PROCESSING OF PERSONAL DATA

1. PARTIES

This Contract on the processing of personal data has been executed by and between ACG Reklam A.Ş. (to be referred to as "ACG Reklam A.Ş." hereinafter) and the User, who has become a member of www.liforbis.com site (to be referred to as “the Site” hereinafter), and is an integral part of the Usage Contract.

2. DEFINITIONS

For the purposes of this agreement, the following terms shall have the following meanings;

Explicit Consent: means a consent relating to a certain subject which is based on information and taken at one's free will;

Processing of Personal Data: means any operation which is performed upon personal data such as collection, recording, storage, preservation, alteration, adaptation, disclosure, transfer, retrieval, making available for collection, categorization or blocking its use by wholly or partly automatic means or otherwise than by automatic means which form part of a filing system;

Personal Data Subject: means the real person whose personal data is being processed;

Personal Data: means any kind of information relating to an identified or identifiable real person; Therefore, the processing of information regarding legal entities is not covered by the Law (i.e. name-surname, TR ID no, e-mail, address, date of birth, credit card number, bank account number, etc.);

Sensitive Personal Data: means any biometric or genetic data relating to racial or ethnic origin, political opinion, philosophical and religious beliefs, sect, or other beliefs, dressing, membership of an association, a foundation or a trade union, health, sexual life, the sentence of any punishment and security measures;

Data Controller: means the person who determines the purposes and means of processing personal data, and manages the place where the data is kept systematically;

Constitution: means the Constitution of the Republic of Turkey;

3. MATTERS REGARDING THE PROCESSING OF THE PERSONAL DATA

3.1. General Principles in the Processing of Personal Data

ACG Reklam A.Ş. processes the data in compliance with the respective provisions stipulated under the Constitution of the Republic of Turkey, and those stipulated under the laws it has to abide by within the scope of the Personal Data Protection Law (to be referred to as "PDP Law" hereinafter).

The following principles are taken into consideration in this context:

3.1.1. Compliance with the Law and Good Faith

ACG Reklam A.Ş., as a prudent merchant, acts in accordance with the principles set forth with legal regulations and the principle of general trust and good faith in the processing of personal data.

3.1.2. Ensuring that Personal Data is Accurate and up-to-date when needed

In addition to the provisions of other laws which it is obliged to observe within scope of its activities, ACG Reklam A.Ş. ensures that the personal data it processes in accordance with the PDP Law by taking into consideration the fundamental rights of personal data subjects and its legitimate interests are accurate and up to date.

3.1.3. Processing of data for Certain, Clear and Legitimate purposes

ACG Reklam A.Ş. clearly determines its purpose of processing personal data that are legitimate and lawful in a certain fashion. In this scope, personal data are processed in limitation to products and/or services it has presented / shall present, and to its legal obligations as well. Purpose for processing personal data is set forth before processing of personal data has been started in this context.

3.1.4. Relevance to purpose of processing, being limited and moderate

ACG Reklam A.Ş. processes the personal data in a manner that enables to carry out specified purposes and avoids the processing of personal data that is not relevant or not required for the performance of the purpose. Accordingly, the processing of data is limited to activities and legal obligations.

3.1.5. Storage of Data for a period stipulated by the Respective Legislation or required for the processing purpose

ACG Reklam A.Ş. stores the personal data only for a period stipulated by the respective legislation that it is obliged to observe or required for the processing purpose.

3.2. Conditions of Processing of Personal Data

The protection of personal data is a constitutional right. Fundamental rights and liberties may only be restricted by law, without prejudice to their essence, and only based on the reasons set forth in the relevant articles of the Constitution. As being stipulated under the Constitution, personal data may be processed either under the respectively foreseen circumstances, or upon the consent of the person concerned. Accordingly, and in compliance with the Constitution, ACG Reklam A.Ş. processes the personal data either under the respectively foreseen circumstances, or upon the explicit consent of the person concerned.

Obtaining the explicit consent of the personal data subject is only one of the legal bases that make it possible for the personal data to be processed in accordance with the law. Apart from seeking for explicit consent, presence of any one of the conditions given below may permit the processing of the personal data. The basis of the personal data processing activity may be only as per one of the following conditions, and also more than one of these conditions may be the basis for the same personal data processing activity.

