Personal Data Protection Notice

1. Data controller and scope

QberX Teknoloji A.Ş. (the “Company”), operating under the QRegu brand, as data controller, informs you under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) about the personal data processed through the qregu.com website and the QRegu platform (web and mobile application).

Address: Dijitalpark Teknokent Ataşehir Yerleşkesi, Barbaros Mah. Şebboy Sk. No: 4/1 İç Kapı No: 2, 34758 Ataşehir / İstanbul
E-mail: info@qberx.com

This notice covers the personal data processing carried out when the website is visited, when contact is made through the website and when the QRegu platform is used.

2. Personal data processed, purposes and legal grounds

Website and platform visits, technical records

Personal data created while the website and the platform are accessed — Transaction Security (IP address, date and time of access, pages visited and actions taken, browser and device information, technical error and security records) — are processed to run the website and the platform, to resolve technical problems, to prevent unauthorised access and to protect information security.

This processing relies on Article 5/2-f of KVKK: processing being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Contact and demo requests

Personal data you share through the contact form, a demo request or e-mail (Identity: name and surname, organisation, title; Contact: e-mail address, telephone number; Customer Transaction: message content) are processed to assess your requests and questions, to reply to you and to provide the information you asked for.

This processing relies on the legitimate interest ground of Article 5/2-f of KVKK. Where the contact is directly related to the establishment or performance of a contract and processing the personal data of the parties to the contract is necessary, Article 5/2-c of KVKK applies.

Account and organisation membership

Personal data processed when an account is opened on the platform and used (Identity: name and surname, title, profile photo if any; Contact: e-mail address, telephone number if any; Customer Transaction: the organisation you are a member of, your unit and role, invitations, your tracking preferences) are processed to open your account and verify your identity, to manage your organisation membership and permissions and to provide you with the platform service. The administrators of the organisation account can see the organisation's members and the records of the actions taken on the platform.

This processing relies on Article 5/2-c of KVKK: processing the personal data of the parties to a contract being necessary, provided that it is directly related to the establishment or performance of the contract.

Uploaded documents and assessments

The documents you upload to the platform and the results of their assessment (Customer Transaction) are processed to assess the documents' compliance with regulation, to keep them in your organisation's regulation inventory and to present the results to you. This processing relies on Article 5/2-c of KVKK.

We ask you not to include in the documents you upload any personal data not needed for the assessment, or special categories of personal data such as health information.

The assistant (Regu) and conversation history

The questions you write to the assistant, the text of the PDF and Word documents you attach to a conversation, the answers given, the sources shown in an answer and the dates of the conversation (Customer Transaction) are processed to answer your questions, to keep your conversations so that you can open them later, continue where you left off, search your past conversations and download a conversation as a PDF. Information in your questions such as Turkish identity numbers, tax identity numbers, IBANs, card numbers, telephone numbers and e-mail addresses is masked before it is sent to the artificial intelligence service provider and before it is kept. A document you attach to a conversation is read so that your questions can be answered from it, and its text is sent to the artificial intelligence service provider; the document's text is not masked. The document's file is deleted once it is read; the text read from it is kept with the conversation. Your conversations are shown on the platform to you alone; other users and the administrators of your organisation cannot see them. You can delete a conversation at any time.

This processing relies on Article 5/2-c of KVKK.

We ask you not to write to the assistant any personal data not needed for your question, or special categories of personal data such as health information, and not to attach documents containing such data.

Support requests

Requests you send through the support centre (Identity: name and surname; Contact: e-mail address; Customer Transaction: the subject and description of the request, the files you attach and, if you opened the request from the assistant, the transcript of that conversation) are processed to assess your request, reply to you and resolve the request. This processing relies on Article 5/2-c of KVKK.

Notifications

Notifications about developments on the platform (Contact: e-mail address, telephone number if any; on the mobile application, the device information needed to send notifications to your device) are processed to send you e-mail, SMS, in-app and mobile notifications on service matters such as regulatory changes, tasks and approvals. This processing relies on Article 5/2-c of KVKK.

Promotional commercial electronic messages are sent only if you have given your explicit consent and your approval for such messages (KVKK Article 5/1).

Legal obligations and protection of rights

The data and records above are, where necessary, processed for the Company to fulfil its legal obligations and to establish, exercise or protect a right, relying on Articles 5/2-ç and 5/2-e of KVKK.

3. Method of collection

Your personal data are collected by automated means through the technical infrastructure and server records of the website and the platform; and through the contact form, demo requests, the forms on the platform, the assistant, the support centre and e-mail, by automated means or by non-automated means provided that they are part of a data recording system. If you are invited to an organisation account, your name and e-mail address may be entered by the administrator of your organisation.

