INFORMATION NOTICE ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

Fineksus Bilişim Çözümleri Ticaret A.Ş. (“Fineksus”) attaches the utmost importance to the security of your personal data. In this regard, Fineksus places great importance on processing and retaining all personal data relating to individuals associated with Fineksus, including persons who benefit from our products and services, in accordance with Law No. 6698 on the Protection of Personal Data (the “Law”). Fully cognizant of this responsibility, we process your personal data in the manner described below and within the limits prescribed by applicable legislation.

IDENTITY OF THE DATA CONTROLLER

1. Collection and Processing of Personal Data and Purposes of Processing

The personal data collected may vary depending on the services, products or commercial activities provided by Fineksus and may be collected verbally, in writing or electronically by automated or non-automated means through offices, the website, social media platforms, mobile applications and similar channels. Your personal data may be generated, updated and otherwise processed for as long as you benefit from Fineksus products and services. Your personal data may also be processed when you use our website with a view to receiving Fineksus services, visit Fineksus or our website, or participate in training sessions, seminars or events organised by Fineksus.

Your personal data will be processed, within the scope of the personal data processing conditions and purposes set out in Articles 5 and 6 of the Law, for the purposes of enabling the relevant business units to carry out the work required for you to benefit from the products and services offered by Fineksus; customising and recommending such products and services in line with your preferences, usage habits and needs; ensuring the legal and commercial security of Fineksus and persons maintaining a business relationship with Fineksus; determining and implementing Fineksus’s commercial and business strategies; and implementing Fineksus’s human resources policies.

2. Recipients of Processed Personal Data and Purposes of Transfer

As a result of the merger and acquisition transaction involving our Company, our Company has become part of the Cleversoft group of companies. Accordingly, personal data processed by our Company may be transferred to Cleversoft group companies, subject to the conditions governing the transfer of personal data set out in Article 8 of the Law and on the legal bases set out in Article 5(2)(f) of the Law, namely that “processing is necessary for the legitimate interests pursued by the data controller, provided that such processing does not prejudice the fundamental rights and freedoms of the data subject”, and Article 5(2)(c) of the Law, namely that “processing of personal data belonging to the parties to a contract is necessary, provided that such processing is directly related to the establishment or performance of the contract”. Such transfers may be made for the purposes of conducting information security processes, carrying out and planning business activities, ensuring business continuity, and receiving services relating to storage, archiving and hosting, including servers, hosting services, software and cloud computing.

No special categories of personal data relating to you, or any information concerning your customers’ anti-money laundering (“AML”) or payment data, is transferred abroad.

3. Transfer of Personal Data Abroad

Where you contact our Company by email, your name, surname, email address, address, signature, mobile telephone number and the other personal data referred to above are transferred abroad because emails sent and received through the international email server, Microsoft 365, are stored in data centres located outside Türkiye. Such transfer is carried out for the purposes of conducting information security processes, conducting communication activities, carrying out and planning business activities, conducting finance and accounting operations, receiving and evaluating suggestions aimed at improving business processes, managing procurement and operational processes relating to goods and services, and conducting strategic planning activities. The transfer is based on the legal ground set out in Article 5(2)(f) of the Law, namely that “processing is necessary for the legitimate interests pursued by the data controller, provided that such processing does not prejudice the fundamental rights and freedoms of the data subject”, and is made under the standard contract executed with our group company Cleversoft CRM Services GmbH, the Microsoft 365 licence holder. The standard contract has been prepared in accordance with Article 9 of the Law, the Regulation on the Procedures and Principles Governing the Transfer of Personal Data Abroad and the applicable secondary legislation, thereby providing appropriate safeguards.

As our Company uses SharePoint and CRM applications within the group, your name, surname, address, email address, telephone number, financial information and customer transaction information are also transferred to our group company Cleversoft CRM Services GmbH, which is located abroad and is the licence holder of the SharePoint and CRM applications, as well as to all other Cleversoft group companies that have access to these systems in their capacity as sub-processors. Such transfers are based on the legal ground set out in Article 5(2)(f) of the Law, namely that “processing is necessary for the legitimate interests pursued by the data controller, provided that such processing does not prejudice the fundamental rights and freedoms of the data subject”, and are made subject to the appropriate safeguards provided by the standard contract executed pursuant to Article 9 of the Law, the Regulation on the Procedures and Principles Governing the Transfer of Personal Data Abroad and the applicable secondary legislation.

