1. Purpose and Scope

1.1. This Policy sets out the principles adhered to by Uzmo Teknoloji Sanayi Limited Şirketi ("UZMO" or the "Company") when processing and protecting personal data, and explains how it fulfills its obligations under the Law No. 6698 on the Protection of Personal Data ("KVKK").

1.2. This Policy covers natural persons whose personal data is processed by UZMO in its capacity as a data controller, such as our customers, users, customer and supplier representatives, potential customers, visitors, and business partners. Processing activities relating to employees and job applicants are governed by separate privacy notices.

1.3. Regarding third-party data uploaded by users to Uzmo applications, UZMO acts as a data processor; for such data, the data security provisions of this Policy and the User Agreement shall apply.

2. Definitions

3. Basic Principles

Pursuant to Article 4 of the KVKK, UZMO processes personal data:

• Lawfully and in accordance with the rule of good faith,
• Accurately and, where necessary, kept up to date,
• For specified, explicit, and legitimate purposes,
• Relevant, limited, and proportionate to the purposes for which they are processed,
• Retained for the period stipulated in the relevant legislation or required for the purpose for which they are processed.

UZMO does not collect personal data under the assumption that it "might be needed in the future"; the purpose and legal ground of each processing activity are determined prior to commencing processing and recorded in the Personal Data Processing Inventory.

4. Processing Conditions

4.1. Personal data is processed with the explicit consent of the data subject or, in the presence of one of the conditions listed under Article 5/2 of the KVKK, without seeking explicit consent: expressly provided for by law; actual impossibility; necessary for the establishment or performance of a contract; fulfillment of a legal obligation; made public by the data subject; necessary for the establishment, exercise, or protection of a right; necessary for the legitimate interests of UZMO, provided that it does not harm the fundamental rights and freedoms of the data subject.

4.2. Explicit consent is not requested where processing can be based on another legal condition; explicit consent shall not be made a prerequisite for service delivery.

4.3. Special categories of personal data are processed pursuant to the conditions under Article 6 of the KVKK (as amended by Law No. 7499) and by taking adequate measures determined by the Board. UZMO keeps the processing of special categories of personal data to a minimum in line with its operations.

4.4. The specific data processed, along with their purposes and legal grounds, are disclosed in the Privacy Notice.

5. Transfer of Data

5.1. Domestic transfers are conducted in accordance with Article 8 of the KVKK, provided that one of the conditions in Articles 5 and 6 is met and strictly limited to the relevant purpose. Recipient groups are detailed in the Privacy Notice.

5.2. Cross-border transfers are carried out pursuant to Article 9 of the KVKK and the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad, in cases where: (a) an adequacy decision exists for the relevant country, sector, or organization; (b) in the absence of an adequacy decision, appropriate safeguards such as standard contractual clauses, binding corporate rules, or undertakings are provided; or (c) in the absence of these, strictly on an occasional basis under one of the statutory exceptions listed in the Law. Standard contracts are notified to the Authority within 5 business days of execution.

5.3. Written contracts containing data security provisions are executed with data processors (hosting, email/SMS, support, etc.).

6. Obligation to Inform

Upon obtaining personal data, UZMO informs data subjects regarding the identity of the data controller, processing purposes, recipients of transfers and their purposes, collection methods, legal grounds, and their rights under Article 11. This obligation to inform is fulfilled separately from any declaration of explicit consent.

7. Data Security

7.1. Pursuant to Article 12 of the KVKK, UZMO takes appropriate technical and administrative measures according to the nature of the data to prevent unlawful processing of personal data, block unauthorized access, and ensure lawful retention.

7.2. Technical Measures: Encryption during transmission and, where necessary, storage; authorization matrix and role-based access; strong authentication; retention of access and operation logs; firewall and anti-malware protection; regular backups and restoration tests; software updates and vulnerability scans; separation of development, test, and production environments; masking and anonymization where appropriate.

7.3. Administrative Measures: Preparation and maintenance of the Personal Data Processing Inventory; regular employee training and awareness; confidentiality provisions in employee and supplier contracts; need-to-know authorization principles; auditing of data processors; internal policies and procedures; regular internal audits.

7.4. Data Breach: Upon becoming aware that personal data has been unlawfully obtained by third parties, UZMO shall notify the Board without delay and within 72 hours at the latest, and notify affected data subjects as soon as reasonably possible; the breach shall be logged and the data breach response plan executed.

8. Storage and Disposal

8.1. Personal data is stored for the period stipulated by applicable legislation or required by the processing purpose. Retention periods are specified in the Personal Data Processing Inventory and the Personal Data Retention and Disposal Policy.

8.2. When all conditions for processing cease to exist, personal data shall be deleted, destroyed, or anonymized ex officio or upon the request of the data subject, pursuant to the Regulation on the Deletion, Destruction, or Anonymization of Personal Data. Periodic destruction is carried out at least once every 6 months; destruction operations are logged, and records are retained for at least 3 years.

9. Rights of the Data Subject and Application

9.1. Data subjects possess the rights listed under Article 11 of the KVKK; these rights and application procedures are explained in detail in the Privacy Notice.

9.2. Applications are accepted in accordance with the Communiqué on the Procedures and Principles for Application to the Data Controller; identity verification is performed, and requests are concluded free of charge as soon as possible and within 30 days at the latest. In case of rejection, written or electronic grounds are provided.

9.3. If an application is rejected, the response is found inadequate, or no response is provided in time, the data subject may lodge a complaint with the Board within 30 days of learning of the response and, in any case, within 60 days from the application date.

10. VERBİS

UZMO annually evaluates the registration criteria (annual number of employees and annual financial balance sheet total) specified by Board decisions; if it falls within the scope of obligation, it registers with VERBİS and keeps its records updated. An exemption from the registration obligation does not eliminate the duty to comply with other provisions of the KVKK.

11. Responsibilities

11.1. The Company Manager / Board of Managers is responsible for the implementation of this Policy. A Personal Data Protection Officer is assigned to coordinate KVKK compliance activities: Reyhan Gümüş - Manager.

11.2. Key duties of the Officer include: maintaining the inventory and policies up to date; responding to data subject applications; managing the data breach process; conducting employee training; monitoring data processor contracts; and overseeing relations with the Authority.

11.3. All UZMO employees and suppliers processing data on behalf of UZMO are obligated to comply with this Policy.

12. Enforcement and Review

12.1. This Policy enters into force upon approval by the Company Manager / Board of Managers, is published at www.uzmo.com.tr, and shall be reviewed at least once a year and upon changes in legislation.

12.2. In case of conflict between this Policy and applicable legislation, statutory provisions shall apply.

Effective / Last Updated Date: October 7, 2026