TERMS OF

A. Introduction

This Clarification Text has been prepared to provide detailed information to you, our esteemed customers, regarding the personal data processing activities conducted by Doğuş Otomotiv, in its capacity as importer and distributor, with a view to adding value to the sales and/or after-sales service processes offered by authorized dealers—each possessing a distinct legal entity—authorized to provide sales and/or after-sales services for the brands represented, as well as the data processing activities carried out by the Authorized Dealer in alignment with the services provided at their sales and service points.

B. Identities of the Data Controllers

Doğuş Otomotiv ("Doğuş Otomotiv Servis ve Ticaret A.Ş."), in its capacity as importer and distributor, and the Authorized Dealer (you may access the full commercial title regarding the legal entity of the authorized dealer on the website of the relevant brand featuring Doğuş Otomotiv's current authorized dealer and service information), as separate data controllers, attach the utmost importance to the fundamental rights and freedoms of individuals. They exhibit the highest level of sensitivity toward processing all personal data relating to natural persons associated with Doğuş Otomotiv and the Authorized Dealer, including individuals benefiting from our products and services, in compliance with the Personal Data Protection Law No. 6698 ("Law"), and toward ensuring the confidentiality and security thereof.

C. Which Personal Data Do We Process?

Identity Data: Your name and surname, date of birth, Republic of Türkiye identity number.

Contact Data: Any contact information you have conveyed to Doğuş Otomotiv and/or the Authorized Dealer, including your e-mail address, telephone number, residential address, and social media account contact details.

Customer Transaction Data: Your information conveyed orally/in writing or electronically to Doğuş Otomotiv and/or the Authorized Dealer within the scope of your requests and complaints regarding our products and services; information regarding the products or services you have acquired (vehicle license plate, vehicle model, vehicle information including transaction history, your information contained within the vehicle registration certificate [registration document]); details of the products and services you have requested and received in the past or currently; your complaints and/or requests conveyed via the Doğuş Otomotiv Value and Interest Center (DİM), where dialogue (interest management), roadside assistance, and call center (survey and reservation) services provided through third-party service providers for the brands distributed by Doğuş Otomotiv or via the website, mobile application, and social media accounts belonging to Doğuş Otomotiv regarding the products or services you purchased are managed, as well as logs regarding the operations performed during the evaluation or management process of these complaints and/or requests.

Transaction Security Data: Your IP address information.

Marketing Data: Your preferences or past experiences regarding our products or services, surveys, campaign information, cookie records obtained from the website, mobile application, and social media accounts belonging to Doğuş Otomotiv, marketing SMS and e-mail messages sent based on the commercial electronic communication consent you have granted, or calls made by the Doğuş Otomotiv Value and Interest Center (DİM), and your social media user information (in the event you have established contact via social media belonging to Doğuş Otomotiv).

Financial Data: Your information regarding invoices and payment instruments within the scope of our products or services.

Visual and Audio Recording Data: Call center recordings obtained by the Doğuş Otomotiv Value and Interest Center (DİM), where dialogue (interest management), roadside assistance, and call center (survey and reservation) services provided through third-party service providers for the brands distributed by Doğuş Otomotiv are managed.

Legal Action Data: Documents/information requested by judicial and administrative authorities, and data regarding judicial and administrative processes (for instance, lawsuits and investigation files).

D. On Which Data Processing Condition and How Do We Collect Your Personal Data? For What Purposes Do We Use It?

Your personal data are collected via (i) face-to-face interviews and printed forms executed at our Authorized Dealer ("Physical Channels"), (ii) the Doğuş Otomotiv Value and Interest Center (DİM), e-mail, SMS, and digital platforms ("Call Channels"), (iii) websites, mobile applications managed by Doğuş Otomotiv, and through communication, reservation, and other request forms featured therein ("Digital Channels"), and (iv) social media accounts belonging to Doğuş Otomotiv ("Social Media Channels").

Your collected personal data are processed within the scope of the data processing conditions and purposes specified in Article 5 of the Law, for the purposes set forth below ("Purposes").

Personal data processing activities in terms of the data processing purposes regarding the personal data categories listed in the table below are carried out by Doğuş Otomotiv in its capacity as data controller:

Personal Data Categories	Personal Data Processing Purposes	Legal Grounds
Identity, contact, customer transaction, visual and audio recording	Execution of call center processes through the Doğuş Otomotiv Value and Interest Center (DİM) Management of websites and social media accounts belonging to Doğuş Otomotiv	Data processing being mandatory for the legitimate interests of the data controller, provided that it does not prejudice the fundamental rights and freedoms of the data subject
Identity, contact, customer transaction, visual and audio recording	Provision of video call services on websites belonging to Doğuş Otomotiv and live support services through the Doğuş Otomotiv Value and Interest Center (DİM)	Processing of personal data belonging to the parties to a contract being necessary, provided that it is directly related to the establishment or performance of said contract Data processing being mandatory for the legitimate interests of the data controller, provided that it does not prejudice the fundamental rights and freedoms of the data subject

