EG678 Cloud Data Protection and Privacy Notice

Emre Göktepe, providing services under the EG678 Cloud brand, values the protection and confidentiality of personal data processed in the course of his own activities.

This notice has been prepared to inform data subjects who contact EG678 Cloud, receive quotations or purchase services, under the Turkish Personal Data Protection Law No. 6698 (“KVKK”).

The data controller for personal data processed by EG678 Cloud in the course of its own commercial activities is:

Emre Göktepe – EG678 Cloud Tax Office: Karaelmas Tax Number: 4060333560 Address: Güney Mahallesi Kemal Yıldırım Sk. B Blok Kapı No: 2/1 Daire No: 14, Kilimli/Zonguldak Email: [email protected] Telephone: +90 552 890 85 67

Depending on the nature of the service relationship, the following personal data may be processed:

• first and last name,
• company and job information,
• telephone number,
• email address,
• billing and tax information,
• customer communication records,
• service and order information,
• payment and invoicing records,
• technical support correspondence,
• IP and connection information,
• security and system logs.

The nature of the service provided may require the processing of other personal data.

Personal data may be processed for:

• preparing quotations,
• handling orders and service processes,
• installing and delivering services,
• carrying out invoicing and accounting operations,
• providing technical support,
• maintaining customer communications,
• ensuring information and system security,
• protecting service continuity,
• fulfilling legal obligations,
• managing requests, complaints and disputes.

Personal data may be obtained through:

• email,
• telephone,
• WhatsApp and similar communication channels,
• the website,
• quotation and order processes,
• invoices,
• technical support discussions,
• server, network and security systems.

Data may be collected by electronic or physical means through these channels.

Depending on the specific processing activity, personal data may be processed on legal bases set out in Article 5 of the KVKK, such as:

• being directly related to the conclusion or performance of a contract,
• being necessary for the data controller to fulfil a legal obligation,
• processing being necessary for the establishment, exercise or protection of a right,
• processing being necessary for the data controller's legitimate interests, provided that the data subject's fundamental rights and freedoms are not harmed.

Explicit consent is obtained separately for processing activities where it is legally required.

To the extent necessary to provide the service or fulfil legal obligations, personal data may be transferred to:

• accounting and financial advisory service providers,
• data centre and infrastructure providers,
• licensing and technology providers,
• legal or technical advisers,
• legally authorised public institutions and organisations.

Transfers are carried out in accordance with the applicable provisions of the KVKK.

Where personal data is transferred abroad, the applicable KVKK provisions governing international transfers are followed.

As a rule, the Customer is responsible for determining the purposes and legal bases for processing content and personal data stored on servers leased or used by the Customer.

Where EG678 Cloud needs to access personal data on the Customer's behalf while providing technical support, security, system administration or separately purchased backup services, the parties' roles and obligations under the KVKK are assessed according to the nature of the service provided.

EG678 Cloud does not use its technical access authority to inspect Customer data for purposes unrelated to the service.

EG678 Cloud seeks to take appropriate technical and organisational measures to prevent personal data under its responsibility from being:

• unlawfully processed,
• unlawfully accessed,
• disclosed to unauthorised persons.

These measures also aim to ensure that the data is stored securely.

Personal data is retained for the period necessary for the relevant processing purpose and for statutory retention periods prescribed by applicable legislation.

When the processing purpose and the legal retention obligation cease to exist, personal data is deleted, destroyed or anonymised in accordance with applicable legislation.

The technical retention period for data on Customer servers after termination of the service is regulated separately in the EG678 Cloud Terms of Service.

Under Article 11 of the KVKK, data subjects have the following rights, to the extent applicable:

• to learn whether their personal data is being processed,
• to request information about the processing of their personal data,
• to learn the purpose of processing and whether their personal data is used in accordance with that purpose,
• to learn the third parties to whom their personal data is transferred,
• to request correction of incomplete or inaccurate personal data,
• to request deletion or destruction of their personal data where the statutory conditions are met,
• to request that correction or deletion be notified to third parties to whom their personal data has been transferred,
• to object to a result arising against them through analysis exclusively by automated systems,
• to claim compensation for damage caused by unlawful processing of their personal data.

Requests under the KVKK may be submitted to EG678 Cloud through the following contact channels:

Emre Göktepe – EG678 Cloud Address: Güney Mahallesi Kemal Yıldırım Sk. B Blok Kapı No: 2/1 Daire No: 14, Kilimli/Zonguldak Email: [email protected] Telephone: +90 552 890 85 67

Applications are assessed in accordance with the procedures and time limits prescribed by applicable legislation.

EG678 Cloud does not use the Customer's commercial, technical or other confidential information accessed in the course of providing the service for purposes other than those required by the service, and does not share it with unauthorised third parties.

Legal obligations and lawful requests from competent authorities remain unaffected.

This notice may be updated to reflect changes in legislation, services or personal data processing activities.

The current version is published on the EG678 Cloud website.