3.2.1. Explicit Consent of the Personal Data Subject

One of the requirements for the processing of personal data is the explicit consent of the data subject. The explicit consent of the personal data subject shall be related to a certain subject, subject to notification and stated with free will. Anyone being a member of the Site hereby declares and undertakes that, he/she has read the usage contract, and the information regarding the processing of the personal data, and has acknowledged the same beforehand. In this context, the same person is thereby deemed as having waived from all his/her rights of objection, filing lawsuit, complaint, and claim with regard to the processing of his/her personal data beforehand.

3.2.2. Cases where Personal data can be processed without Explicit Consent

3.2.2.1. When it is clearly stipulated in laws

Data subject's personal data may be processed legally without explicit consent if it is expressly set forth in the law.

3.2.2.2. When express consent cannot be obtained due to actual impossibility

The personal data of the data subject may be processed if it is compulsory to process the personal data in order to protect the life or body integrity of the person who can not state his/her consent due to the actual impossibility or of another person or when it is not possible to validate the consent of an employee.

3.2.2.3. When it is Directly Related to the Conclusion or Execution of the Contract

Personal data may be processed, to the extent personal data is directly related to the conclusion or execution of a contract, when it is required to process personal data pertaining to parties of the contract.

3.2.2.4. When there is a Legal Obligation

If data processing is compulsory for ACG Reklam A.Ş. to fulfill its legal liabilities, the data subject's personal data may be processed.

3.2.2.5. When the Data Subject has made her/his Personal Data public

If Data Subject has made his/her personal data public, then such personal data may be processed.

3.2.2.6. When Data Processing is mandatory to Establish, Exercise or Protect a right

The personal data of the data subject may be processed when data processing is mandatory to establish, exercise or protect a right.

3.2.2.7. When Data Processing is imperative for the Legitimate Interests of ACG Reklam A.Ş.

Personal data of the data subject may be processed when it is mandatory to process data for legitimate interests of ACG Reklam A.Ş., provided that fundamental rights and liberties of the data subject are not prejudiced.

3.3. Processing of Sensitive Personal Data

ACG Reklam A.Ş. acts in accordance with the regulations set forth in PDP Law in the processing of personal data specified to be "sensitive" by PDP Law.

In this context, a number of personal data bearing the risk of causing victimization or discrimination of the individuals when they are processed illegally have been specified as "sensitive" in Article 6 of the PDP Law. Such data include any biometric or genetic data relating to racial or ethnic origin, political opinion, philosophical and religious beliefs, sect, or other beliefs, dressing, membership of an association, a foundation or a trade union, health, sexual life, the sentence of any punishment and security measures.

Sensitive personal data are processed by ACG Reklam A.Ş. under the conditions specified below, in a manner in compliance with the Law and on condition that the adequate measures to be determined by the Personal Data Protection Board ("PDP Board") are taken: If there is explicit consent of the personal data subject,

Otherwise, sensitive personal data apart from those relating to health and sexual life of the Personal Data Subject may be processed in cases set forth in the Law,

- Sensitive personal data relating to health and sexual life of the Personal Data Subject may only be processed by persons who is subject to confidentiality obligation or authorized agencies and administrations for purposes such as preserving public health, rendering services such as preventive medicine, medical diagnosis, treatment and care giving, planning and management of health services and financing of such services.

3.4 Categorization of Personal Data

The personal data of the data subjects are processed by informing the respective persons in accordance with Article 10 of the PDP Law and in a limited manner based on one or more of the personal data processing requirements set out in Articles 5 and 6 of the PDP Law and in the direction of ACG Reklam A.Ş.' legal and legitimate personal data processing purposes, and on a data category basis, complying with the general principles stipulated under PDP Law, and with all the obligations which are regulated under the PDP Law, including primarily the principles stipulated under Article 4 on the processing of personal data.

3.5 Deletion, Destruction or Anonymization of Personal Data9

Accordingly, in the event that the personal data is processed in accordance with the provisions of the PDP Law, and with those of the other respective laws, but the reasons for the processing are no longer valid, personal data are, directly or upon demand of the person concerned, deleted, destroyed or anonymized by the data controller.

