1.1. Purpose of the Policy

Within the scope of the Personal Data Protection Law No. 6698 ("Law"), as Optima Foreign Exchange and Gold Authorized Institution Inc. ("Company" and "Firm"), the lawful processing and protection of personal data is among our highest priorities. We follow the same priority in all our planning and business activities. In this context, in accordance with Article 10 of the Law, we hereby present this Personal Data Processing and Protection Policy ("Policy") to inform you and to notify you of all administrative and technical measures we will apply regarding the processing and protection of personal data.

1.2. Scope

This Policy determines the conditions for processing personal data and sets out the principles adopted by the Firm in processing personal data. In this context, the Policy covers all personal data processing activities carried out by the Firm within the scope of the Law, all personal data processed, and the owners of this data.

1.3. Definitions

1.4. Entry into Force of the Policy

This Policy, prepared by the Firm, entered into force on 31.03.2021 and was made public. In case of conflict between the provisions of the legislation in force, primarily the Law, and the provisions of this Policy, the legislative provisions shall apply.

The Firm reserves the right to make changes to the Policy in parallel with legal regulations. You can access the current version of the Policy on the Firm's website (https://www.optimadoviz.com).

2.1. Data Owners

Data owners within the scope of the Policy are all real persons whose personal data are processed by the Firm, excluding Company employees. Generally, data owners can be listed as follows:

The data owner categories explained in the table above are provided for general information purposes. Not falling within the scope of any of these categories does not eliminate the data owner status as specified in the Law.

2.2. Purposes of Processing Personal Data

2.2.1. Conducting necessary studies by relevant departments to enable persons to benefit from the products and services offered by the Firm and carrying out business processes:

1. Planning and execution of product and/or service sales processes,
2. Planning and/or execution of after-sales support service activities,
3. Planning and execution of customer relationship management processes,
4. Follow-up of contract processes and/or legal claims,
5. Follow-up of customer requests and/or complaints.

2.2.2. Planning and execution of the Firm's Human Resources policies and processes:

1. Planning and execution of talent-career development activities,
2. Fulfillment of obligations arising from employment contracts and/or legislation for Company employees,
3. Planning and execution of fringe benefits and perquisites for employees,
4. Planning and execution of in-house orientation activities,
5. Planning and execution of employee exit procedures,
6. Compensation management,
7. Planning of Human Resources processes,
8. Management of personnel procurement processes,
9. Planning and execution of assignment-promotion and termination processes for the Company,
10. Planning and execution of employee performance evaluation processes,
11. Monitoring and/or control of employees' business activities,
12. Planning and/or execution of in-house training activities,
13. Planning and execution of employee satisfaction and/or loyalty processes,
14. Planning and execution of processes for receiving and evaluating suggestions from employees for improving work and/or production processes,
15. Planning and/or execution of intern and/or student procurement, placement, and operation processes.

2.2.3. Conducting necessary studies by relevant business units to carry out commercial activities by the Firm and carrying out related business processes:

1. Event management,
2. Planning and execution of business activities,
3. Planning and execution of corporate communication activities,
4. Planning and execution of supply chain management processes,
5. Planning and execution of production and/or operation processes,
6. Planning, control, and execution of information security processes,
7. Creation and management of information technology infrastructure,
8. Planning and execution of business partners' access rights to information,
9. Follow-up of finance and/or accounting affairs,
10. Planning and execution of corporate sustainability activities,
11. Planning and execution of corporate governance activities,
12. Planning and/or execution of business continuity activities,
13. Planning and execution of logistics activities.

2.2.4. Planning and execution of necessary activities to customize, recommend, and promote the products and services offered by the Firm to persons according to their preferences, usage habits, and needs:

1. Identification and/or evaluation of persons who will be subject to marketing activities according to consumer behavior criteria,
2. Designing and/or executing personalized marketing and/or promotion activities,
3. Designing and/or executing advertising and/or promotion and/or marketing activities in digital and/or other channels,
4. Designing and/or executing activities to be developed for customer acquisition in digital and/or other channels and/or creating value in existing customers,
5. Planning and/or execution of data analytics studies for marketing purposes,
6. Planning and execution of product and/or service marketing processes,
7. Planning and/or execution of processes for creating and/or increasing loyalty to the products and/or services offered by the Company.

2.2.5. Planning and execution of the Firm's commercial and/or business strategies: Managing relationships with business partners.