Personal data processing activities in terms of the data processing purposes regarding the personal data categories listed in the table below are carried out separately by Doğuş Otomotiv and the Authorized Dealer as independent data controllers:

Personal Data Categories	Personal Data Processing Purposes	Legal Grounds
Identity, contact, customer transaction, visual and audio recording, financial	Provision of our products and services Execution of sales and leasing transactions Provision of after-sales support services Provision of assistance services Management of substitute vehicle allocation processes Provision of second-hand vehicle purchase, sale, and trade-in services Execution of invoicing processes Making announcements and providing information regarding the products and services offered	Processing of personal data belonging to the parties to a contract being necessary, provided that it is directly related to the establishment or performance of said contract
Identity, contact, customer transaction, visual and audio recording, financial	Execution of financial operations (including financial reporting, control, verification, analysis, and evaluations, as well as execution of payment and refund transactions) Development and improvement of products and services offered Conduct of measurement and evaluation studies to diversify our activities toward our products and services, better understand our customers, continuously improve services, and achieve higher quality standards for the products and services offered Customization, renewal, and optimal redesign of our products and services in light of the preferences, habits, and feedback of our customers or potential customers (We do not create customized products for you or perform promotional activities targeted at you without your explicit consent.) Management of requests and complaints	Data processing being mandatory for the legitimate interests of the data controller, provided that it does not prejudice the fundamental rights and freedoms of the data subject
Identity, contact, financial, customer transaction, visual and audio recording, legal action	Conducting activities in compliance with the applicable legislation Performing compliance audits Fulfillment of obligations arising from consumer legislation (including the establishment and retention of contracts, provision of information regarding sales and service operations, provision of after-sales support services, provision of assistance services and substitute vehicles when necessary, opening records regarding product safety and service status, and making announcements and disclosures) Fulfillment of required obligations (including retention and sharing) pursuant to the applicable legislation in insurance-related processes Taking measures against cases of financial fraud and abuse Fulfillment of tax and similar payment and reconciliation obligations Fulfillment of requests from official institutions Providing information to authorized entities as required by legislation Ensuring compliance with retention obligations prescribed by legislation Responding to data subject applications in compliance with legislation and executing the necessary operations	Being explicitly prescribed by laws Being mandatory for the fulfillment of our legal obligations as data controller
Identity, contact, customer transaction, marketing, transaction security	Formulation of sales and marketing strategies through the generation of statistical information and construction of user profiles; execution of deduplication, listing, reporting, verification, analysis, and evaluations within the database to ensure customer service quality; contacting customers/potential customers via the communication channels provided for offers, information, and callback requests they may convey through any channel; ensuring customer/potential customer relationship management; planning and/or execution of membership transaction processes; utilization in marketing activities such as campaigns, promotions, competitions, loyalty programs, and sweepstakes; ensuring the conduct of surveys, customer satisfaction research, and event activities; formulation of personalized offers; planning and/or execution of advertising, promotional, and marketing activities on Digital Channels and Social Media Channels; establishing contact with customers/potential customers in line with their requests; sending all types of communications and other correspondence messages regarding the requested product or service; execution of personalized advertising applications (displaying advertisements via search engines, social media platforms, and data management platforms through data enrichment, cross-device targeting, and delivering tailored advertisements, promotions, sales, marketing, event management, disclosures, promotions, and campaign notifications to provide various advantages tailored to individuals' preferences and tastes)

INFORMATION: Purposes directly linked to the administrative, operational, and legal processes of the Authorized Dealer in the field of sales or after-sales services—such as the execution of vehicle sales transactions to disabled customers, conduct of financial operations within this scope, management of insurance processes, administration of substitute vehicle allocation processes, execution of vehicle delivery processes to third parties, management of call center processes through switchboards directly operated by the Authorized Dealer, management of security and camera recordings of the Authorized Dealer, and conduct of information sharing processes with traffic advisory firms—are carried out by the Authorized Dealer in its capacity as data controller. To obtain information from the Authorized Dealer regarding the data processing purposes pursued by the Authorized Dealer as a data controller, please refer to the section "G- How can you make your applications pursuant to Article 11 of the Law?" of this Clarification Text.

