Privacy and Personal Data Protection Policy

---

1. PURPOSE AND SCOPE

This Privacy and Personal Data Protection Policy ("Policy") aims to fulfill the disclosure obligation and explain data protection principles regarding personal data processed within the scope of the B2B reverse auction platform ("Platform") operated under the KURUMSAL+ brand by UK Bilisim Teknolojileri A.S. ("Company", "Data Controller").

This Policy has been prepared in accordance with the Personal Data Protection Law No. 6698 ("KVKK"), related regulations, and decisions of the Personal Data Protection Board.

2. DATA CONTROLLER IDENTITY

• Company Name: UK Bilisim Teknolojileri Anonim Sirketi
• Brand Name: KURUMSAL+
• Address: Edirne Istasyon Mah. Ortanca Sokak, Bina No 9, 22100 Edirne / Turkiye
• Email: info@acsisco.com
• Phone: +90 533 488 31 85

3. PERSONAL DATA PROCESSED

3.1 Identity Data

Name, surname, title, job position, signature circular information.

3.2 Contact Data

Corporate email address, mobile phone number, business phone number, corporate postal address.

3.3 Corporate Data

Company name, tax identification number, tax office, trade registry number, MERSIS number, KEP address, field of activity, sector information, company size and employee count.

3.4 Financial Data

Invoice information, payment history, bank account details (IBAN), membership package information and payment amounts.

3.5 Visual Data

Profile photo, company logo, product images, promotional videos, and digital assets (LinkedIn profile, company website link).

3.6 Digital Trace Data

IP address, browser type and version, operating system, session data, cookie information, page view and click data, auction and bid history, in-platform behavioral data, access logs and timestamps.

4. PROCESSING PURPOSES AND LEGAL BASES

4.1 Establishment and Performance of Contract (KVKK Art. 5/2-c)

Membership operations, auction and bid process management, contract and invoicing, customer relationship management and support services.

4.2 Fulfillment of Legal Obligations (KVKK Art. 5/2-ch)

ETAHS obligations under ETK, access log retention for 2 years under Law No. 5651, accounting records for 10 years under Tax Procedure Law, commercial document retention for 10 years under Turkish Commercial Code.

4.3 Establishment, Exercise, or Protection of Rights (KVKK Art. 5/2-e)

Evidence creation and preservation in legal disputes, enforcement of contractual rights, platform security and fraud prevention.

4.4 Legitimate Interest (KVKK Art. 5/2-f)

Platform performance measurement and improvement, statistical analysis and reporting (using anonymized data), platform security and abuse detection.

4.5 Explicit Consent (KVKK Art. 5/1)

Profile Quality Score creation and publication, display of digital assets on the Platform, commercial electronic message delivery, international data transfer to cloud infrastructure providers, marketing cookie usage.

5. DATA TRANSFERS

6. DATA SECURITY MEASURES

The Company implements industry-standard technical measures (SSL/TLS encryption, database encryption, firewalls, DDoS protection, access controls, regular security audits, 2FA support) and administrative measures (data processing inventory, employee confidentiality agreements, data processor agreements, security training, breach response plan).

7. RETENTION PERIODS

| Data Category | Retention Period | Legal Basis |

|--------------|-----------------|-------------|

| Commercial books and documents | 10 years | TCC Art. 82, TPL Art. 253 |

| Access logs | 2 years | Law No. 5651 |

| Communication consent records | 5 years | ETK Regulation |

| Marketing data | Until consent withdrawal | KVKK Art. 5/1 |

| Cookie data | Max 2 years (by type) | KVKK, ePrivacy |

Data whose retention period has expired is deleted, destroyed, or anonymized in accordance with periodic destruction procedures.

8. DATA SUBJECT RIGHTS (KVKK Art. 11)

You have the right to: learn whether your personal data is processed, request information if processed, learn the purpose and whether it is used accordingly, know third parties to whom data is transferred, request correction of incomplete or incorrect data, request deletion or destruction, request notification of corrections/deletions to third parties, object to results produced by automated analysis, and claim compensation for damages from unlawful processing.

9. CONTACT

To exercise your rights, contact us at info@acsisco.com (subject: "KVKK Application") or by registered mail. Applications are processed free of charge within 30 days.

---

Edirne Istasyon Mah. Ortanca Sokak, Bina No 9, 22100 Edirne / Turkiye

Email: info@acsisco.com | Phone: +90 533 488 31 85