1. PURPOSE

Ram and Sons İnşaat ve Dış Ticaret Anonim Şirketi, located at Büyükdere Mah., Ahiler Çıkmazı Sk., Sarıyer Belediyesi, Blok No: 19, Sarıyer / Istanbul (hereinafter referred to as “Rams” or the “Company”) has prepared this Privacy Notice in order to fulfil its obligations arising from the Personal Data Protection Law No. 6698 (“PDPL” or the “Law”), in line with its respect for fundamental human rights and its sensitivity regarding the protection of personal data.

DATA CONTROLLER

Rams, acting as the data controller, collects, processes, and safeguards the personal data of its customers in accordance with the Personal Data Protection Law (PDPL) Within the scope of the PDPL, Rams aims to increase its customers’

awareness regarding personal data processing activities, to transparently explain such processing activities, and to fulfil its disclosure obligation under Article 10 of the PDPL. In this context, Rams provides detailed information and clarification to its customers within the framework set out below.

DEFINITIONS

Personal Data

Any information relating to an identified or identifiable natural person.

Special Categories of Personal Data

Personal data relating to the race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other belief, appearance, membership to associations, foundations or trade-unions, data concerning health, sexual life, criminal convictions and security measures, and the biometric and genetic data are deemed to be special categories of personal data. Special Categories of Personal Data are data that pose a greater risk to the privacy of the data subject. The processing of these categories of data is strictly regulated.

Data Controller

Natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data filing system. In this context, Rams acts as the data controller.

Data subject

Data subject means the natural person, whose personal data are processed.

PDPL

It refers to the Personal Data Protection Law No. 6698, which entered into force on April 7, 2016.

Explicit Consent

Explicit consent means freely given, specific and informed consent.

Data Processing

It refers to any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Personal Data Breach

Personal Data Breach Personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Disposal

Disposal It refers to erasure, destruction or anonymization of personal data.

Anonymization

Anonymization is the process of rendering personal data impossible to link with an identified or identifiable natural person, even through matching them with other data.

Recording Medium

It refers to any type of environment that keeps the personal data processed wholly or partially by automated means or non-automated means which provided that form part of a data filing system.

Data Processor

It refers to natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Data Transfer

It refers to the sharing personal data with third parties domestically or abroad.

Personal Data Protection Policy

The internal Company document governing principles and procedures for processing, storing and protecting personal data.

PURPOSES OF PROCESSING YOUR PERSONAL DATA, CATEGORIES OF PERSONAL DATA, METHODS OF COLLECTION AND LEGAL BASES

Purposes of Processing

a. Your personal data are processed for the following purposes, in compliance with the limitations set forth under the PDPL:

• Execution of goods and service sales processes,
• Management of customer relationship processes,
• Management of customer relationship processes,
• Conducting communication processes,
• Conducting information security processes,
• Auditing product sales processes,
• Conducting finance and accounting audits,
• Executing contractual processes,
• Carrying out financial and accounting operations,
• Providing information to authorized institutions and organizations,
• Managing customer relations and providing after-sales services,
• Conducting marketing analysis activities,
• Managing and organizing commercial electronic communication processes,
• Carrying out company/product/service loyalty processes,
• Managing advertising, campaign, and promotion activities,
• Carrying out site management operations..

b. In addition, your personal data are processed by our Company only if you have given your explicit consent, and provided that you have also consented to receive commercial electronic messages, for the purposes of conducting general or personalized campaigns, advantages, promotions, product/service introductions, advertisements, notifications and marketing activities; carrying out customer satisfaction surveys related to products and services; and contacting you to inform you about campaigns, discounts, gifts, contests, greetings, well wishes, and raffles.

Within this scope, if you consent to the processing of your personal data for the purposes specified above, you are also required to approve the separately provided ‘Commercial Electronic Message Consent Form.’ Upon providing such consent, we may inform you about current developments and updates regarding our projects. If you do not provide your consent, your personal data will only be processed for the purposes specified in section 4.1(a) of this Privacy Notice, and no commercial electronic messages will be sent to you.

