markets Law No. 6362 / 6362 sayılı Sermaye Piyasası Kanunu, the Anti-Money Laundering Law No. 5549 / 5549 sayılı Suç Gelirlerinin Aklanmasının Önlenmesi Hakkında Kanun and related secondary legislation);
• necessity to fulfil legal obligations;
• necessity for the establishment, exercise or protection of a right;
• our legitimate interests, provided this does not harm the data subject's fundamental rights and freedoms;
• your explicit consent.

Your personal data may be transferred, in line with Articles 8 and 9 of the KVKK, to: competent public authorities (the relevant regulator, BDDK, MASAK, courts, tax authorities); Istanbul Settlement and Custody Bank (Takasbank); the Central Securities Depository of Türkiye (MKK / Merkezi Kayıt Kuruluşu); Borsa İstanbul A.Ş.; supporting law firms and independent auditors; our information-technology service providers; and our cloud-infrastructure providers. Cross-border transfers are made, under Article 9 of the KVKK, only to countries deemed to provide adequate protection or where adequate safeguards are otherwise in place — and otherwise only with your explicit consent.

Your personal data are collected by automatic or partly automatic means via account-opening forms, our website, e-mail, physical and electronic agreements, our mobile applications and our authorised intermediaries.

Your personal data are retained for as long as required by statutory retention obligations: 10 years under capital-markets legislation, 10 years for commercial books, and 8 years under MASAK requirements. After these periods, data are deleted, destroyed or anonymised in accordance with our destruction policy.

Under Article 11 of the KVKK, you have the following rights at any time:

• to learn whether your personal data are being processed;
• to request information regarding such processing;
• to learn the purpose of processing and whether data are used in accordance with that purpose;
• to know the third parties to whom data have been transferred, domestically or abroad;
• to request rectification of incomplete or inaccurate data;
• to request erasure or destruction of your data within the conditions of the KVKK;
• to request that rectification, erasure or destruction be communicated to third parties to whom data have been transferred;
• to object to outcomes adverse to you that result from automated analysis of your data;
• to seek compensation for any damages suffered as a result of unlawful processing.

To exercise the rights above, in line with the Communiqué on the Procedures and Principles for Application to the Data Controller, you may submit your request:

• by e-mail from your registered address to info@nrdmenkuldegerler.com;
• in writing by wet-signed petition delivered to our head-office address.

Your request will be answered free of charge within 30 days at the latest. Your right to lodge a complaint with the Personal Data Protection Authority (Kişisel Verileri Koruma Kurulu) is reserved.