TOKEN CUSTOMER PRIVACY POLICY ON THE PROTECTION AND PROCESSING OF

PERSONAL DATA

Your personal data may be processed by Token Finansal Hizmetler A.Ş. ("Token" or the "Company")

as a data controller in accordance with Personal Data Protection Law No. 6698 as described below.

Commercial Title: Token Finansal Teknolojiler A.Ş.

Adress: İTÜ Maslak Campus ARI-8 Building Floor:2 34467 Maslak Sarıyer İstanbul, TÜRKİYE

E-mail: destek@tokeninc.com

Detailed information about the purposes for processing your personal data by our Company can be

found in the Token Finansal Teknolojiler A.Ş. Personal Data Protection and Processing Policy at

https://www.tokeninc.com/TokenEcommerce/media/Token/pdf/Token-Personal-Data-Protection-and-

Processing-Policy.pdf

For What Purpose Are Your Personal Data Processed?

- Your personal data are processed for the purposes of: Providing goods and services and

after-sales services,

- Creating a customer card for the provision of services,

- Conducting Customer Relations Management Processes,

- Managing communication channels,

- Making appointments and carrying out on-site promotion and sales,

- Carrying out campaigns, sweepstakes, and contests,

- Evaluating your requests and complaints,

- Organizing events and training and determining participants,

- Conducting authorized service processes,

- Increasing customer satisfaction, measuring and improving brand perception,

- Having our relevant business units carry out the work required for the actualization of the

commercial activities run by the Company and conducting the associated business

procedures,

and they will be processed within the scope of the legal reasons specified in Article 5 of the Law.

For What Purposes Are Your Personal Data Processed With Your Explicit Consent?

Your collected personal data may be processed with your explicit consent for the carrying out of

campaigns, sweepstakes, and contests; increasing customer satisfaction; measuring and improving

brand perception; carrying out market research and survey processes; customizing the products and

services offered by the company according to your tastes, usage habits, and needs; and within this

context sending advertisements, promotions, campaigns, and similar communications to your

preferred channel of communication, and they may be shared with the third parties whose services

we use for this purpose.

If you give your explicit consent, your name, surname, telephone number, and e-mail address can be

sent to companies which are located abroad and act as the data processor for Token, for the purpose

of conducting marketing activities and customer satisfaction based on your explicit consent.

For What Purposes Can Your Personal Data Be Transferred?

Your collected personal data may be transferred to our business partners, suppliers, legally

authorized public institutions, and private legal entities for the purposes stated above and within the

scope of the conditions for processing personal data stated in Article 8 of the Law.

If you give your explicit consent, your name, surname, telephone number, and e-mail address can be

sent to companies which are located abroad, for the purpose of conducting marketing activities and

customer satisfaction processes based on your explicit consent.

How is Personal Data Collected and What is the Legal Reason?

Your personal data is collected and processed electronically through the website, call center, mobile

app, social media, telephone, in-house systems and physically through the business partners and

authorized service channels through which you contact the Company for the following legal reasons:

Based on the legal reason for execution of contract for the purposes of providing goods and services

and after-sales support services, ensuring services, creating a customer card, making appointments,

carrying out on-site promotion and sales processes,

Based on the legal reason that data processing is necessary for the establishment, use, or protection

of a right in order to evaluate your requests and complaints,

Based on the legal reason of explicit consent, if you give your explicit consent, your personal data

may be processed for the purposes of carrying out campaigns, sweepstakes, and contests; increasing

customer satisfaction; carrying out customer relations processes and for our relevant business units

to carry out the necessary work and the business processes related to this; organizing events and

training and determining the participants; managing communication channels; measuring and

improving brand perception; carrying out market research and survey processes; providing gifts

through reference; customizing the goods and services offered by the company according to your

tastes, usage habits, and needs and within this scope sending advertising and promotions to your

preferred communication channel.

What Are Your Rights as a Data Subject?

We inform you that as a data subject you have the following rights under Article 11 of the Law:

1. To find out whether personal data has been processed or not,

2. To request information if your personal data has been processed,

3. To learn the purpose for processing personal data and whether they are used in line with their

purpose,

4. To learn the third parties to whom personal data are transferred domestically or abroad,

5. To request correction of personal data that have been incompletely or inaccurately processed and

to request that the third parties to whom the data were transferred be notified of the action taken in

this regard,

6. To request the deletion or destruction of her/his personal data in the event that the reasons for

their retention no longer exist despite their having been processed in accordance with the PDP Law

and the provisions of other relevant laws, and to request that the third parties to whom the data

were transferred be notified of the action taken in this regard,

7. To object to any adverse consequences arising as a result of processed data being analyzed solely

by automatic systems,

8. To claim compensation for any harm caused by the unlawful processing of personal data.

You can submit your applications regarding your rights listed above to our Company by filling in the

Token Data Owner Application Form, which can be found at

https://www.tokeninc.com/TokenEcommerce/media/Token/pdf/Token-Data-Subject-Application-

Form.pdf

Your applications will be concluded free of charge and as soon as possible, within a maximum of thirty

days, based on the nature of your claim; however, if the process requires additional costs, you may be

required to pay additional fees as per the tariff to be specified by the Personal Data Protection Board.