1. Identity Of The Data Controller

This Clarification Text has been prepared by Vodatech Çağrı Merkezi Anonim Şirketi (“Company”), in its capacity as the data controller, within the scope of Article 10 of the Law No. 6698 on the Protection of Personal Data (“KVKK”) and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Clarify.

• Title: Vodatech Çağrı Merkezi Anonim Şirketi

• Address: Helis Gold Ofis Yeşilbağlar Mah. Dumanlar Sk. No:1 Kat:10 34893 Pendik/Istanbul

• Phone: +90 216 578 6565

• E-mail: kvkk@vodatech.com.tr

2. Scope Of The Clarification Text

This text covers the personal data processing activities carried out through closed-circuit television (CCTV) systems installed in our Company’s headquarters in Kartal / Istanbul and its affiliated operational areas. These areas include all sections monitored by cameras, including common areas, call center operation floors, entry-exit points, and the parking lot. Private areas (locker rooms, toilets, etc.) are never monitored by cameras.

3. Categories Of Processed Personal Data

Camera recordings are exclusively visual in nature; no audio recording is performed. Recordings are not systematically analyzed before the retention period specified below expires; they are only subject to examination in the event of a security incident or legal necessity.

4. Method Of Collection And Legal Grounds

Your personal data is collected via automatic methods through CCTV cameras deployed at designated points within the Company premises. Data processing activities are based on the following legal grounds within the framework of Article 5/2 of the KVKK:

5. Purposes Of Processing Personal Data

CCTV recordings are processed solely for the following purposes:

• Ensuring physical space security and preventing unauthorized access,

• Protecting the life and property safety of employees, visitors, and third parties,

• Managing emergency processes,

• Fulfilling internal audits and legislative obligations regarding occupational health and safety,

• Resolving legal disputes and using recordings as evidence in potential conflicts,

• Fulfilling information and document obligations arising from legislation to authorized public institutions and organizations,

• Ensuring the security of Company assets and movable property,

• Executing data controller operations and information security processes.

6. Retention Period And Disposal

CCTV recordings are stored for 45 (forty-five) days from the date of recording. In determining this period, physical security requirements, the storage capacity of the system, and the need for evidence in potential legal disputes were taken into consideration.

Upon the expiration of the 45-day period, recordings are deleted automatically and irreversibly by the system in accordance with Article 7 of the KVKK. In cases where the retention of a specific recording is necessary due to a security incident or legal obligation, such recording may be kept in a separate and access-restricted environment until the relevant process is finalized.

7. Transfer Of Personal Data

As a rule, CCTV recordings are not shared with third parties. Transfers may only be made in the following cases and within the mandatory scope:

As a rule, no data transfer is made abroad.

8. Data Security Measures

Primary technical and administrative measures taken within the scope of Article 12 of the KVKK:

• Access to the recording system is restricted by role-based authorization; unauthorized access is prevented.

• Access logs are regularly maintained and audited.

• Camera images are stored on encrypted and access-restricted servers.

• Personnel with access to the system are assigned within the scope of confidentiality obligations.

• The presence of cameras is announced at the entrances of the relevant locations with warning signs.

9. Rights Of The Data Subject

You may exercise the following rights by applying to our Company within the scope of Article 11 of the KVKK:

• To learn whether your personal data is processed,

• To request information if it has been processed,

• To learn the purpose of processing and whether it is used in accordance with its purpose,

• To request correction if it is incomplete or incorrectly processed,

• To request deletion or destruction if the conditions are met,

• To demand compensation if you suffer damage due to unlawful processing.

Important Note: Since CCTV recordings also include images of third parties, it is mandatory to consider the rights of others and the principle of proportionality when evaluating your requests for deletion or access.

10. Application Method

You may submit your requests through the following channels:

• Application in person: Personally applying to Helis Gold Ofis Yeşilbağlar Mah. Dumanlar Sk. No:1 Kat:10 34893 Pendik/Istanbul with a document providing identity identification,

• Via notary public: Written application through a notary,

• Via e-mail: kvkk@vodatech.com.tr

Applications are finalized within 30 (thirty) days at the latest from the date of receipt. Your right to complain to the Personal Data Protection Board is reserved in cases where the application is rejected or not responded to in a timely manner.