PDPL INFORMATION LETTER

Information Letter Regarding the Processing of Personal Data

The Data Protection Law, which was adopted on 24.03.2016 and published in the Official Gazette dated 07.04.2016 (the “Law”), sets forth the principles for processing natural persons’ data that is obtained by natural and legal persons. St. Martins Şişli Gayrimenkul Yatırımcılığı Ticaret A.Ş. (the “Company”), within the scope of the Law, acts in its capacity as the “Data Controller.” Pradera Gayrimenkul Yönetimi ve Ticaret Limited Şirketi (“Pradera”), on the other hand, acts as the “Data Controller” as per the contractual relationship between our Company and Pradera.

This Information Letter has been drafted for the purpose of informing you on “Data Controller’s Obligation to Inform” as provided under Article 10 of the Law and the “Rights of Data Subject” provided under Article 11 thereof.

What is the Purpose of Processing Personal Data?

Your personal data (name and surname, Turkish identity number, mobile and home number, address, e-mail address; and written correspondences, photographs, videos, bills/receipts and other documents/evidences submitted by you, if need be) may be recorded, stored, preserved, updated, rearranged, shared with those persons and institutions that are legally authorized to request such personal data, transferred, assigned, classified under the conditions set forth by the Law and other legal regulations, and/or processed by any other means provided under the Law; within the framework of the purpose requiring the processing thereof and in connection with, limited by, and proportionate to, the purpose of providing better services to you and reviewing and finalizing your requests.

Principle of the Processing of Personal Data

Personal Data shall only be processed in accordance with the procedures and principles set forth by the Law and other laws.

Your Personal Data shall be processed;

a) in conformity with the law and the good faith principle;

b) on an accurate and, if necessary, up-to-date basis;

c) for specific, explicit, and legitimate purposes;

d) in connection with, limited by, and proportionate to, the purpose of processing thereof; and

e) to be preserved for the maximum period designated by the relevant legislation or required by the purpose of processing thereof.

Who Do We Share Your Personal Data With?

Our Company may, to the extent relevant, transfer your personal data to the cleaning company, security company, disinfection company, landscape services company, facility management company, and the food services company, which provide services to Istanbul Cevahir Shopping and Entertainment Center (“Cevahir SC”), and other supplier companies and the tenants thereof with the purpose of providing better services to you and reviewing and concluding your requests; provided that sufficient precautions have been taken within the scope of the security and privacy principles set forth in the Law.

Your personal data may further be shared with the organizations and institutions, which are authorized, and required by their statutory obligations, to request such data, for your own safety and for the purpose of performance of our Company’s legal obligations under the laws.

Any personal data that you have shared with us shall not be shared with third parties without your explicit consent or for any purpose other than those processing and sharing purposes stipulated herein and the Law.

Method and Legal Grounds of Personal Data Collection

The personal data that you have shared with us shall be obtained from the Opinion, Suggestion and Complaint Forms that you have filled in. The legal grounds for processing your personal data consist of the explicit consent of the data subject, as stated in Paragraph 1 of Article 5 of the Law with the heading “Conditions of Personal Data Processing;” the requirement of personal data processing by the Law explicitly, as stated in Paragraph 2/a of Article 5 of the Law; and the requirement of data processing for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are protected, as stated in Paragraph 2/f of Article 5 of the Law.

Update of Personal Data

It is crucial that your personal data is accurate and up to date. Please therefore inform us of any changes to your personal data.

What are Your Rights?

Your rights under Article 11 of the Law, without prejudice to the circumstances provided under Article 28 of the Law with the heading “Exceptions”, are as listed below.

By submitting an application to our Company, you may exercise your right to:

a) Learn whether or not your personal data have been processed,

b) Request further information, if your personal data have been processed,

c) Learn the purpose of processing your personal data and whether they are used in line with such purpose,

d) Learn the third party recipients to whom your personal data have been disclosed within the country or abroad,

e) Request rectification of your personal data if processed incompletely or inaccurately,

f) Request erasure or destruction of your personal data as per the conditions set forth in Article 7 of the Law,

g) Request notification to third parties, to whom your personal data have been disclosed, with respect to the transactions made as per sub-clauses (e) and (f) above,

h) Object to any negative consequence resulting from the analysis of your personal data exclusively by automated systems,

i) Claim compensation for the damages that you suffered due to unlawful processing of your personal data.

The requests to be submitted to our Company shall be in writing, pursuant to the Law. You may send an e-mail to our Company’s e-mail address info@istanbulcevahir.com with your explanations as to the rights that you wish to exercise, together with the documents proving your identity; and/or personally submit a petition to our Company’s central office located at Büyükdere Caddesi, Cevahir Alışveriş Merkezi, No:22/A, Mecidiyeköy, Şişli, Istanbul; or make your application through notary public or by a registered letter with return receipt. The requests stated in your application shall, depending on the content thereof, be concluded as soon as possible and within 30 (thirty) days at the latest without any charge.

Yours Respectfully, Data Controller

St. Martins Şişli Gayrimenkul Yatırımcılığı Ticaret A.Ş.

Data Controller

Pradera Gayrimenkul Yönetimi ve Ticaret Limited Şirketi