COMMITTEE FOR EARLY DETECTION OF RISK

We want you to become a member of the Huge Sinpas Family which have enriched the lives of thousands of families and present you our new projects, promote you advantages and campaigns which we will prepare especially for you. Therefore, hereby we accept, acknowledge and undertake that we will use your personal information which you provide in this form only for marketing and communication activities of Sinpas Holding and its group companies and we protect this information in accordance with the 6698 Numbered Law on Protecting Personal Information of the Republic of Turkey. As long as we continue our commercial activities as Sinpas Holding, we shall save your personal information within the scope of the aforementioned law in domestic or foreign secure data centers and use them for promoting you special campaigns we prepare for you and we will only share this information with the business partners which our company signs confidentiality agreements, accordingly. If, you want to change your data share preferences, you can send such request to izin@sinpasREIT.com.tr e-mail or call our call-center from 4441974 and make your request to our data specialist and cancel your membership.

DECLARATION ABOUT THE DISCLOSURE OF PERSONAL DATA

This Information and Clarification Form is arranged in relation to the processing and transferring of the “Personal Data” of real persons regulated by the Personal Data Protection Law no 6698 (“PDP Law”). Pursuant to the Law no 6698, all kinds of updated personal information you have shared with our company shall be considered “Personal Data".

The security of your personal data is of utmost importance for us and your personal data shall be retained under the legally stipulated conditions, in the securest way for a period of time as required by legal obligations.

a) Data Controller and Representative

In accordance with the Personal Data Protection Law (""PDP Law"") no 6698, your personal data may be processed by Sinpaş Gayrimenkul Yatırım Ortaklığı A.Ş. as the ""Data Controller"" under the below defined coverage.

b) The Purposes of Processing your Personal Data

Your personal data may be processed within the conditions and purposes of personal data processing as stated in the Articles 5 and 6 of the Law No 6698 for executing the liabilities of our company and the real or legal persons having business relations with our company, giving information regarding the updates, preparing and executing the agreements to be signed with you, reminding and fulfilling the legal obligations, doing various advertising and marketing activities, having your opinion by way of surveys and votes, selecting the products, projects and services suitable for you and customizing and developing them, providing effective customer services, notifying the changes in legislation and company policies that are of interest for you or making other related notifications, celebrating birthdays, inviting to lotteries and competitions, giving presents and organizing similar events, promotions and campaigns in your favor, informing you via electronic mail, SMS and fax, giving information about campaigns, sending you printed bulletins, magazines and campaign letters, defining our visitor profiles, evaluating your requests, demands and complaints, implementing the human resources policies of our company and replying your requests and questions.

c) Permissable Receiver and Purpose of Personal Data Transfers

Your collected personal data are processed for proper, updated, defined, clear, legitimate and legal purposes in line with the rules of integrity and retained for a limited and constrained period of time related to the purpose of processing as stipulated in the related legislation or as required for the purpose of processing. Also, on condition that the requirements in the Articles 8 and 9 of the PDP Law are observed and the necessary security precautions are taken, and limited with the purposes listed under the Article (b) of this notification; the personal data may be transferred to our direct/indirect local/foreign affiliates/subsidiaries, local/foreign/international public/private institutions and organizations, companies and other 3rd persons from whom our company purchases services/support/advise or is in cooperation or has project/program/financing partnerships, our company's subsidiaries, advisors, shareholders or other group companies as solution partners, Central Securities Depository and other authorised institutions and organizations, suppliers and and subcontractors. SİNPAŞ GYO may process and retain your personal data in servers located within or out of Turkey or in other electronic environments, under the condition that the required security measures are taken.

ç) The Method and the Legal Reason for Collecting Personal Data

Personal data may be collected by our Company through various channels (SİNPAŞ GYO headquarters, branches, agencies, sales offices or other subcontractors or business partners and the reachable offices and other physical settings, call centers, websites, mobile applications and similar platforms of electronic operation, social media and other public channels, organizations such as training, conference and similar settings, investigations, other group companies or contracted persons and institutions, in written, oral, audio or visual format or in other physical or electronic formats, etc.). Your personal data may be collected, processed, transferred and retained for the purposes stated in the Articles (b) and (c) of this text within the data processing conditions and purposes stipulated in the Articles 5 and 6 of the PDP Law.

Your personal data are retained for a period of time as required by legal obligations or as permitted by legislation and under legally permitted conditions.

d) Your Rights as Personal Data Owner

As personal data owners, if you send your claims for your rights to our Company using the below described method, our Company shall conclude your claim as soon as possible within a maximum period of thirty days depending on the nature of your claim. However, if any costs are stipulated by the Personal Data Protection Council, our Company shall charge such price in the tariff. Within that scope, personal data owners have the right to;

• Learn whether the personal data has been processed or not,
• Request related information if the personal data has been processed,
• Know about the purpose of processing the personal data and whether the data has been used for the intended purpose,
• Know about the third persons within or out of the country to whom the personal data has been transferred,
• Ask for the correction of any incomplete or incorrect processing of the personal data and ask for the third persons to whom the data has been transferred to be informed about such correction,
• Ask for the deletion or destruction of the personal data if the reasons for data processing have been removed although such processing was done according to the provisions of the PDP law and the other related laws; and ask for the third persons to whom the data has been transferred to be informed about such deletion,
• Raise objection to any results occurring against the person himself/herself when the processed data is analysed only by means of automatic systems,
• Ask for the compensation of any damage that the person may incur because of the illegal processing of personal data.

Pursuant to the Paragraph 1 in the Article 13 of the PDP Law, you may send a written notice to our Company including your demand for exercising your above listed rights. You may prepare a written request including a description of the rights you wish to exercise, as mentioned in the Article 11 of the PDP Law, along with the documents to prove your identity, and you may either submit it in person or send it through notary to “Dikilitaş Mah. Yenidoğan Sok. Sinpaş Plaza No:36 Dikilitaş-Beşiktaş/İSTANBUL” addressed to SİNPAŞ GYO Customer Relations Department.

Our Company reserves its right to make changes in this clarification notice in case of any possible amendments to the PDP Law and based on the methods to be defined by the Personal Data Protection Council.