E. With Whom and For What Purposes Can Your Personal Data Be Shared?

Your personal data are transferred based on the purposes and legal grounds set forth below:

With relevant public institutions and our financial advisors regarding financial processes so that we can fulfill our legal obligations, and with service providers from whom we receive technical support due to obligations arising from consumer legislation;

To fulfill our contractual obligations, between the Authorized Dealer and Doğuş Otomotiv, and with the relevant authorized dealers and authorized service stations of Doğuş Otomotiv (you may access the current authorized dealer and service information of Doğuş Otomotiv on the websites of our respective brands) and, for the same purposes, with Doğuş Bilgi İşlem ve Teknoloji Hizmetleri A.Ş., Doğuş Holding A.Ş., affiliates and subsidiaries of Doğuş Holding A.Ş., and third-party service providers rendering technical support; with insurance companies and agencies if arising specifically from the contract, and with banks and other financial institutions if required in line with your request;

Within the scope of our legitimate interest, with consultants and other technical service providers from whom we procure services, with Doğuş Bilgi İşlem ve Teknoloji Hizmetleri A.Ş., Doğuş Holding A.Ş., affiliates and subsidiaries of Doğuş Holding A.Ş., and third-party service providers rendering technical support;

We may share your personal data with third parties within the country and/or abroad with whom Doğuş Otomotiv has a contractual relationship, for the purpose of executing communication and promotional activities subject to your explicit consent—primarily including the provision and sale of goods and services offered by our Company, planning, monitoring, and developing after-sales support service processes, marketing, campaigns, events, and personalized advertising activities—as well as with Doğuş Holding affiliates and subsidiaries, whose list can be accessed at (https://www.dogusgrubu.com.tr/), its shareholders, the manufacturer companies of the vehicles imported by Doğuş Otomotiv, the affiliates of manufacturer companies and/or third parties designated by these companies, Doğuş Otomotiv authorized dealers and authorized service stations, and companies rendering research, promotional, and consultancy services that process data on behalf of Doğuş Otomotiv and authorized dealers/authorized service stations, in order to enable the provision of these services.

Identity of the Data Controller

F. What Are Your Rights Regarding Your Personal Data?

Pursuant to Article 11 of the Law;

• To learn whether your personal data are processed or not,
• To request information if your personal data have been processed,
• To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
• To know the third parties to whom your personal data are transferred within the country or abroad,
• To request the rectification of your personal data if they are processed incompletely or inaccurately, and to request that the operation performed within this scope be notified to the third parties to whom your personal data have been transferred,
• To request the erasure or destruction of your personal data in the event that the reasons requiring their processing cease to exist despite having been processed in accordance with the provisions of the KVKK and other relevant laws, and to request that the operation performed within this scope be notified to the third parties to whom your personal data have been transferred,
• To object to the occurrence of a result against yourself by means of analyzing your processed data exclusively through automated systems,
• To demand indemnification for damages in the event that you incur damages due to the unlawful processing of your personal data.

G- How can you make your applications pursuant to Article 11 of the Law?

You may convey your requests regarding your rights under Article 11 of the Law, along with information/documents verifying your identity;

To Doğuş Otomotiv;

• In writing with a petition to the physical address of Doğuş Otomotiv, to the attention of the Digital Transformation and Corporate Communications department,
• Via electronic mail from your Registered Electronic Mail (KEP) address to the Registered Electronic Mail (KEP) address of Doğuş Otomotiv registered on its website,
• Via e-mail to [email protected] using a secure electronic signature or from your electronic mail address previously notified to Doğuş Otomotiv and registered in our system.

To the Authorized Dealer;

• In writing with a petition to the physical address of the Authorized Dealer, to its Registered Electronic Mail (KEP) address, or to the e-mail address designated by the Authorized Dealer for data subject applications.
• To learn the addresses of the Authorized Dealer where you can submit an application, you may establish contact with the Authorized Dealer by utilizing the contact information provided on the Authorized Dealer’s website.

In your application, along with the information and documents regarding your request, it is required to explicitly state:

• Your name, surname, and your signature if the application is submitted in writing,
• Republic of Türkiye identity number for citizens of the Republic of Türkiye; nationality, passport number, or foreign identity number, if any, for foreign nationals,
• Your residential or workplace address serving as the basis for notification,
• Your electronic mail address, telephone, and fax number serving as the basis for notification, if any, and
• A clear statement of the subject matter of the request.

The inclusion of the aforementioned information within the content of applications is mandatory by law, and in the event of any deficiency, the application cannot be processed.

Your application must be submitted in accordance with paragraph 2 of Article 5, titled "Application Procedure", of the "Communiqué on the Procedures and Principles of Application to the Data Controller". Your application will be evaluated by the relevant data controller and responded to within 30 (thirty) days at the latest, depending on the nature of your request.

H. Retention of Your Personal Data Accurately and Up to Date

We would like to remind you that the accuracy and up-to-date nature of the information you share is crucial for exercising your rights over your personal data within the meaning of the Law, as well as your rights under other relevant legislation.

I. Amendments to be Made to the Clarification Text on the Processing of Personal Data

To ensure that this "Clarification Text on the Processing of Personal Data" remains up to date, amendments may be made to the text from time to time. These amendments shall gain immediate validity upon the placement of the modified new "Clarification Text on the Processing of Personal Data" at the address www.dogusotomotiv.com.tr. Necessary notifications will be provided to you to ensure you remain informed of the amendments to this "Clarification Text on the Processing of Personal Data".