Personal Data We Process

In accordance with the principle of “data minimization” set forth in Article 4 of the Personal Data Protection Law No. 6698, our Company undertakes to collect and process only those personal data that are relevant, limited and proportionate to the purposes of processing. Within this scope, the categories of personal data processed by our Company are as follows:

Identity Information

Name/Surname, Turkish ID Number, Signature, Date of Birth, ID Serial Number, Gender, Mother’s/Father’s Name, Marital Status, Nationality

Contact Information

Address, Phone Number, E-mail Address, Workplace Address, Residential Address

Professional Experience/ Professional Knowledge

Sector of Employment, Employer, Professional Background, Workplace, Educational Background

Financial Information

Account Number

Customer Transaction Information

Payment Plan, Payment Preferences, Type of Real Estate Interested In, Purpose of Real Estate Purchase, Purchased Property Details, Delivery Date of the Purchased Property, Collection Information, Satisfaction Survey Results, Complaint and Request Information, Information on Projects Previously Purchased by the Customer, Number and Amount of Referral Sales

Physical Premises Security

CCTV Footage, Entry and Exit Records

Audio and Visual Recordings

Photograph on ID Document

Other

Commercial Electronic Message Consent Records, Appointment Information, Information on Whether the Customer Attended the Appointment, Information on Whether the Customer Purchased an Independent Unit, Number of Children

Methods of Collecting Your Personal Data

• Physically, through customer information forms and sales contracts completed by you at our sales offices.
• Through payment plans and collection documents, in order to manage your purchasing process and carry out financial transactions,
• Electronically, via applications submitted and contact forms completed on our website and social media accounts.
• Through e-mail and other digital communication channels, within the scope of customer support services, complaint management, and sales processes.
• Through satisfaction surveys and feedback forms, for the purposes of improving customer satisfaction, enhancing our service quality, and evaluating your feedback.
• Through CCTV systems located in our sales offices, for the purpose of ensuring physical premises security.

Legal Grounds for Processing General Personal Data

Your personal data may be processed by Rams in order to carry out its business activities, within the scope of the conditions and purposes for processing personal data specified in Article 5 of the Personal Data Protection Law and in accordance with the principles and procedures prescribed by the relevant legislation. Your data are processed for the purposes stated in this Privacy Notice and to fulfil the Company’s legal obligations, based on the following legal grounds:

TRANSFER OF PERSONAL DATA

Our Company transfers customers’ personal data only in accordance with the provisions of the Personal Data Protection Law (PDPL) and other relevant legislation, and in line with the purposes of processing. Personal data may be shared with the following parties under the circumstances listed below:
•For the purpose of carrying out our customers’ sales transactions, issuing invoices, fulfilling tax obligations, and making statutory notifications, invoice and financial record information are electronically transferred to the Revenue Administration (GİB) within the framework of the applicable legislation.
• Our Company works with eLogo Electronic Service Provider within the scope of e-invoicing services. Accordingly, the personal data contained in invoices, payment records, and purchase details are processed and transferred through eLogo systems in compliance with the relevant legislation.
• For the purpose of carrying out our customers’ payment processes and facilitating housing loan transactions, personal data are transferred to the relevant banks.
• When necessary, personal data are transferred to independent audit firms for the purposes of examining our Company’s financial and operational processes in accordance with independent audit regulations, fulfilling legal obligations, and verifying company records.
• In accordance with legal regulations, personal data may be shared with courts, public prosecutors’ offices, law enforcement authorities (police, gendarmerie), regulatory and supervisory bodies, notaries, and other public authorities upon request, for the purpose of carrying out legal proceedings.
• Personal data may be shared with contracted attorneys and law firms for the purposes of representing the Company in legal proceedings or obtaining legal consultancy services. Such transfers are limited solely to the necessity of the relevant legal process and are carried out by taking all necessary technical and administrative measures to ensure the security of personal data.
• Your consent for commercial electronic communication is transferred to the İleti Yönetim Sistemi (Message Management System) (İYS).
• In order for you to benefit from the advantages offered under the Loyalty Program, the necessary personal data are transferred to the companies with which we cooperate and from which we receive services.
• For the purposes of conducting marketing analysis activities, enhancing customer satisfaction, and effectively managing advertising, campaign, and promotion processes tailored specifically to you, your personal data are shared with Diler Medya İletişim Limited Şirketi and Lead Plus Media.
• Customers’ personal data may be shared between Rams Holding A.Ş. and the companies within Rams Holding A.Ş. for the purposes of coordinating business processes, conducting strategic planning, carrying out audit activities, and managing joint operations.
• Your personal data may be transferred to the landowners for the purposes of fulfilling the obligations arising from the revenue-sharing arrangements within the project, carrying out sales processes, completing title deed transfer transactions, and reporting information regarding the sold independent units.
• Following the delivery of the independent units within the scope of the project, personal data of the relevant individuals may be transferred to the site management, on a limited basis, for the purpose of carrying out site management activities, within the framework of the collective building management plan.

