Personal Data Protection Notice (KVKK)

This Notice is provided under the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to transparently inform residents, independent unit owners, tenants and commercial area users of the Dünya Şehir Maltepe project about the collection method, legal grounds and purposes of processing of their personal data in connection with their use of the App, the parties to whom it is transferred, and their rights under Article 11 of the KVKK. In case of any discrepancy, the Turkish version prevails.

1. Data Controller

Dünya Şehir Cadde Ticari Gayrimenkul Yönetim Anonim Şirketi (the "Data Controller" or the "Management").

2. Purposes of Processing

In line with the general principles in Article 4 of the KVKK, your personal data is processed in a related, limited and proportionate manner for the following purposes:

• Creating your App account and verifying your identity by phone and SMS verification code,
• Verifying data on owners' and residents' units and matching it with ownership records,
• Delivering site management announcements, notifications, meeting calls and operational updates,
• Creating, tracking and resolving requests and support records for moving, renovation and technical service,
• Querying, accruing and paying dues, common-area charges, electricity, water, natural gas, internet and similar shared or individual expenses through banking integration,
• Displaying the products and services of businesses within the Dünya Şehir Cadde project, creating orders and coordinating delivery,
• Ensuring information, network and system security and keeping records accurate and up to date,
• Complying with statutory retention periods and responding to requests from public authorities.

3. Categories of Personal Data Processed

• Identity: first name, last name. The Turkish national ID number (TCKN) is processed only where required to verify unit owners against ownership records or for statutory invoicing, and only for those purposes; it is not mandatorily requested from tenants or other users, or from users placing orders with businesses.
• Contact: mobile phone number, e-mail address.
• Location and ownership: unit/apartment number, floor and block, ownership status (owner/tenant/user).
• User transaction and security: one-time SMS verification codes, sign-in/sign-out times, in-app activity logs, IP address, device information.
• Financial and payment: dues, common-area and consumption debt and balance information, receipts, and successful/failed collection records via integrated banks and licensed payment institutions (sensitive card data is processed directly by the bank or payment institution and is not stored on the Management's servers).
• Requests and complaints: moving, renovation and technical service records; requests, suggestions and support messages.
• Orders: orders placed with Dünya Şehir Cadde stores and businesses, order history, delivery address and contact preferences.

4. Collection Methods and Legal Grounds

Your personal data is collected by fully or partly automated means through installing and using the App, phone number and SMS code verification, existing title-deed and management system records, forms, digital payment integrations and order processes. It is processed on the grounds set out in Article 5 of the KVKK: performance of a contract (App User Agreement, account and secure sign-in, unit management, collection of dues, orders); compliance with legal obligations; establishment, exercise or protection of a right; legitimate interests (information security, fraud prevention, operational notifications, service quality); and your explicit consent for optional commercial electronic messages and additional services beyond the integration scope.

5. Transfer of Personal Data

In full compliance with Articles 8 and 9 of the KVKK and limited to the purposes above, your personal data may be transferred to authorised banks and licensed payment service providers; the relevant stores and businesses (only the data needed for orders and delivery); IT and software providers acting on the Data Controller's behalf as data processors (hosting, database, maintenance, SMS verification, technical infrastructure); lawyers, financial advisors and independent auditors; and competent administrative, judicial and regulatory authorities where required by law.

Cross-border transfers

The App's main servers and database are located in Türkiye. Some infrastructure providers are based abroad, and the following data, limited to what each service requires, may be transferred abroad:

• Messages written to the in-app support assistant, to Google LLC's AI service (Gemini) to generate replies,
• E-mail address and message content of e-mails sent by the App, to Google LLC's e-mail infrastructure,
• Where push notifications are used, the device push token and notification content, to Google LLC (Firebase Cloud Messaging) and Apple Inc. (Apple Push Notification service),
• IP address and connection/request data, to Cloudflare, Inc.'s content delivery and security network,
• IP address, device and app version data, to Expo (650 Industries, Inc.) for delivering app updates.

These transfers rely on the appropriate safeguards set out in Article 9 of the KVKK, such as standard contracts determined by the Personal Data Protection Board and notified to the Authority. Personal data is not transferred abroad outside these mechanisms.

6. Data Security

Under Article 12 of the KVKK, the Data Controller takes the technical and administrative measures needed to prevent unlawful processing of and access to personal data and to safeguard it (SMS-based verification, access authorisation limits, database encryption and network security testing). Sensitive card data is processed directly through the financial institution's PCI-DSS compliant interface and is not stored on the Management's servers.

7. Your Rights Under Article 11 of the KVKK

By applying to the Data Controller you have the right to:

• Learn whether your data is processed and request information about it,
• Learn the purpose of processing and whether it is used accordingly,
• Know the third parties to whom your data is transferred domestically or abroad,
• Request correction of incomplete or inaccurate data,
• Request deletion or destruction within the conditions of Article 7,
• Request that corrections, deletions or destructions be notified to third parties,
• Object to results against you arising solely from automated analysis,
• Claim compensation for damages arising from unlawful processing.

8. How to Apply

Under the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests in writing with a wet signature in person at the Data Controller's office at Çavuşoğlu Mahallesi, Barbaros Hayrettin Paşa Caddesi No:2/31 Kartal/İstanbul, Türkiye, through a notary, or to the Data Controller's registered electronic mail (KEP) address dunyasehirgayrimenkul@hs01.kep.tr using a KEP address, secure electronic signature, mobile signature, or an e-mail address previously notified to and registered with the Data Controller.

Applications are concluded free of charge as soon as possible and within thirty (30) days at the latest, depending on the nature of the request. If the process requires an additional cost, the fee set by the Personal Data Protection Board may be charged.