As GALATA GAYRİMENKUL YATIRIMCILIĞI İNŞAAT TAAHHÜT TURİZM VE TİC. A.Ş. (“Galata A.Ş.” or “Company”), we have enacted a Confidentiality and Data Policy as part of our principles in order to process, keep and protect your personal data in compliance with the provisions of the Law on the Protection of Personal Data no 6698.

As a company responsible for obtaining, processing, keeping and security of your personal data in compliance with laws and regulatory legislation, Galata A.Ş. is taking strict measures to protect your personal data against all kinds of losses or modifications, to keep them in a secure manner; and to conduct technical and software procedures in this regard.

As Galata A.Ş., we declare that we always obey the following principles:Of processing the personal data of our employees, business partners, clients and/or representatives in compliance with the law and the rule of honesty, and for specific, open and justified purposes, to protect their basic rights and freedoms, in particular the confidentiality of personal life; Of providing personal data correct and updated when necessary, to process and keep the personal data in connection with the purpose of processing the personal data and for a limited and moderate time period which is required for the purpose of their processing;and to transfer the personal data to third persons local and/or abroad by taking security measures, and that act in compliance with the provisions of the Law on the Protection of Personal Data and all legal legislations under this scope.

Acceptance of the principles and rules for protection of personal data by our employees and business partners, and creating and reinforcing such awareness for this direction, is also a Company policy.

As Galata A.Ş., we declare that we fulfill all of our compliance obligations related to obtaining, processing, keeping, and protecting your personal data. Under this scope, we have been registered to VERBIS (Registry of Data Controllers Information System); we fulfilled our obligation to demonstrate clear communication while obtaining personal data in oral and/or written forms to the relevant authorities; and we have taken the necessary technical, software and administrative measures to maintain the security of the personal data (such as preventing unlawful processing of personal data and unlawful access to the data).

Under this scope, we also declare that, the current risks and threats have been identified and policies have been established in the fields of access information security, usage, storing and destruction; and that a closed network system is used for maintaining network and application security; key management is applied; security measures under the scope of provision, development and maintenance of information technologies systems; that security of personal data stored in cloud has been provided; an authority matrix has been established for the employees; that the access logs are kept regularly and without user intervention; data masking measures are implemented in necessary cases; user account management and authority control system are implemented; security walls with current anti-virus systems are used; personal data transfers with specific qualities are definitely made with encoding technique/cryptographic keys; in cases where sending via email is required in personal data transfers with specific qualities KEP or institutional email account is used and the data are encoded in environments such as portable memory, CD and DVD; cyber security is maintained by applying attack identification and prevention system forpreventing cyber attacks and infiltration tests are conducted; data loss preventing software is used; security of backup personal data is also maintained in a similar manner; and such measures are periodically reviewed and updated; confidentiality commitments containing provisions on data security are conducted with the employees and business partners; the security of the physical environments containing personal data against outer risks are also maintained; that the personaldata that are collected and processed are minimized as much as possible numerically; that in the case where during the periodic reviews or upon the application of the relevant persons it is determined that the reason for processing the personal data has disappeared or the term of storing personal date has ended, the personal data is deleted, destroyed or anonymized in compliance to the data category and nature of the personal data.

In our Internet web site, for the purpose of giving more accurate information to our users, we place links to Internet web sites that we consider to be trustworthy. However, we state that our company is not responsible for the data and/or confidentiality policies or the content of the relevant sites. The fact that you use our website means that you have read, understood and approved our data confidentiality policy in line. In case of any requests for cooperation and/or information that may come from judicial or administrative authorities, we state that we may share your personal data requested by the relevant authorities in accordance with legislation.

Information which is anonymous and not sufficient for identifying you personally is non-personal information and such information is automatically stored in our servers.

Article 11 of the Law on the Protection of Personal Data states that the owners of personal data, defined as the data subject (“Applicant”), are entitled to making certain requests about the processing of their personal data in article 11 of the same law; we would also like to inform you about your rights under the scope of this Confidentiality and Data Policy.

According to article 13/1 of the Law on the Protection of Personal Data, you may apply to the data controller, our Company, in writing or by other methods determined by the Personal Data Protection Board (“Board”). There are specific requirements and details based on the application method, which are detailed below. All applications are required to be evaluated and finalized within 30 (thirty) days of their arrival to our Company; you will be informed of their outcome. No fees are charged for evaluation requests or outcome communication; however, our Company reserves the right to charge a fee based on the fee schedule determined by the Board, only if the transaction requires a cost.

In order to submit an application in writing, you may print and fill the Data Subject Application Form in the web sites of our Company with the domain names of www.livenoa.com and undersign them with wet signature; and send it (i) by the personal application of the Applicant, (ii) by notary public to the address of our Company at Çukurcuma Faik Paşa Cad. No: 37 K: 4 D: 9 Beyoğlu/İstanbul or (iii) via email with electronic signature/e-signed to the electronic email address of of Company,kvkk@galataas.com

In case the Board later determines an application method, conditions of application about such method shall be separately announced.

In person. Applicant arrives in person, with the completed application and documentation to prove his or her identity. Via notary public. The application form is submitted with the Applicant’s wet-ink signature and proof of identity to our company, through a notary public. Via secure electronic signature and email. The Applicant completes the Data Subject Application Form with a secure electronic signature and emails to kvkk@galataas.com. [in all cases, instead of writing, “it is requested to write” replace with “please write…” and then continue as-is.

Special information about written applications are in the following table.

Application Method	Features	Application Address	Information to be Specified in the Application Submission
Personally	It is the applicant’s arrival in person and applying with a document proving his/her identity	Galata Gayrimenkul Yatırımcılığı İnşaat Taahhüt Turizm ve Tic. A.Ş. Çukurcuma Faik Paşa Cad. No:37 K:4 D:9 Beyoğlu/İstanbul	The Applicant is requested to write “Information request under the Law on the Protection of Personal Data ” on the envelope.
Via notary public	It is the notification of the Data Subject Application Form with the wet-ink signature of the Applicant to our Company, together with the document proving the identity, through a notary public.	Galata Gayrimenkul Yatırımcılığı İnşaat Taahhüt Turizm ve Tic. A.Ş. Çukurcuma Faik Paşa Cad. No:37 K:4 D:9 Beyoğlu/İstanbul	It is requested to write “Information request under the Law on the Protection of Personal Data” in the content of the notification envelope.
Via secure electronic signature and email	It is signing the Data Subject Application Form with a secure electronic signature and sending it to kvkk@galataas.com.	Galata Gayrimenkul Yatırımcılığı İnşaat Taahhüt Turizm ve Tic. A.Ş. kvkk@galataas.com	It is requested to write “Information request under the Law on the Protection of Personal Data ” in the subject part of the e-mail.

In accordance with Article 13 of the Law on the Protection of Personal Data, your applications will be evaluated and finalized as soon as possible and within 30 (thirty) days at the latest following their arrival at our Company, and you will be informed. Although it is essential not to charge any fees for the evaluation of the requests and informing the outcome, we hereby inform you that our Company reserves the right to charge a fee based on the fee schedule determined by the Board, if the transaction requires cost.

With kind regards,

GALATA A.Ş.

Sustainability

Properties