This document has been prepared in accordance with the "Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform," pursuant to Article 10 of the "Law on the Protection of Personal Data," with the aim of fulfilling the obligation to inform data subjects by the data controller or persons authorized by the data controller at the time personal data is collected. The document is based on the relevant Law, Regulation, and Communiqués.

1. Data Subject: Refers to the natural person whose personal data is being processed.

2. Data Controller: Refers to the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

   The definitions not included in this document shall be governed by the definitions in the Law, Regulations, and Communiqués.

This document applies to our Members whose personal data is processed within the framework of the relevant Laws and Regulations and in line with our activities.

The following principles are adhered to in the processing of personal data:

• Personal data is processed in accordance with the law and good faith.
• Personal data is processed accurately and, when necessary, kept up to date.
• Personal data is processed for specific, explicit, and legitimate purposes.
• Personal data is processed in a manner that is relevant, limited, and proportionate to the purposes for which it is processed.
• Personal data is retained for as long as necessary for the purposes for which it is processed or for the period stipulated by the relevant legislation.

PURPOSE OF PROCESSING PERSONAL DATA OF MEMBERS

The personal data of members is processed for the following purposes:

1. Execution of Information Security Processes
2. Conducting Training Activities
3. Conducting Activities in Compliance with Legislation
4. Conducting Finance and Accounting Affairs
5. Ensuring Physical Space Security
6. Following and Conducting Legal Affairs
7. Conducting Internal Audits/Investigations/Intelligence Activities
8. Conducting Communication Activities
9. Managing Business Activities/Audits
10. Collecting and Evaluating Suggestions for Improving Business Processes
11. Managing Customer Relations Processes
12. Conducting Activities Aimed at Ensuring Customer Satisfaction
13. Managing Organization and Event Activities
14. Conducting Strategic Planning Activities
15. Following Requests/Complaints
16. Providing Information to Authorized Persons, Institutions, and Organizations
17. Creating and Tracking Visitor Records
18. Other (Preparation of Activity Reports, Social Media News and Announcements, Activity Announcements, Press News Bulletins and Announcements, Website News and Announcements)

TRANSFER OF PERSONAL DATA

According to Article 8 of the "Law on the Protection of Personal Data," personal data cannot be transferred to third parties without the explicit consent of the data subject.

Personal data may be transferred to third parties without explicit consent if there are conditions where personal data can be processed without the data subject's explicit consent. Similarly, with sufficient precautions in place, special categories of personal data, excluding health and sexual life, can also be transferred without the data subject's explicit consent in cases stipulated by law. However, health and sexual life-related personal data may only be transferred without explicit consent by persons or authorized institutions and organizations that have a duty of confidentiality for the purpose of protecting public health, preventive medicine, medical diagnosis, treatment, and care services, or the planning and management of healthcare services and financing.

Other provisions in laws regarding the transfer of personal data remain reserved.

Your personal data may be transferred to:

• Institutions or organizations that are permitted by the "Occupational Health and Safety Law," "Turkish Commercial Code," "Law on Collection of Public Receivables," "Capital Markets Law," "Law on Licensed Warehousing for Agricultural Products," "Execution and Bankruptcy Law," "Law on Regulation of Broadcasts on the Internet and Prevention of Crimes Committed through Such Broadcasts," "Law on the Protection of Personal Data," and other legislation,
• Public legal entities such as the Personal Data Protection Authority, Ministry of Treasury and Finance, Ministry of Trade, Ministry of Family, Labor, and Social Services, Information and Communication Technologies Authority,
• The Union of Chambers and Commodity Exchanges of Turkey, other chambers and exchanges affiliated with the Union, affiliated partnerships and/or domestic/foreign subsidiaries of AYDIN COMMODITY EXCHANGE,
• Domestic/foreign organizations and suppliers with whom we collaborate or receive services to carry out our activities as AYDIN COMMODITY EXCHANGE, who are jointly and severally responsible with us for taking institutional security measures, preventing unauthorized access, and preventing unlawful processing of personal data,
• Personal data processing conditions and purposes specified in Articles 8 and 9 of the "Law on the Protection of Personal Data."

METHOD OF COLLECTING PERSONAL DATA AND LEGAL REASON

Personal data is collected in verbal, written, or electronic form during the continuation of activities carried out based on:

• "Occupational Health and Safety Law,"
• "Turkish Commercial Code,"
• "Law on the Union of Chambers and Commodity Exchanges of Turkey and Chambers and Commodity Exchanges,"
• "Law on Collection of Public Receivables,"
• "Capital Markets Law,"
• "Law on Licensed Warehousing for Agricultural Products,"
• "Execution and Bankruptcy Law,"
• "Law on Regulation of Broadcasts on the Internet and Prevention of Crimes Committed through Such Broadcasts,"
• "Law on the Protection of Personal Data,"
  and other relevant legal regulations.

RIGHTS OF THE DATA SUBJECT WHOSE PERSONAL DATA IS PROCESSED

By applying to our institution, members have the right to:

• Learn whether personal data is processed,
• Request information if personal data has been processed,
• Learn the purpose of processing personal data and whether it is used in accordance with its purpose,
• Know the third parties to whom personal data is transferred domestically or abroad,
• Request correction of personal data if it is incomplete or incorrectly processed,
• Request deletion/destruction of personal data under the conditions set forth in Article 7 of the "Law on the Protection of Personal Data,"
• Request notification to third parties to whom personal data has been transferred of the actions carried out in accordance with paragraphs (e) and (f),
• Object to the occurrence of a result against the person due to analysis exclusively by automated systems,
• Request compensation if they suffer damage due to unlawful processing of personal data.

In accordance with the first paragraph of Article 13 of the "Law on the Protection of Personal Data," you may submit your requests related to exercising the above rights to our institution in writing or electronically via a signed application sent through the KEP address.

To exercise your rights, you may fill out the "Personal Data Application Form" and submit a signed copy of the form, along with identity verification documents, to the address of AYDIN COMMODITY EXCHANGE, Ata Mahallesi Denizli Bulvarı No: 18 AYDIN, either in person, through a notary, or by sending a securely signed electronic copy to the registered email address aydinticaretborsasi@hs01.kep.tr.

RELATED DOCUMENTS

• Law on the Protection of Personal Data
• Occupational Health and Safety Law
• Turkish Commercial Code
• Law on the Union of Chambers and Commodity Exchanges of Turkey and Chambers and Commodity Exchanges
• Law on Collection of Public Receivables
• Capital Markets Law
• Law on Licensed Warehousing for Agricultural Products
• Execution and Bankruptcy Law
• Law on Regulation of Broadcasts on the Internet and Prevention of Crimes Committed through Such Broadcasts
• Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform
• Personal Data Application Form (FRM.131)