METRO PROPERTIES GAYRİMENKUL YATIRIM A.Ş.

INFORMATION ON PERSONAL DATA PROCESSING

The primary principles of our company, Metro Properties Gayrimenkul Yatırım A.Ş. (‘Company’)”), are protecting the fundamental rights and freedom, protection of privacy related to private life, ensuring and protecting information security, respect to ethical values. In this regard, we process and protect the personal data of all individuals related to the Company, including those who benefit from our products and services, in accordance with the Law No. 6698 on the Protection of Personal Data(‘KVKK/LPPD’).

Purposes of Personal Data Processing and Transferring

Personal data is collected by means of automated or non-automated methods by e-mail or similar methods, orally, in writing or electronically. Collected personal data is basically processed for the purposes of carrying out the necessary activities to get benefit from the products and services offered by our Company, providing legal and commercial security of the persons those are in business relationship with our Company, conducting administrative operations for the communication carried out by our Company, providing physical security and control of the Company's locations, management of assessment/complaint processes and legal compliance processes, carrying out audit, financial and similar transactions properly, determining and executing the commercial and business strategies of the Company, the continuance and sustainability of the Company activities and for ensuring the execution of our Company's human resources policies.

For the above-mentioned purposes and in accordance with KVKK/LPPD, our Company shares the collected personal data with our business partners located both at home and abroad, and Metro Group companies/affiliates, related official entities and institutions at home, and with the companies and/or our business partners we obtain services.

Methods of Collecting Personal Data and Its Legal Grounds

By expressly giving information to the personal data owners in a clear and understandable manner and taking their direct consent if necessary by our Company, personal data is collected, used, recorded stored and processed in accordance with the law and honesty rules, in a manner connected with the legitimate purposes explicitly mentioned above and limitedly, and within the framework of the principle of proportionality.

Personal data is processed and shared with the persons and institutions specified above, within the scope of the following legal grounds defined under KVKK/LPPD Article 5/2:

• It is mandatory for the protection of life or physical integrity of the person (data subject) or of any other person who is incapable to disclose his consent due to factual impossibility or whose consent is not deemed legally valid.
• It is necessary to process the personal data of the parties to a contract, provided that it is directly related to the establishment or execution of the contract.
• It is mandatory for the data controller to fulfil his legal obligations.
• The data has been disclosed to public by the data owner himself.
• It is mandatory to process the data for establishment, exercise or protection of a legal right.
• It is mandatory to process data for the legitimate interests of the data controller, provided that it is not violate the fundamental rights and freedoms of the data subject.

Duration of Storing Personal Data

Personal data will be retained for the period of storage specified in the relevant legislation or for the period required by the above-mentioned processing purposes, and afterwards will be deleted, destroyed or anonymized completely in accordance with KVKK/LPPD.

Rights of the Data Subject Specified under KVKK/LPPD Article 11

Pursuant to KVKK/LPPD Article 11, data owner/subject is entitled to the following rights:

• To learn whether the personal data is processed,
• To request information if the personal data has been processed,
• To learn purpose of processing the data and whether it is used for intended purposes,
• To know the third parties to which personal data is transferred at home or abroad,
• To request rectifying of the incomplete or incorrect personal data, if any, and to request the notification of such transaction to third parties those personal data has been transferred to,
• To request deletion or destruction of the personal data and to request notification of such transaction to third parties those personal data has been transferred to, in the event that the required purposes of the processing personal data are ceased to exist although it has been processed in accordance with the provisions of KVKK/LPPD and other related legislation,
• To object to the emergence of a result against you, by analysing processed personal data exclusively through automated systems,
• To request compensation if any losses incur due to unlawful processing of the data.

Mentioned rights can be exercised by choosing one of the following methods:

1. After filling and wet-ink signing the online form at https://www.metro-properties.com.tr/en/information-on-personal-data-processing you can deliver it personally to the address of Metro Properties Gayrimenkul Yatırım A.Ş. Barbaros Mah. Kazım Karabekir Cad.No:2 Yenisahra 34746 Ataşehir/İSTANBUL (The application will be processed providing that submitting a proof of identity, such as identity card/ driver's license/passport, etc.).
2. After filling and wet-ink signing the online form at https://www.metro-properties.com.tr/en/information-on-personal-data-processing you can deliver it through a public notary to the address of Metro Properties Gayrimenkul Yatırım A.Ş. Barbaros Mah. Kazım Karabekir Cad.No:2 Yenisahra 34746 Ataşehir/İSTANBUL.
3. After filling and signing the online form at https://www.metro-properties.com.tr/en/information-on-personal-data-processing by means of “secure electronic signature” defined in Law No. 5070 Electronic Signature, you can deliver it through Registered Electronic Mail (KEP) to the address metroproperties@hs01.kep.tr.