Personal Data Protection and Processing Policy

Document Information

INFRENZY PAZARLAMA A.Ş. Personal Data Protection and Processing Policy

Introduction

INFRENZY PAZARLAMA A.Ş. Personal Data Protection and Processing Policy

1. Introduction

INFRENZY PAZARLAMA A.Ş. (the "Company") places the utmost importance on protecting individuals' fundamental rights and freedoms when protecting and processing personal data, particularly the right to privacy under Article 20 of the Constitution. In this context, it takes care to protect and process personal data lawfully under Law No. 6698 on the Protection of Personal Data (the "Law" or "Personal Data Protection Law") and follows this approach in all its planning and activities.

Our Company regards the protection and processing of personal data, which underpins privacy, as more than regulatory compliance: its approach is founded on the value it places on people. With this awareness, our Company takes all administrative and technical measures necessary to protect and process personal data lawfully.

2. Purpose of the Policy

The purpose of the Personal Data Protection and Processing Policy (the "Policy") is to provide the greatest possible protection for individuals' fundamental rights and freedoms, particularly privacy under Article 20 of the Constitution, when protecting and processing personal data by wholly or partly automated means, or by non-automated means as part of a data filing system, in accordance with the purpose of the Law. It also informs personal data owners (data subjects) about our Company's obligations and the procedures and principles it will follow under the Law. In line with this purpose, the Policy aims to ensure full regulatory compliance in our Company's personal data protection and processing activities and protect data subjects' rights to privacy and data security.

3. Scope of the Policy

This Policy applies to the following natural persons: job applicants, employees, interns, customer representatives, customer employees, prospective customer representatives/employees, Company shareholders/partners, Company officers, business partner representatives, business partner employees, subcontractor representatives, subcontractor employees, supplier representatives, supplier employees, consumers, family members of employees/officers/shareholders/interns, scholarship applicants/recipients, their family members, visitors and third parties. The Company informs these data subjects about the Law by publishing this Policy on its website. This Policy does not apply to legal entities in any capacity.

This Policy applies to the data subjects listed above when our Company processes their personal data by wholly or partly automated means, or by non-automated means as part of a data filing system. It does not apply if the data does not fall within the definition of "Personal Data" set out below, or if our Company's processing activity does not use the methods described above.

4. Definitions

The terms used in this Policy have the following meanings:

5. Effective Date of the Policy

Prepared by INFRENZY PAZARLAMA A.Ş. and effective as of July 13, 2026, this Policy is made available to data subjects through publication on the Company's website (www.infrenzy.ai) and applications.

Protection of Personal Data

6. Security of Personal Data

Under the Law, our Company takes all necessary administrative and technical measures to ensure an appropriate level of security for storing personal data safely and preventing unlawful processing and access. These measures are detailed in our Company's Personal Data Retention and Disposal Policy.

Our Company has established a "Personal Data Protection Management System" to ensure compliance with the Law and other regulations. It has also formed a Personal Data Protection Committee to implement this Policy and related policies.

7. Auditing

Our Company conducts and commissions the audits necessary to establish the data security described above and ensure the regularity and continuity of its measures. The Personal Data Protection Committee audits the measures taken to secure personal data.

8. Confidentiality

Taking into account technological capabilities and implementation costs, our Company takes all necessary administrative and technical measures to prevent relevant data controllers and processors from disclosing personal data contrary to the Law and this Policy or using it beyond its processing purpose. Company employees receive information and training on the Law and Policy, and relevant employees sign confidentiality agreements as part of recruitment.

9. Unauthorized Disclosure of Personal Data

If others obtain personal data processed by our Company through unlawful means, our Company takes the necessary steps to notify the data subject and the Personal Data Protection Board within the deadlines specified by the Board. If deemed necessary by the Board, the incident is announced on its website or by another method it considers appropriate.

10. Respecting Data Subjects' Legal Rights

Our Company respects all legal rights of data subjects relating to the implementation of the Policy and Law and takes all necessary measures to protect those rights.

11. Protection of Special Categories of Personal Data

Data relating to individuals' race, ethnic origin, political opinions, philosophical beliefs, religion, denomination or other beliefs, clothing, membership of associations, foundations or trade unions, health, sex life, criminal convictions and security measures, and biometric and genetic data are Special Categories of Personal Data. Our Company recognizes that disclosure of such data to others may cause harm or discrimination and carefully takes the adequate measures specified by the Board to protect this data when lawfully processed. It maintains a separate, systematic, clearly defined, manageable and sustainable policy (the Security Policy for Special Categories of Personal Data) and procedure.

