NART INSURANCE AND REINSURANCE BROKERAGE INC.

SUPPLIER AND BUSINESS PARTNER PRIVACY NOTICE UNDER THE LAW ON THE PROTECTION OF PERSONAL DATA

We, NART Insurance and Reinsurance Brokerage Inc. (“NART” or the “Company”), recognize the importance of your personal data. In carrying out our activities, we regard your personal data as entrusted to us and, with the responsibility of a “Trustee,” we take all necessary administrative and technical measures to protect your personal data against any unlawful processing activities, ensuring their security and confidentiality.

This Privacy Notice has been prepared by NART, in its capacity as the data controller under Article 10 of the Law on the Protection of Personal Data No. 6698, to inform and enlighten you about the personal data you may share with us during the procurement of products and services deemed necessary by NART.

With this Privacy Notice, we aim to inform you about NART’s identity (Article 10.a of the Law), the purposes for which your personal data may be processed (Article 10.b), the recipients and purposes of data transfer (Article 10.c), the methods and legal grounds for data collection (Article 10.ç), and your rights (Article 10.d) regarding the personal data you may share with us.

1. Identity of the Data Controller (Article 10.a)

Your personal data will be processed, stored, and protected by NART Insurance and Reinsurance Brokerage Inc. as the data controller.

2. Purpose of Processing Your Personal Data (Article 10.b)

During the procurement of necessary products and services from you, the personal data you share with us will be processed by NART in accordance with the personal data processing conditions specified in Articles 5 and 6 of the Law, for the following purposes:

• Conducting the Company’s purchasing, accounting, production, planning, sales, and marketing activities;
• Determining the terms of the commercial relationship, managing mutual negotiation processes, preparing contracts, and communicating on other matters;
• Managing, monitoring, auditing, and controlling business processes;
• Collecting and forwarding requests for proposals;
• Managing commercial relationships with suppliers and business partners, handling orders and deliveries, providing post-purchase support, directing requests and complaints to suppliers and business partners, and conducting evaluations of supplier and business partner satisfaction and service quality, along with related activities;
• Conducting necessary work by our business units to benefit from the products and services you provide to our Company and executing related business processes;
• Managing communication, logistics, and occupational health and safety processes;
• Fulfilling obligations arising from supplier and business partner contracts and managing improvement processes related to these relationships;
• Establishing, interpreting, and using records such as commitments and statements for evidentiary purposes in the contractual relationship between the parties;
• Making necessary notifications to public authorities in cases related to incentives and legal obligations;
• Managing finance, accounting, payment, collection, refund, request, complaint, and invoicing processes;
• Determining and implementing the commercial and business strategies of our Company and ensuring the execution of our Company’s commercial policies.

Your personal data will be processed within the framework of the personal data processing conditions and purposes specified in Articles 5 and 6 of the Law.

3. Transfer and Purpose of Transferring Your Personal Data (Article 10.c)

The personal data you share with us may be transferred to customers, other business partners, and suppliers; service providers; Company officials; shareholders; our independent consultants and other solution partners who work with us under confidentiality agreements; and, if necessary, relevant third parties, public institutions and authorities, and judicial bodies, for purposes such as conducting necessary work by our business units to benefit from the products and services you provide to our Company, using the products and services procured from you according to Company needs, integrating them into the Company infrastructure, ensuring the continuity of the procurement process, managing customer relationships, fulfilling service contracts with other business partners and suppliers, ensuring the legal, commercial, and technical security of our Company and those in a business relationship with our Company, determining and implementing our Company’s commercial and business strategies, and identifying, analyzing, and addressing commercial risks and needs.

4. Method and Legal Grounds for Collecting Personal Data (Article 10.ç)

The personal data you share with us is processed by our Company through the offers, contracts, order forms, invoices, delivery notes, and other records provided by you in physical and electronic environments, and via email, through automatic or partially automatic means, based on the legal grounds specified in Article 5 of the Law, such as “the necessity of processing for the performance of a contract to which the data subject is party,” “the necessity for compliance with a legal obligation to which the data controller is subject,” “the necessity for processing to protect the legitimate interests of the data controller, provided that such processing does not harm the fundamental rights and freedoms of the data subject,” “it is explicitly prescribed by laws,” and “the necessity for the establishment, exercise, or defense of legal claims.”

5. Your Legal Rights (Article 10.d)

Your rights under Article 11 of the Law on the Protection of Personal Data include:

a) To learn whether your personal data is being processed; b) To request information if your personal data has been processed; c) To learn the purpose of processing your personal data and whether they are being used in accordance with that purpose; ç) To know the third parties to whom your personal data is transferred, domestically or internationally; d) To request the correction of your personal data if it is incomplete or inaccurate; e) To request the deletion or destruction of your personal data under the conditions set forth in Article 7 of the Law; f) To request notification of the actions taken regarding the correction, deletion, or destruction of your personal data to third parties to whom your data has been transferred; g) To object to any unfavorable outcome resulting from the automated processing of your personal data; ğ) To seek compensation for damages resulting from the unlawful processing of your personal data.

You can submit your requests regarding your rights to NART Insurance and Reinsurance Brokerage Inc. by following the procedures and principles outlined in the Communiqué on the Procedures and Principles of Application to the Data Controller. You may also use the KVKK Request Form, which we have prepared for you and is available on our website.

This Privacy Notice may be updated as necessary to ensure compliance with legal obligations and to protect the rights and privacy of individuals. Any updates will be communicated to you via email and/or announced on our website.