4. Transfer of personal data

Your personal data are transferred, limited to the purposes described in this notice and with the necessary security measures, to:

• information technology service providers from whom hosting, database, identity verification, file storage, maintenance and security services are obtained for the platform and the website;
• e-mail, SMS and notification infrastructure providers, for notifications, contact details and message contents;
• artificial intelligence service providers, for answering the assistant's questions and for regulation and document assessment;
• the administrators of the organisation account you are a member of, for organisation membership and the records of actions on the platform;
• competent public institutions and organisations and legal advisers, where necessary to fulfil legal obligations or to protect rights

within the conditions set out in Article 8 of KVKK.

Some of the information technology, notification and artificial intelligence service providers have their servers abroad. Transfers to these providers are made in accordance with the conditions set out in Article 9 of KVKK, relying on adequacy decisions announced by the Personal Data Protection Board or on standard contracts concluded with the relevant service providers.

5. Cookies and similar technologies

Our website uses, besides necessary technologies, analytics cookies; it uses no advertising cookies.

Necessary technologies: your browser's local storage is used to record your cookie preference and your language choice and to remember them on your next visits; these records are kept until you delete them from your browser. Necessary technologies are also used on the platform to keep your session. Processing through necessary technologies relies on Article 5/2-f of KVKK and is not subject to explicit consent.

Analytics cookies: used through the Google Analytics service (provider: Google) to measure how many people visit the website and how often its pages are viewed, and to improve the website. Analytics cookies are used only with your explicit consent (KVKK Article 5/1) and are kept for at most 24 months. Data obtained through these cookies may be transferred to the provider's servers abroad; the transfer is made in accordance with the conditions set out in Article 9 of KVKK, relying on adequacy decisions announced by the Personal Data Protection Board or on standard contracts concluded with the service provider.

Cookies that require explicit consent are not activated before your approval. You can set, refuse or later change your preference in the website's cookie notice.

6. Retention period

Your personal data are kept for as long as the purposes of processing require and, where applicable, within the retention periods set out in the relevant legislation.

• Contact and demo requests and correspondence: 2 years from the resolution of the request. If the correspondence turns into a contract or commercial relationship, the related records are kept for 10 years under Article 82 of the Turkish Commercial Code No. 6102.
• Account and organisation membership information: for as long as your membership continues; after your account is closed, for the retention periods in the legislation.
• Assistant conversations (including the text of the documents you attach): until you delete them; deleted when you leave or are removed from the organisation, or when your account or the organisation account is deleted.
• Uploaded documents and assessments: for as long as the organisation account continues or until deleted by your organisation.
• Support requests: 2 years from the resolution of the request.
• Technical access, error and security records: at most 2 years.
• Cookie and preference data: your cookie and language preference until you delete them; analytics cookies at most 24 months (see section 5).

Where there is a dispute or a legal retention obligation, the related records may be kept for as long as necessary. When the reasons requiring retention cease, your personal data are deleted, destroyed or anonymised in accordance with the legislation.

7. Security of personal data

The Company takes appropriate technical and administrative measures to prevent the unlawful processing of personal data and unlawful access to it, and to ensure its safekeeping.

Access to personal data is limited to those who need it because of their duties and authorisations. Those who access personal data and the service providers processing data on the Company's behalf are made to comply with their confidentiality and data security obligations.

8. Your rights under KVKK

Under Article 11 of KVKK, you have the right to:

• learn whether your personal data are processed;
• request information if your personal data have been processed;
• learn the purpose of processing your personal data and whether they are used in line with that purpose;
• know the third parties in Türkiye or abroad to whom your personal data are transferred;
• request correction if your personal data are processed incompletely or incorrectly;
• request the deletion or destruction of your personal data within the conditions set out in Article 7 of KVKK;
• request that correction, deletion or destruction be notified to the third parties to whom your personal data were transferred;
• object to a result against you arising from the analysis of the processed data exclusively through automated systems;
• claim compensation if you suffer damage because of unlawful processing of your personal data.

Where there is processing based on your explicit consent, you can withdraw the consent you gave. Withdrawal does not affect the lawfulness of processing carried out before the date of withdrawal.

9. How to apply

You can send your requests concerning your rights, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller:

• by a written application to the Company address given above;
• by notification through a notary;
• to the Company's registered electronic mail (KEP) address, if any;
• using a secure electronic signature or mobile signature;
• to info@qberx.com from an e-mail address you have previously given to us and that is registered in our system.

Your application must contain the information required by the legislation that allows your identity and your request to be determined. Additional information to verify your identity may be requested where necessary to conclude the application securely.

Your applications are concluded as soon as possible according to the nature of the request and within thirty days at the latest; the answer is given in writing or electronically. Applications are in principle free of charge. If the action requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.

10. Updates to this notice

This notice may be updated in line with changes to the functions of the website and the platform or to the personal data processing activities. The current notice is published on this page with its last update date. Where the legislation requires further notice, the data subjects concerned are informed as needed.