Processing and Transfer of Personal Data

12. General Principles for Processing and Transferring Personal Data

Our Company processes personal data in accordance with the procedures and principles set out in the Law and this Policy, following the principles below.

12.1 Lawfulness and Fairness

Our Company processes personal data in accordance with applicable legislation and the requirements of fairness, using it within these limits. When pursuing its processing objectives, it considers data subjects' interests and reasonable expectations and acts to prevent outcomes they neither expect nor should be expected to anticipate. It also ensures processing is transparent to the data subject and complies with its information and notification obligations.

12.2 Accuracy and Keeping Data Up to Date When Necessary

Our Company ensures the personal data it processes is accurate and current, considering data subjects' fundamental rights and legitimate interests. It carefully considers whether data sources are identifiable, accuracy has been confirmed and updates are needed. Under its duty of active care, it always keeps channels open to ensure data subjects' information is accurate and current. Accurate, current personal data protects both our Company's interests and data subjects' fundamental rights and freedoms.

12.3 Processing for Specific, Explicit and Legitimate Purposes

Our Company clearly and precisely defines its processing purposes and ensures they are legitimate. A legitimate purpose means that the personal data processed is connected with, and necessary for, the Company's business or services. It does not process data for purposes other than those stated and carefully follows the principles of specificity and clarity in legal acts and texts describing processing purposes.

12.4 Relevance, Limitation and Proportionality to the Processing Purpose

Our Company ensures that personal data processed is suitable for achieving the stated purposes and avoids processing data that is unrelated or unnecessary. It does not collect or process data for purposes that do not currently exist but may arise later. Processing to meet potential future needs must satisfy the conditions set out in the Law as if processing were beginning for the first time. The Company limits processing to what is necessary and maintains a reasonable balance between processing and its intended purpose.

12.5 Retention for the Period Required by Legislation or the Processing Purpose

Our Company follows any retention periods specified by applicable legislation. Otherwise, it retains personal data only for as long as necessary for its processing purpose. If there is no valid reason for further retention, the data is deleted, destroyed or anonymized. Retention and disposal procedures are detailed in our Company's Personal Data Retention and Disposal Policy.

13. Conditions for Processing Personal Data

Our Company does not process personal data without the data subject's explicit consent. Personal data may be processed without explicit consent only where one of the following conditions is met:

14. Conditions for Processing Special Categories of Personal Data

Our Company does not process Special Categories of Personal Data without explicit consent. Such data may be processed without explicit consent only where one of the following conditions is met:

15. Conditions for Transferring Personal Data

Under Article 8 of the Law, our Company may transfer personal data to third parties, with necessary safeguards, based on and limited to one or more of the following processing conditions:

• The data subject has given explicit consent
• The law expressly provides for the transfer of personal data
• Transfer is necessary to protect the life or physical integrity of the data subject or another person, and the data subject cannot express consent due to actual impossibility or their consent is not legally valid
• Transfer of the personal data of parties to a contract is necessary and directly related to establishing or performing that contract
• Transfer is necessary for our Company to fulfill a legal obligation
• The personal data has been made public by the data subject
• Transfer is necessary to establish, exercise or protect a right
• Transfer is necessary for our Company's legitimate interests, provided the data subject's fundamental rights and freedoms are not harmed

Special Categories of Personal Data may be transferred, with adequate measures, based on and limited to one of the following conditions:

• The data subject has given explicit consent
• For Special Categories of Personal Data other than health and sex life, the law expressly provides for transfer
• Data concerning health and sex life may be transferred by persons bound by confidentiality or authorized institutions and organizations for the protection of public health, preventive medicine, medical diagnosis, treatment and care, and the planning and management of healthcare services and their financing

16. Conditions for Transferring Personal Data Abroad

Under Article 9 of the Law, our Company may transfer personal data abroad based on the data subject's explicit consent, with necessary safeguards.

Where a condition under Article 5(2) or Article 6(3) of the Law is met, and without prejudice to international treaties to which Türkiye is a party, our Company may also transfer personal data abroad without explicit consent. Such transfers are limited to countries declared by the Board to provide adequate protection, or, where protection is insufficient, countries for which data controllers in Türkiye and the receiving country have provided a written undertaking of adequate protection and obtained the Board's permission.

Personal Data Categories and Data Subject Groups

17. Personal Data Categories

Our Company processes personal data in the following categories:

18. Special Categories of Personal Data

Contact

If you have any questions or requests about this Policy, please contact us:

Email: bartu@infrenzy.ai

© INFRENZY PAZARLAMA A.Ş., 2026. This document may not be reproduced or distributed without the written permission of INFRENZY PAZARLAMA A.Ş.