Personal Data Protection Notice

PRIVACY NOTICE OF ÇAKMAKÇI KIYMETLİ MADENLER SAN. TİC. A.Ş. UNDER PERSONAL DATA PROTECTION LAW NO. 6698

This privacy notice has been prepared by ÇAKMAKÇI KIYMETLİ MADENLER SAN. TİC. A.Ş. (hereinafter referred to as the “data controller”) in its capacity as data controller, within the scope of the Communiqué on the principles and procedures to be applied for the fulfilment of the obligation to inform under Article 10 of Personal Data Protection Law No. 6698.

Pursuant to the provisions of Personal Data Protection Law No. 6698, the personal data set out below, which the natural persons whose data will be processed are expected to transmit, will be recorded in the Company's database.

A - IDENTITY OF THE DATA CONTROLLER

TITLE: ÇAKMAKÇI KIYMETLİ MADENLER SAN. TİC. A.Ş.

ADDRESS: Mollafenari Mah. Nuruosmaniye Caddesi No:58/A Fatih İstanbul

PHONE: 0212 945 99 98

E-MAIL: [email protected]

B - TRANSACTIONS UNDERLYING THE PROCESSED PERSONAL DATA

The transactions underlying the personal data processed by the data controller within the scope of Law No. 6698 are information arising from precious metals purchase and sale transactions, personal data belonging to the personnel employed within the Company, and data that may be transmitted through camera recordings.

C - PERSONAL DATA COLLECTED

Telephone numbers, address details, copies of identity documents, tax certificates and signature circulars belonging to customers and personnel; for personnel to be employed by the Company, the curriculum vitae of job applicants, and the curriculum vitae, copy of identity document, passport photograph, criminal record certificate, place of residence, civil registry copy, telephone number and copy of the contract to be concluded of the personnel recruited and employed by the Company; and, in the camera recordings made at the Company, the camera images of customers and Company personnel.

D - PURPOSE OF COLLECTING PERSONAL DATA

In gold purchase and sale transactions: managing customer relationship processes, responding to requests and complaints, checking, correcting and reversing erroneous transactions, proving contracts concluded orally by telephone, applying to judicial and administrative authorities where necessary; fulfilling the obligations under the Law on the Protection of the Value of Turkish Currency, the Tax Procedure Law, the General Communiqué on Tax Identification Numbers and other legislation, and providing the information that may be requested by the Revenue Administration and the Ministry of Treasury and Finance where necessary. Such data will be processed within the scope of the personal data processing conditions set out in Articles 5 and 6 of Personal Data Protection Law No. 6698.

In transactions concerning personnel employed within the Company and persons attending job interviews: evaluating persons who apply for a job, are recruited and work at the Company and inviting them to a job interview; ensuring that the employment contracts concluded with the personnel recruited and employed by the Company are complete and legally effective; fulfilling the other legal obligations laid down by Labour Law No. 4857, Social Insurance and General Health Insurance Law No. 5510, Turkish Code of Obligations No. 6098, Turkish Commercial Code No. 6102 and other legislation; enabling the Company to prove the employment relationship with its personnel in the event of any dispute; and enabling it to exercise effectively its rights of claim and defence in judicial proceedings.

In transactions relating to security camera recordings made: the purposes are to ensure the security of the workplace, to control entries to and exits from buildings and facilities, to determine the working conditions of personnel, to prove the employment relationship, to prove erroneous transactions by means of camera images, to contact the customer party to the transaction, and to provide information when requested by the Ministry of Treasury and Finance.

D - LEGAL GROUNDS FOR COLLECTING PERSONAL DATA

The grounds set out in subparagraphs (a), (ç), (e) and (f) of the second paragraph of Article 5 of Personal Data Protection Law No. 6698:

a) Being expressly provided for by law.

ç) Being necessary for the data controller to fulfil its legal obligations.

e) Being necessary for the establishment, exercise or protection of a right.

f) Processing of data being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

E - METHOD OF COLLECTING PERSONAL DATA

In gold purchase and sale transactions: the transmission by customers of their data to Company personnel, to an authorised representative or to the data controller orally, in writing or electronically when they come to the Company in person to carry out a transaction or carry out a transaction remotely by telephone or e-mail; the recording of the transmitted data by personnel in a closed-circuit software application in the computer environment; and the retention, either in the computer/electronic environment or physically filed at the Company, of information, documents and records relating to personal data that are requested from customers by Company personnel, an authorised representative or the data controller where compulsory, or that are obtained with the consent of customers from certain institutions and places in order for the trade carried out to be reliable.

