This text has been drawn up by Aktiftech Teknoloji A.S. (“AktifTech“), acting as the data controller, for the purpose of providing information with respect to processing of personal data of the prospective employees, who have made a job application and serve as part or internship process, as per the Law Nr.6698 on Protection of Personal Data (the “Law Nr.6698“), which has been promulgated on the Official Journal, dated April 07, 2016 and bearing the issue number 29677 thereon.

Your Personal Data Processed By Our Company; Your personal/sensitive personal data, including but not limited to your identity details (name, full name, Republic of Türkiye ID number, passport number), contact details (home address, business address, electronic mail address, mobile phone number, fixed phone number), personnel data, professional experience data, socio-demographic information, vocational educational level, legal data, medical data, including any and all kinds of personal and/or sensitive personal data (photographs, telephone calls, voice records, camera record), which will be obtained from you during the course of your job application or internship as per the Law and such other applicable regulations, shall be processed.

Purposes of Processing of Your Personal Data by our Company; During the course of your job application or internship, your personal data and sensitive personal data shall be processed for the purposes and reasons including but not limited to the following purposes and legal grounds in compliance with the principles as specified in Section 4 of the Law Nr.6698;

If and when it is directly related to the execution of an agreement by and between our Company and you, and also the performance of such agreement, and it is mandatory for the purpose of fulfillment of our statutory obligation; then for the purpose of;

• Planning the human resources processes of the Company and performance of the recruitment of the staff members and planning and execution of the authorization of access to information by the staff members;
• Planning and execution of the operational activities as required for ensuring that the operations of the company are carried out in compliance with the corporate procedures and/or the applicable regulations, and providing regulatory information to the competent authorities for the purpose of ensuring the legal, technical, business and job security of the Company as well as the individuals who have an employment relation with the Company;
• Creation and management of the information technologies infrastructure as part of the performance of the necessary activities by our respective business units for the purpose of accomplishment of the business operations carried out by the Company, and also performance of the business processes associated therewith;
• Storing, reporting the information which are requested by the Banking Regulation and Supervision Agency, MASAK (Financial Crimes Investigation Board), GIB (Turkish Revenue Administration), Information Technologies Authority, Recep Tayyip Erdogan Universitesi ve Turk-Alman Universitesi Teknoloji Gelistirme Bolgesi Yonetim A.S. (Recep Tayyip Erdogan University and Turkish-German University Technology Development Zone Management Inc.) and such other governmental agencies, to which we are obliged to provide information, and fulfillment of the requests for information and documentation forwarded by any such agency,
• Retention of the records and performance of the staff recruitment processes as prescribed by the laws for the purpose of fulfillment of the statutory obligations;

If and when it is directly related to the execution of an agreement by and between our Company and you, and also the performance of such agreement, and it is mandatory for the purpose of fulfillment of our statutory obligation; then for the purpose of;

Provided that you, as being the data subject, shall not have your fundamental rights and freedoms impaired by such processing, on the basis of the legal ground that such processing of data is of mandatory nature for the legitimate interests of the data controller;

if and when such processing is required for establishment, exercise or protection of a right, and

if and when an explicit consent is granted.

Method for Collection of Your Personal Data, and Legal Grounds thereto; Your personal data shall be collected either physically or electronically (through the job application platforms, developed by our company, or through the social media platforms, etc.) by means of your curriculum vitae, application form and personality inventory form during the job interview and internship. Your personal data may be processed and shared in line with the legal grounds and purposes as specified in Article 2 of the Clarification Text as described in detail herein above.

Your personal data may be processed on the basis of the legal grounds as prescribed in the Law Nr.6698, if and when;

• You have granted your explicit consent as per Sections 5/1 and 6/2 of the said Law,
• It is expressly prescribed by the laws as specified in Section 5/2-a of the said Law,
• It is required for the purpose of protecting the life or bodily integrity of the individual or any other individual who is not able to state her/his consent due to any actual impossibility or whose consent is not recognized in legal terms as specified in Section 5/2-b of the said Law,
• Processing of the personal data of the parties of such agreement is required, provided that such processing is required for entering into or performing an agreement as specified in 5/2-c of the said Law,
• It is required for enabling our Company to fulfill its statutory obligation as specified in Section 5/2-ç of the said Law,
• Such personal data has been made publicly available by You as specified in Section 5/2-d of the said Law,
• Such processing is required for establishment, exercise or protection of a right as specified in Section 5/2-e of the said Law,
• Such processing is required for the legitimate interest of our Company without prejudice to your fundamental rights and freedoms as per Section 5/2-f of the said Law.

The Parties to which Your Personal Data May Be Transferred for the Purposes Listed Herein Above

Your personal data may be transferred to the domestic and international business partners and associates, shareholders, subsidiaries, infrastructure service providers, cloud information technology system providers of AktifTech and to the judicial authorities and also to such other similar governmental/private agencies and organizations, provided that adequate and effective measures will have been taken as per the security and non-disclosure principles as specified in the applicable regulations for the purpose of ensuring the accomplishment of the purposes as listed herein above as based on the terms and conditions for transferring and processing such data as specified in Sections 8 and 9 of the Law Nr.6698.

Your Rights as Listed in Section 11 of the Law Nr.6698; In the event that you, as being a personal data subject, submit your request regarding your rights to us by means of the methods as set out herein below, then, Aktif Bank shall conclude any such request as soon as possible and no later than a period of thirty days depending on the nature of such request. If and when it is stipulated by the Personal Data Protection Board to charge a fee, then our Company may collect a fee as determined in the tariff.

In respect of your personal data processed by Aktif Bank, as per Section 11 of the Law Nr.6698, you shall be entitled to;

• inquire whether your personal data has been processed, or not; and
• ask for information regarding any such processed personal data; and
• be informed about the purpose of processing of any such data, and also about the fact that whether such data has been used as appropriate to the purpose thereto; and
• be informed about any 3rd party to which any such data has been transferred, either domestically or internationally; and
• ask for correction of any imperfect or inaccurate data, in case of any imperfect or inaccurate processing thereof; and
• ask for deletion of any such personal data, if and when the reasons requiring the processing of your data cease to exist; and
• raise an objection against such outcome in case of emergence of an outcome that is to the detriment of you upon the analysis of any such processed personal data solely by any automated systems; and
• claim for compensation of any and all damage and/or loss you might have incurred in case your personal data has been processed in breach of the law.

As per the 1st paragraph of Section 13 of the Law Nr.6698 and also the Communique, numbered 30356 and dated 10.03.2018, regarding the Procedures and Principles For Filing an Application to the Data Controller; you may send and deliver your request with respect to any of your rights as listed herein above;

• by e-mail by sending an e-mail message to info@aktiftech.com as indicated on the website of our Company; and

• to our KEP (registered electronic mail) address, aktifbank@hs03.kep.tr , if and when you wish to file an application through KEP; and

• to and at the address of our Company, namely Esentepe Mah. Kore Sehitleri Cad. No:8/1 Aktif Bank Genel Mudurluk (Head Office) Sisli/Istanbul, as being the data controller, by attaching the necessary documentation thereto, if and when you wish to file an application in writing.

It is required that the information and documentation to enable identification as based on the nature of you request are provided to us in full and accurately. If and when any such required information or documentation is not provided properly, some inconvenience may be experienced in respect of perfectly and properly performance of the investigations to be carried out by AktifTech as based on your request. We hereby represent that the legal rights of AktifTech shall be reserved in such case. Therefore; your application must be sent completely and in a manner so as to include all such required information and documentation as based on the nature of your request.