4. Method and Legal Basis for the Collection of Personal Data

Your personal data are collected through verbal, written or electronic channels for the purposes set out above, in order to enable the products and services offered by Fineksus to be provided within the applicable legal framework and to enable Fineksus to duly and fully perform its obligations arising from contracts and applicable law. Personal data collected on these legal bases may also be processed and transferred for the purposes specified in Sections 1 and 2 of this Notice, within the scope of the personal data processing conditions and purposes set out in Articles 5 and 6 of the Law.

5. Rights of the Data Subject under Article 11 of the Law

Where you, as a data subject, submit a request concerning your rights to Fineksus through the methods set out below, Fineksus will conclude the request free of charge as soon as possible and, in any event, within thirty days, depending on the nature of the request. Where fulfilment of the request gives rise to an additional cost, Fineksus may charge the fee specified in the tariff determined by the Personal Data Protection Board (the “Board”).

In this context, data subjects are entitled to:

• learn whether their personal data are being processed;
• request information where their personal data have been processed;
• learn the purposes for which their personal data are processed and whether such data are used in accordance with those purposes;
• know the third parties to whom their personal data have been transferred in Türkiye or abroad;
• request the rectification of personal data that have been processed incompletely or inaccurately, and request that the actions taken in this respect be notified to third parties to whom the personal data have been transferred;
• request the erasure or destruction of personal data where the grounds requiring their processing have ceased to exist, notwithstanding that the data were processed in accordance with Law No. 6698 and other applicable laws, and request that the actions taken in this respect be notified to third parties to whom the personal data have been transferred;
• object to the occurrence of a result against themselves arising from the analysis of processed data exclusively by automated systems; and
• claim compensation for damage suffered as a result of the unlawful processing of personal data.

6. Circumstances Where Explicit Consent Is Not Required

Pursuant to Article 5(2) of Law No. 6698 on the Protection of Personal Data, the Company may process personal data without obtaining the data subject’s explicit consent where:

• such processing is expressly provided for by law;
• processing of personal data belonging to the parties to a contract is necessary, provided that such processing is directly related to the establishment or performance of the contract;
• processing is necessary for the Company, in its capacity as data controller, to comply with its legal obligations;
• the personal data have been made public by the data subject;
• processing is necessary for the establishment, exercise or protection of a right; or
• processing is necessary for the legitimate interests pursued by the Company as data controller, provided that such processing does not prejudice the fundamental rights and freedoms of the data subject.

7. Data Subject’s Right to Apply

Pursuant to Article 13(1) of Law No. 6698, you may submit your request concerning the exercise of the rights set out above to Fineksus in writing or by such other methods as may be determined by the Board. As the Board has not, at this stage, determined any other method, your application must be submitted to Fineksus in writing in accordance with Law No. 6698. The channels and procedures through which written applications under Article 11 of Law No. 6698 may be submitted to Fineksus are set out below.

Your request must include the information required to verify your identity and an explanation of the right under Article 11 of Law No. 6698 that you wish to exercise. You may submit your request by any of the following methods:

• complete the data subject application form available at fineksus.com and deliver a signed copy of the form, together with documents verifying your identity, in person or through a notary public to İTÜ Ayazağa Kampüsü, Reşitpaşa Mah., Katar Cad., İTÜ Teknokent Arı-2 No: 4/1/702, 34469 Maslak-Sarıyer, İstanbul/Türkiye;
• sign the application using your “secure electronic signature” within the meaning of Electronic Signature Law No. 5070 and submit the electronically signed application to fineksus@hs03.kep.tr; or
• submit the application from an email address previously notified to Fineksus and registered in Fineksus’s systems to info@fineksus.com.

Fineksus undertakes to update this Information Notice in the event that any amendment to Law No. 6698 on the Protection of Personal Data is published.

Last updated: 07/2026