NART INSURANCE AND REINSURANCE BROKERAGE INC.

CUSTOMER PRIVACY NOTICE UNDER THE LAW ON THE PROTECTION OF PERSONAL DATA

We, NART Insurance and Reinsurance Brokerage Inc. (“NART” or the “Company”), understand how important your personal data is to you. In carrying out our activities, we consider your personal data entrusted to us and, with the responsibility of a “Trustee,” we take all necessary administrative and technical measures to protect your personal data against any unlawful processing activities, ensuring their security and confidentiality.

This Privacy Notice has been prepared by NART in its capacity as a data controller to inform and enlighten you about the personal data you may share with us during the procurement of NART products and services, as required under Article 10 of the Law on the Protection of Personal Data No. 6698.

With this Privacy Notice, we aim to inform you about NART’s identity (Article 10.a of the Law), the purposes for which your personal data may be processed (Article 10.b of the Law), the recipients and purposes of the data transfers (Article 10.c of the Law), the methods of data collection and legal grounds (Article 10.ç of the Law), and your rights (Article 10.d of the Law).

1. Identity of the Data Controller (Article 10.a of the Law)

This form has been prepared by NART Insurance and Reinsurance Brokerage Inc., and the personal data you may share with us during the procurement of products and services will be maintained and protected by NART Insurance and Reinsurance Brokerage Inc. as the data controller.

2. Purpose of Processing Your Personal Data (Article 10.b of the Law)

The personal data you may share with us during the procurement of products and services are processed by NART within the scope of the personal data processing conditions specified in Articles 5 and 6 of the Law and for the following purposes:

• Conducting the Company’s sales and marketing activities,
• Determining the terms of the commercial relationship, managing mutual negotiation processes, communicating regarding contract preparations and other matters,
• Managing, monitoring, auditing, and controlling business processes,
• Collecting and delivering quote requests, informing customers about new products, campaigns, and advertisements, and providing information about promotions and discounts,
• Managing customer relationships, handling order and delivery processes, providing after-sales support, receiving customer requests and complaints, evaluating customer satisfaction, and performing related transactions,
• Conducting necessary work by our business units to enable you to benefit from the products and services offered by our Company and executing related business processes,
• Planning and executing activities necessary to offer customized suggestions and promotions to you based on your preferences, usage habits, and needs for the products and services provided by our Company,
• Managing communication, logistics, and occupational health and safety processes,
• Establishing, interpreting, and using records such as commitments and statements to create a contractual relationship between the parties,
• Complying with obligations and legal requirements in cases where notifications to public authorities are necessary,
• Managing financial, accounting, payment, collection, refund, request and complaint tracking, and invoicing processes,
• Determining and implementing the commercial and business strategies of our Company and ensuring the execution of our Company’s commercial policies.

Your personal data will be processed in accordance with the personal data processing conditions and purposes specified in Articles 5 and 6 of the Law.

3. Transfer and Purpose of Transferring Your Personal Data (Article 10.c of the Law)

The personal data you may share with us may be transferred to our business partners, service providers, suppliers, Company officials, shareholders, independent consultants, and other solution partners working with us under confidentiality agreements, as well as, if necessary, relevant third parties, public institutions and authorities, and judicial bodies for the purposes of enabling you to benefit from the products and services offered by our Company, customizing the products and services offered by our Company to suit your preferences, usage habits, and needs, ensuring the legal, commercial, and technical security of our Company and those in a business relationship with our Company, determining and implementing our Company’s commercial and business strategies, and identifying, analyzing, and addressing commercial risks and needs.

4. Method and Legal Grounds for Collecting Personal Data (Article 10.ç of the Law)

The personal data you share with us is processed by our Company in physical and electronic environments through the offer, contract, order form, invoice, delivery note, and other records you provide and via e-mail, through automatic or non-automatic means, based on the legal grounds stipulated in Article 5 of the Law, such as “the processing of personal data is necessary for the establishment or performance of a contract,” “the processing of personal data is necessary for compliance with a legal obligation to which the data controller is subject,” “the processing of personal data is necessary for the legitimate interests pursued by the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject,” “it is explicitly prescribed by laws,” and “the processing of personal data is necessary for the establishment, exercise, or defense of legal claims.”

5. Your Legal Rights (Article 10.d of the Law)

Pursuant to Article 11 of the Law, you have the following rights:

a) To learn whether your personal data is being processed; b) To request information regarding the processing of your personal data; c) To learn the purpose of processing your personal data and whether they are used in accordance with that purpose; ç) To know the third parties to whom your personal data is transferred, either domestically or internationally;

d) To request the correction of your personal data if it is incomplete or inaccurate; e) To request the deletion or destruction of your personal data under the conditions laid down in Article 7 of the Law; f) To request notification to third parties to whom your personal data has been transferred of the actions taken under subparagraphs (d) and (e); g) To object to any adverse outcome arising solely from the analysis of your personal data by automated systems; ğ) To request compensation for the damage you may suffer as a result of the unlawful processing of your personal data.

You can submit your requests regarding your rights to us (NART Insurance and Reinsurance Brokerage Inc.) following the procedures and principles outlined in the Communiqué on the Procedures and Principles of Application to the Data Controller and use the KVKK Request Form, which we have prepared for you and is accessible on our website.

This Privacy Notice may be updated in line with changes and innovations in legislation, as well as decisions and statements made by the Personal Data Protection Board, to ensure that data security and confidentiality are fully maintained, legal obligations are properly and completely fulfilled, and any potential loss of rights is prevented. In such cases, the updated Privacy Notice will be sent to you via email and/or announced on our website.