In transactions concerning personnel employed within the Company and persons attending job interviews: the transmission of curricula vitae electronically to the Company's e-mail address, the physical delivery by persons attending a job interview of their curricula vitae to Company officials or personnel, the completion of the job application form prepared by the Company; the physical delivery by recruited personnel of their criminal record certificate and a copy of their identity document to the accounting department in order to complete their personnel file, and the creation by the accounting department of a personnel file in both physical and electronic form, together with the data obtained through the curriculum vitae, copy of identity document, passport photograph, criminal record certificate, place of residence, civil registry copy, telephone number and copy of the contract to be concluded of the personnel employed at the Company.

In transactions relating to security camera recordings made: the data obtained together with the images of personnel and/or customers captured by means of the security cameras located at certain points in the workplace.

F - TRANSFER OF DATA

In gold purchase and sale transactions: the data controller company may share the personal data it has obtained in line with the data processing purposes during “precious metals gold purchase and sale transactions” with judicial, enforcement and investigation authorities, the Ministry of Treasury and Finance, the Financial Crimes Investigation Board and other relevant public institutions and organisations.

Apart from the data that must be shared pursuant to Law No. 6698 and the relevant legislation, the Company will under no circumstances share the personal data it obtains with third parties without the explicit consent of the person whose data is processed, and will ensure the security of the data obtained through the highest level of protection measures.

In transactions concerning personnel employed within the Company and persons attending job interviews: the data controller company may share the personal data it has obtained in line with the data processing purposes from persons attending job interviews and applicants and from its current personnel with the financial advisors from whom it receives services, for the purpose of submitting the required declarations to the relevant public institutions; with the Social Security Institution, İŞKUR, the Revenue Administration and other relevant public institutions and organisations as required by legislation; with judicial, enforcement and investigation authorities for the resolution of legal disputes or upon request as required by the relevant legislation; and with ÇAKMAKÇI KIYMETLİ MADENLER SAN. TİC. A.Ş., where the Company is registered, for the purpose of establishing communication.

Apart from the data listed above that must be shared pursuant to Law No. 6698 and the relevant legislation, the Company will under no circumstances share the personal data it obtains with third parties without the explicit consent of the person whose data is processed, and will ensure the security of the data obtained through the highest level of protection measures.

In transactions relating to security camera recordings made: the data controller company may share the images and thus the personal data of persons, personnel and customers that it has obtained by means of security camera recordings in line with the data processing purposes with judicial, enforcement and investigation authorities and other institutions and organisations, for the resolution of any possible legal or criminal dispute or upon request from public institutions and organisations as required by the relevant legislation.

G - RIGHTS OF PERSONS WHOSE DATA IS PROCESSED

Pursuant to Article 11 of Law No. 6698:

“Everyone has the right, by applying to the data controller, in relation to themselves:

a) To learn whether their personal data is being processed,

b) To request information if their personal data has been processed,

c) To learn the purpose of processing personal data and whether the data is used in accordance with that purpose,

ç) To know the third parties to whom personal data is transferred domestically or abroad,

d) To request the correction of personal data where it has been processed incompletely or inaccurately,

e) To request the deletion or destruction of personal data within the conditions set out in Article 7,

f) To request that the operations carried out pursuant to subparagraphs (d) and (e) be notified to the third parties to whom the personal data has been transferred,

g) To object to a result arising to the person's own detriment as a consequence of the analysis of the processed data exclusively by automated systems,

ğ) To claim compensation for damages incurred as a result of the unlawful processing of personal data.”

The data subject may exercise their rights at any time by transmitting to the Company a request that includes a document verifying their identity and clearly states the right they wish to exercise, by sending it to the e-mail address [email protected] or by using the other communication channels set out in section A above.

DATA CONTROLLER COMPANY

ÇAKMAKÇI KIYMETLİ MADENLER SAN. TİC. A.Ş.

GOLD

SILVER

PLATINUM

PALLADIUM