3.6 Transfer of Personal Data

In line with the respective provisions stipulated both under the Constitution, and under the PDP Law, ACG Reklam A.Ş. pays utmost care and attention to the sharing of personal data within the country and/or in foreign countries, and carries on its activities in compliance with the regulations being applicable in this context.

3.7. Disclosure Obligation

It has been established in the Constitution that everyone has the right to be informed about the personal data about themselves. In this respect, in Article 11 of the PDP Law, among the rights of the personal data subject, "requesting for information" is also included. ACG Reklam A.Ş., in this context, serves any notification necessary upon the respective request of the personal data subject in compliance with both the Constitution, and with the Article 11 of the PDP Law.

In this context, and as per Article 10 of the PDP Law, ACG Reklam A.Ş. discloses any information necessary to the personal data subjects in the course of obtaining personal data, including the identity of ACG Reklam A.Ş., the purpose for which the personal data will be processed, the parties to which and for what purposes the personal data might be transferred, the method and legal reason for collecting personal data, and on the rights they have in accordance with the Article 11 of the PDP Law. Anyone who has approved the usage contract placed in the Site, and thereupon become a member of the Site acknowledges the fact that, the foregoing disclosure has been served to him/her.

In addition, ACG Reklam A.Ş. announces to the personal data holders and to the other persons concerned by means of miscellaneous open-source documents, this Policy document being in particular, that it carries out personal data processing activities in compliance with all aspects of the PDP Law, and primarily with the rule of "Legality and Integrity", and thereby fulfills its disclosure obligation, and maintains its transparency in its personal data processing activities before any and all of the persons concerned.

4. MAINTAINING THE SECURITY OF THE PERSONAL DATA

ACG Reklam A.Ş. gives the utmost care and attention to the provision of data security and in this context, according to Article 12 of the PDP Law, the required precautions are taken regarding the following issues regarding "data security".

I. ACG Reklam A.Ş. takes any and all technical and administrative precautions necessary aimed at ensuring a suitable level of security for the purpose of preventing the unlawful processing of, or access to, Personal Data, and assuring the appropriate level of security for the safeguarding of Personal Data.

II. ACG Reklam A.Ş. is jointly responsible with the respective persons with regards to taking the measures mentioned in the first article, if the personal data is processed by another real or legal entity for and on behalf of the respective person.

III. Persons, who come to know the personal information due to the legal entity of ACG Reklam A.Ş., its employees, and/or due to their duties, do not disclose such information to anyone else in breach of the provisions of the PDP Law, PDP Law, and those of the other respective laws, and do not use the same except for the purpose of processing. This obligation survives the termination of their employment. IV. If the processed personal data is obtained by others through unlawful ways, the subject matter will be reported to the person concerned as soon as possible.

5. PROTECTING THE RIGHTS OF THE DATA SUBJECT

If personal data subjects submit their requests regarding the following rights to ACG Reklam A.Ş., the requests are concluded free of charge within thirty days at the earliest, depending on the nature of the request. However, in the instance which the procedure requires an additional expense, ACG Reklam A.Ş. shall receive the sum respectively charged in the tariff determined by the PDP Board or other authorities.

In this context, the data subjects will be able to transmit their requests to ACG Reklam A.Ş. in writing.

Personal data subjects are entitled to:

- Learn whether or not their personal data have been processed,

- Request information if their personal data has been processed,

- Learn the purpose of processing of the personal data and whether the data have been used in accordance with that purpose,

- Know the third parties at home or abroad to whom personal data have been transferred,

- Request correction of personal data if they are incomplete or incorrectly processed and ask that the process carried out in this context be notified to the third parties to whom personal data have been transmitted,

- Request for the deletion or destruction of your personal data if the reasons for processing the same have ceased to exist although it has been processed in accordance with the PDP Law and other relevant laws, and to ask that the process carried out in this context be notified to the third parties to whom your personal data has been transmitted;

- Object to any unfavorable result that they suffer due to analysis of processed data only by means of automatic systems,

- Demand indemnification of loss if they suffer loss due to their personal data being processed in breach of the law.