2.2.6. Ensuring the legal, technical, and commercial security of the Firm and persons in a business relationship with the Firm:

1. Follow-up of legal affairs
2. Planning and execution of necessary operational activities to ensure that Company activities are carried out in accordance with Company procedures and/or relevant legislation,
3. Providing information to authorized institutions as required by legislation,
4. Creation and follow-up of visitor records,
5. Planning and execution of emergency management processes,
6. Carrying out company and partnership law transactions,
7. Planning and execution of Company audit activities,
8. Planning and/or execution of occupational health and/or safety processes,
9. Implementation of credit process risk management,
10. Ensuring the security of Company premises and/or facilities,
11. Ensuring the security of Company operations,
12. Planning and/or execution of the Company's financial risk processes,
13. Ensuring the security of Company fixtures and/or resources.

2.3. Personal Data Categories

The personal data categorized as follows by the Firm are processed in accordance with the personal data processing conditions stipulated in the Law and relevant legislation:

The Firm processes personal data in accordance with Article 4 of the Law; in compliance with the law and rules of honesty, accurately and kept up to date where necessary, for specific, explicit, and legitimate purposes, in a limited and measured manner connected to the purpose, and stores them only for the time stipulated in relevant legislation or required for the purpose of processing.

3.1. Principles Regarding the Processing of Personal Data

In accordance with Article 10 of the KVK Law, the Firm informs data owners and processes this personal data based on the following principles, requesting consent from data owners where consent is required.

3.1.1. Processing Data in Compliance with Law and Rules of Honesty

The Firm acts in compliance with the principles brought by legal regulations and the general rule of trust and honesty in the processing of personal data. In accordance with the principle of acting in compliance with honesty, the Firm takes into account the interests and reasonable expectations of relevant persons while trying to achieve its goals in data processing.

3.1.2. Ensuring Personal Data is Accurate and Kept Up to Date Where Necessary

Keeping personal data accurate and up to date is necessary for the Firm to protect the fundamental rights and freedoms of the relevant person. The Firm has an active duty of care to ensure that personal data is accurate and kept up to date where necessary. For this reason, all communication channels are open for the Firm to keep the information of the data owner accurate and up to date.

3.1.3. Processing Data for Specific, Explicit, and Legitimate Purposes

The Firm determines the legitimate and lawful purpose of personal data processing clearly and precisely. It processes only as much personal data as is necessary and connected to the commercial activities it carries out.

3.1.4. Data Being Connected, Limited, and Proportionate to the Purpose for Which They Are Processed

The Firm processes personal data within the scope of purposes related to its field of activity and necessary for the conduct of its business. Therefore, it processes personal data in a manner suitable for the realization of the determined purposes and avoids processing personal data that is not related to or not needed for the realization of the purpose.

3.1.5. Retaining Data for the Period Stipulated in Relevant Legislation or Required for the Purpose for Which They Are Processed

The Firm retains personal data only for the period stipulated in relevant legislation or required for the purpose for which they are processed. In this context; it first determines whether a period is stipulated in relevant legislation for the storage of personal data, acts in accordance with this period if a period is determined, and stores personal data for as long as necessary for the purpose of processing if no period is determined. After the purpose of personal data processing ceases or the period stipulated in the legislation expires, personal data are deleted, destroyed, or anonymized by the Firm.

3.2. Conditions Regarding the Processing of Personal Data

Your personal data are processed by the Firm if at least one of the personal data processing conditions in Article 5 of the Law exists.

3.2.1. Explicit Consent of the Personal Data Owner

One of the conditions for processing personal data is the explicit consent of the owner. The explicit consent of the personal data owner must be freely given, specific, informed, and unambiguous on a particular subject.

For the processing of personal data based on the explicit consent of the personal data owner, explicit consents are obtained from customers, potential customers, and visitors through relevant methods.

3.2.2. Personal Data Processing Activities Explicitly Provided for by Law

The personal data of the data owner may be processed lawfully without explicit consent if explicitly provided for by law.

3.2.3. Impossibility of Obtaining Explicit Consent Due to Actual Impossibility

Personal data of the data owner may be processed if the processing of personal data is necessary to protect the life or physical integrity of the person who is unable to declare their consent due to actual impossibility or whose consent is not valid, or of another person.

3.2.4. Personal Data Being Directly Related to the Establishment or Performance of a Contract

Personal data may be processed if the processing of personal data belonging to the parties of a contract is necessary, provided that it is directly related to the establishment or performance of a contract.

3.2.5. Fulfillment of the Firm's Legal Obligation

The personal data of the data owner may be processed if the processing is necessary for the Firm to fulfill its legal obligations as a data controller.