TRANSFER OF PERSONAL DATA ABROAD

Your personal data are transferred abroad to Microsoft Corporation, whose servers are located outside of Turkey, in accordance with the data transfer conditions set forth in Articles 8 and 9 of the Personal Data Protection Law. In addition to the purposes stated above, this transfer is carried out particularly for the purpose of performing data storage activities. During this transfer, all necessary legal, technical, and administrative measures are taken under the Law to ensure that your personal data are protected at the highest possible level.

RIGHTS OF THE DATA SUBJECT

Within the scope of the Personal Data Protection Law (PDPL), you have the following rights:

• to learn whether his/her personal data are processed or not,
• to demand for information as to if his/her personal data have been processed,
• to learn the purpose of the processing of his/her personal data and whether these personal data are used in compliance with the purpose,
• to know the third parties to whom his personal data are transferred in country or abroad,
• to request the rectification of the incomplete or inaccurate data, if any,
• to request the erasure or destruction of his/her personal data under the conditions set forth in the PDPL and the relevant legislation.
• To request notification to third parties to whom personal data have been transferred in cases of erasure or destruction,
• to object to the occurrence of a result against the person himself/herself by analyzing the data processed solely through automated systems,
• to claim compensation for the damage arising from the unlawful processing of his/her personal data.

HOW CAN YOU EXERCISE YOUR RIGHTS?

You may submit your requests within the scope of Article 11 of the Personal Data Protection Law (PDPL) by filling out the “Data Subject Application Form”, which can be accessed through the relevant link, in accordance with Article 5 of the Communiqué on the Principles and Procedures for the Application to the Data Controller dated March 10, 2018.

Applications submitted within this scope will be concluded free of charge within the shortest time possible and, in any case, within thirty (30) days at the latest. However, if the process entails an additional cost, a fee may be charged according to the tariff determined by the Personal Data Protection Board.

If the information or documents provided are incomplete, the response period shall commence once the missing information or documents are completed. Rams reserves the right to verify your identity before responding to your request. Responses may be sent, at Rams’ discretion, in writing to the applicant’s postal address or electronically to the e-mail address you have provided.

DATA CONTROLLER INFORMATION

Full Name: RAM AND SONS İNŞAAT VE DIŞ TİCARET ANONİM ŞİRKETİ

VKN: Sarıyer Vergi Dairesi / 7341504228

Address: Büyükdere Mah., Ahiler Çıkmazı Sk., Sarıyer Belediyesi, Blok No: 19, Sarıyer/İstanbul

Website : www.ramsturkiye.com.tr

Telephone: 444 47 48