In accordance with the Law on the Protection of Personal Data No. 6698 ("Law"), your personal data may be processed by Cerebrum Technology Software Industry and Trade Inc. ("Company") as the data controller, within the scope explained below.

Purposes and Legal Grounds for Processing Personal Data Your personal data collected may be processed for the purposes listed below ("Purposes"), under the legal conditions and purposes stated in Articles 5 and 6 of the Law.

Based on the legal ground that processing the personal data of the parties to the contract is necessary provided that it is directly related to the establishment or performance of the contract;

• Your identity and communication data for updating customer contact information,
• Your identity, communication, financial and customer transaction data for opening sales records and performing invoicing activities,
• Your identity, communication, financial and customer transaction data for the establishment or performance of a sales contract due to your purchase of our products and services,
• Your identity, communication, financial and customer transaction data for post-sales support services, call center services and fulfillment of warranty processes

Based on the legal ground that it is expressly required by law and necessary for the data controller to fulfill its legal obligations;

• Your identity, communication, financial, customer transaction and family member and relative data for fulfilling requests from official authorities,
• Your identity, communication, financial, customer transaction and family member and relative data for providing information to authorized institutions arising from legislation,
• Your identity, communication, financial and customer transaction data for ensuring compliance with mandatory retention obligations stipulated by legislation,
• Your identity, communication, financial, customer transaction, process security and family member and relative data for responding to data subject requests in accordance with the legislation and for carrying out necessary procedures

Based on the legal ground that processing personal data is necessary for the legitimate interests of the data controller provided that it does not harm the fundamental rights and freedoms of the data subject;

• Your identity, communication, financial and customer transaction data for tracking financial and sales records,
• Your identity, communication, customer transaction and family member and relative data for managing customer relations,
• Your identity, communication, financial and customer transaction data for carrying out studies and related business processes by our relevant business units to perform commercial activities carried out by our company,
• Your identity, communication, financial and customer transaction data for ensuring the legal, technical and commercial-business security of our company and relevant persons who have business relations with our company,
• Your identity, communication, customer transaction and process security data for determining and implementing commercial and business strategies of our company,
• Your process security data for managing information security processes,
• Your identity, communication, financial, customer transaction and process security data for conducting audit and ethical activities,
• Your identity, communication, financial, customer transaction, process security, request and complaint and family member and relative data for planning and execution of customer satisfaction and corporate communication activities,
• Your identity, communication, customer transaction, process security and family member and relative data for conducting information and announcement activities,
• Your identity, communication, customer transaction, process security and request and complaint data for managing requests and complaints

Based on the legal ground that processing data is mandatory for the establishment, exercise, or protection of a right;

• Your identity, communication, customer transaction, process security and request and complaint data for receiving, evaluating, and finalizing your requests and complaints,
• Your identity, communication, customer transaction, request and complaint, financial, process security and family member and relative data to retain your personal data within the general statute of limitations period as evidence in potential future disputes.

If your explicit consent is obtained;

• Your personal data may be processed in a limited way for the proper configuration of the Cere Insight product and to provide support in emergency interventions.

Recipients and Purposes of Transfer of Processed Personal Data Your collected personal data may be transferred to our suppliers within the scope of our legitimate interests, to legally authorized public institutions and legally authorized private persons where explicitly required by law and for the fulfillment of our legal obligations, and to our overseas suppliers whose servers are located abroad based on the standard contractual clauses published by the Personal Data Protection Authority, within the framework of the data processing conditions stipulated in Articles 5 and 6 of the Law and in compliance with the rules on the transfer of personal data stipulated in Articles 8 and 9 of the Law.

Method of Collecting Personal Data Your personal data, for the purpose of fulfilling the Purposes, may be collected via our internet sites electronically, online membership/contact/application forms, call center, our mobile applications, SMS, e-mail, and during your communications and meetings with our Company in physical medium and via forms.

Rights of the Data Subject Stated in Article 11 of the Law Regarding your personal data, we inform you that you have the following rights under Article 11 of the Law:

• To learn whether your personal data is being processed,
• If processed, to request information regarding this,
• To learn the purpose of processing and whether it is used in accordance with that purpose,
• To know the third parties to whom personal data is transferred domestically or abroad,
• To request correction if your personal data is incomplete or incorrectly processed and to request notification of the correction to third parties to whom your data has been transferred in this context,
• To request deletion or destruction of your personal data where the reasons that required processing no longer exist despite being processed in accordance with the Law and other relevant laws, and to request notification of such deletion or destruction to third parties to whom the data has been transferred,
• To object to any result that is to your detriment arising from analysis of processed data exclusively by automated systems,
• To request the compensation of damage in case you suffer damages due to unlawful processing of your personal data

If you submit your requests regarding your rights stated above to the e-mail address [email protected], the Company will finalize your request within the shortest time, and in any event, within thirty days, free of charge depending on the nature of the request. However, if the process incurs an additional cost, a fee prescribed by the Personal Data Protection Board tariff will be collected by our Company.