KVKK Data Subject Disclosure Notice

Company: Bubi Medya Dijital Hizmetler Tax ID: 32332011454 Tax Office: Kuşadası Vergi Dairesi Address: Değirmendere Mah. Sanayi Cd. 4. Sokak No: 1/2, 09400 Kuşadası / Aydın, Türkiye Phone: +90 545 572 16 09 Email: info@deedloom.com Website: deedloom.com deedloom is a real estate platform where only verified real estate offices may publish listings. Individual listings are not accepted.

This disclosure notice has been prepared in accordance with Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, published in the Official Gazette dated 10.03.2018 and numbered 30356. Through this notice, you are informed of: - The purposes for which your personal data will be processed, - The persons to whom the processed personal data may be transferred and for what purposes, - The method of collecting personal data and its legal basis, - Your rights enumerated in Article 11 of KVKK. As the data controller, deedloom undertakes, in fulfilling its obligation to inform, to: - Act in accordance with law and the rules of good faith, - Ensure that personal data is accurate and, where necessary, up to date, - Process data for specified, explicit and legitimate purposes, - Ensure that processing is connected with, limited to and proportionate to the purpose for which data are processed, - Retain data for the period stipulated in the relevant legislation or required for the purpose for which they are processed.

The following categories of personal data are processed on the deedloom platform:

The personal data collected from you are processed for the following purposes:

• ›Conduct of membership procedures: Account creation, identity verification, password management, account security
• ›Provision of listing services: Publication, editing, archiving and management of real estate listings
• ›Lead management: Secure transmission of prospective buyers' requests to the relevant real estate office
• ›Platform analytics: Analysis of user behaviour, measurement and improvement of service quality
• ›Fulfilment of legal obligations: Tax legislation, e-commerce law (6563), TTK, KVKK and other relevant legislative requirements
• ›Security: Ensuring platform security, detection of unauthorised access attempts and fraud
• ›Marketing and communication: Dispatch of campaigns, promotions and notifications (only with explicit consent, pursuant to Law No. 6563 Art. 6)
• ›Communication management: Management of user requests, complaints and feedback
• ›Boost and featured listing services: Management and invoicing of paid listing promotion services
• ›Real estate office verification: Evaluation of corporate applications, licence and authorisation verification processes
• ›Contractual processes: Performance of membership agreement, service agreement and other contractual obligations
• ›Audit and reporting: Internal audit, statutory reporting and compliance processes

Your personal data are collected by automated and non-automated means, on the basis of the legal grounds set out below:

Domestic Transfer (KVKK Art. 8): Your personal data may be transferred to third parties within the country upon the explicit consent of the data subject or where the conditions specified in KVKK Art. 5/2 are met.

• ›Real Estate Offices: The information you submit via the lead form (name, telephone, e-mail, message) is transferred to the relevant verified real estate office
• ›Business Partners: Payment service providers (for payment processing), cloud infrastructure providers (data storage), e-mail service providers (notifications)
• ›Legal and Financial Advisors: For the conduct of legal processes and fulfilment of financial obligations
• ›Competent Public Authorities: In cases of legal obligation such as court orders, public prosecutor requests, tax audits
• ›Independent Audit Firms: For statutory audit and compliance processes

Pursuant to Article 11 of Law No. 6698 (KVKK), as the data subject you have the following rights:

• ›(a) Right to learn whether personal data concerning you are processed: You have the right to query whether deedloom processes any personal data relating to you.
• ›(b) Right to request information if personal data are processed: You may request detailed information about which of your data are processed, the purpose and scope of processing.
• ›(c) Right to learn the purpose of processing personal data and whether they are used in accordance with that purpose: You may query whether your data are being used in accordance with the purpose for which they were collected.
• ›(d) Right to know the third parties to whom personal data are transferred domestically or abroad: You have the right to learn with whom your data are shared.
• ›(e) Right to request rectification where personal data are incomplete or inaccurately processed: You may request that erroneous or incomplete data be updated.
• ›(f) Right to request erasure or destruction of personal data within the framework of KVKK Art. 7: You may request the destruction of your data where the conditions for processing no longer exist.
• ›(g) Right to request notification of transactions carried out pursuant to sub-paragraphs (e) and (f) to third parties to whom personal data have been transferred: You may request that rectification or erasure operations be communicated to the parties with whom data have been shared.
• ›(h) Right to object to the emergence of a result detrimental to the data subject by means of analysis of processed data exclusively through automated systems: You have the right to object to adverse outcomes arising from automated processing.
• ›(i) Right to claim compensation for damage arising from the unlawful processing of personal data: You may seek redress for damages arising from unlawful data processing.

Application Review Process: Your application will be concluded free of charge as soon as possible and within at most 30 (thirty) days, depending on the nature of the request. Where the transaction requires an additional cost, a fee set in the tariff determined by the Personal Data Protection Board may be charged. Your application will be accepted or refused with stated reasons. Our response will be communicated to you in writing or electronically.

• ›Application by e-mail: You may send a written application to info@deedloom.com together with documents verifying your identity. It is recommended that you write "KVKK Information Request" in the subject line of the e-mail.
• ›Written application: You may submit a wet-signed petition by post or in person.
• ›Through a notary: You may submit an application via a notary channel with identity verification.
• ›Application by KEP: Our KEP address is —.

deedloom takes the following administrative and technical measures pursuant to KVKK Art. 12 to prevent the unlawful processing of and access to personal data and to ensure the safeguarding of data:

• ›Technical Measures: SSL/TLS encryption, firewall, access control (RBAC), database encryption (AES-256), intrusion detection and prevention systems (IDS/IPS), regular penetration testing, automated backups, log monitoring and anomaly detection
• ›Administrative Measures: Maintaining a personal data processing inventory, providing regular KVKK training to employees, executing confidentiality agreements, documenting data processing policies and procedures in writing
• ›Data Breach Management: In the event of a data breach, notification is made to the KVKK Board within 72 hours. Data subjects are informed "as soon as possible". Breach records are kept and preventive measures are taken.
• ›Access Control: Access to personal data is restricted to personnel who require access by virtue of their job description. Every access is recorded.
• ›Supplier Management: KVKK-compliant data processing agreements are executed with all suppliers engaged in personal data processing activities.
• ›Periodic Audit: Data security measures and compliance processes are regularly monitored through internal and external audits.

This KVKK Disclosure Notice may be updated due to legislative changes, decisions of the Personal Data Protection Board, platform updates or changes in business processes. When updates are made: - The revised notice is published at deedloom.com/kvkk - The last update date is amended - Registered users are notified of significant changes - Where changes affect processing based on explicit consent, fresh consent is obtained We recommend that you review the current notice periodically.

You may contact us through the following channels for all questions, requests and complaints within the scope of KVKK: Right to Complain to the KVKK Board (Art. 14): In the event that your application to the data controller is rejected, the response given is found inadequate, or no response is given within 30 days, you have the right to lodge a complaint with the Personal Data Protection Board. Personal Data Protection Authority Nasuh Akar Mahallesi Ziyabey Caddesi 1407. Sokak No:4, 06520 Balgat-Cankaya/Ankara Phone: +90 312 216 50 50 Web: www.kvkk.gov.tr