3.2.6. Public Disclosure of Personal Data by the Data Owner

Relevant personal data may be processed if the data owner has publicly disclosed their personal data.

3.2.7. Necessity of Data Processing for the Establishment or Protection of a Right

The personal data of the data owner may be processed if data processing is necessary for the establishment, exercise, or protection of a right.

3.2.8. Necessity of Data Processing for the Legitimate Interests of the Firm

The personal data of the data owner may be processed if data processing is necessary for the legitimate interests of the Firm, provided that it does not harm the fundamental rights and freedoms of the personal data owner.

3.3. Processing of Special Category Personal Data

By the Firm, in the processing of personal data designated as "special category" by the KVK Law, careful attention is paid to compliance with the regulations provided in the KVK Law.

By the Firm; special category personal data are processed in the following cases, provided that sufficient measures determined by the KVK Board are taken:

• If there is explicit consent of the personal data owner, or;
• If there is no explicit consent of the personal data owner;
• Special category personal data other than those concerning the health and sexual life of the personal data owner, in cases provided for by law,
• Special category personal data concerning the health and sexual life of the personal data owner are processed only by persons or authorized institutions and organizations under the obligation of confidentiality or for the purposes of protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing.

4.1. Transfer of Personal Data to Third Parties Within the Country

If at least one of the data processing conditions specified in Articles 5 and 6 of the Law and explained under Section 3 of this Policy exists, and provided that the basic principles regarding data processing conditions are complied with, your personal data may be transferred by the Firm.

4.2. Transfer of Personal Data to Third Parties Outside the Country

If at least one of the data processing conditions explained under Section 3 of this Policy exists, and taking necessary security measures, the Firm may transfer the personal data and special category personal data of the personal data owner to third parties outside the country. By the Firm; personal data are transferred to foreign countries declared to have adequate protection by the KVK Board ("Country with Adequate Protection") or to foreign countries where the data controllers in Turkey and the relevant foreign country have committed in writing to provide adequate protection and where the KVK Board's permission exists ("Country with Data Controller Committing to Adequate Protection") in case adequate protection is not available. The Firm acts in accordance with the regulations provided in Article 9 of the KVK Law in this regard.

4.3. Third Parties to Whom Personal Data Are Transferred and Purposes of Transfer

Within the scope of the general principles of the Law and the data processing conditions in Articles 8 and 9, the Firm may carry out data transfers to the parties categorized in the table below:

5.1. Rights of the Personal Data Owner

1. To learn whether personal data are being processed,
2. To request information if personal data have been processed,
3. To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
4. To know the third parties to whom personal data are transferred within or outside the country,
5. To request correction if personal data are processed incompletely or inaccurately, and to request notification of the transaction made within this scope to third parties to whom personal data have been transferred,
6. To request deletion or destruction of personal data if the reasons requiring their processing have ceased to exist, despite being processed in accordance with the provisions of the KVK Law and other relevant laws, and to request notification of the transaction made within this scope to third parties to whom personal data have been transferred,
7. To object to the occurrence of a result against the person by analyzing the processed data exclusively through automatic systems,
8. To request compensation for damages in case of damage due to unlawful processing of personal data.

5.2. Cases Where the Personal Data Owner Cannot Exercise Rights:

Personal data owners cannot exercise the rights listed in 5.1 regarding the following cases, as they are excluded from the scope of the KVK Law pursuant to Article 28 of the KVK Law:

1. Processing of personal data by real persons for activities related to themselves or family members living in the same household, provided that they are not given to third parties and data security obligations are complied with,
2. Processing of personal data for purposes such as research, planning, and statistics by making them anonymous for official statistics,
3. Processing of personal data for art, history, literature, or scientific purposes or within the scope of freedom of expression, provided that they do not violate national defense, national security, public security, public order, economic security, privacy of private life, or personal rights, or constitute a crime,
4. Processing of personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public security, public order, or economic security,
5. Processing of personal data by judicial authorities or execution authorities in relation to investigation, prosecution, trial, or execution procedures.

Pursuant to Article 28.2 of the KVK Law; in the following cases, personal data owners cannot exercise the other rights listed in 5.1, except for the right to request compensation for damages:

1. Personal data processing is necessary for the prevention of crime or crime investigation,
2. Processing of personal data that the personal data owner has publicly disclosed themselves,
3. Personal data processing is necessary for the execution of supervision or regulation duties by authorized public institutions and organizations and public professional organizations with public institution status, based on the authority given by law, or for disciplinary investigation or prosecution,
4. Personal data processing is necessary for the protection of the State's economic and financial interests regarding budget, tax, and financial matters.