SUPERONLINE PRIVACY NOTICE

This Privacy Notice has been drafted by Superonline İletişim Hizmetleri A.Ş. (hereinafter to be referred to as “Superonline” for the purposes of this document) with the capacity of "data controller" in accordance with article 10 of the Law 6698 on Protection of Personal Data (“Law”) and the Communiqué on Methods and Principles on the Liability of Providing Information.

Personal data collected and processed by Superonline are protected by Superonline. Superonline takes all the necessary technical and administrative measures to ensure the appropriate level of data security and lawful processing of personal data in accordance with the Law and the applicable legislation using the necessary technology and infrastructure.

The personal data are processed by Superonline in accordance with the Law and the applicable legislation. The following text is available for real persons who want detailed information on how their personal data are processed by Superonline with the capacity of data controller in accordance with the Law, purpose of processing, possible receiver groups, method of collection and legal grounds.

I. WHAT IS PERSONAL DATA?

Personal data refers to data which personally identify you or make you personally identifiable. Even though the information indicated in this statement may vary depending on the products and services used by persons or their request and consents, the categories of personal data which may be processed by Superonline are as follows:

• ID Information: This data category is inclusive of ID number, name, passport number, tax ID, nationality, ID card number, date and place of birth, civil status, gender, copy of ID card, photograph, statement of signature/authorized signatures list and letter of attorney.
• Contact Data: This data category is inclusive of phone numbers, e-mail addresses and social media accounts.
• Subscription Data: This data category is inclusive of customer number, campaigns/plans/subscriptions and plan usage data, occupation, subscription data and subscription status as well as KDH/DSS (Added Value Services/Digital Products and Services) subscription data.
• Network, Traffic and Location Data: This data category is inclusive of customer's activities on Superonline’s web servers and operating systems, date and time of system access and exit via internet, traffic and other connection data on source and target; service location data and the types of technical data required to provide the services.
• Sales Channel Data: This data category is inclusive of information and documents provided by you during the sales process, invoices issued for the service address, invoices from the former internet service provider, visual logs (video, photograph); data collected upon contact via electronic or physical means; audio logs maintained in accordance with the call center standards, security phrases selected by you, and your requests and activities via sales channels.
• Data on Use of Products and Services: This data category is inclusive of preferences, habits and patterns regarding the use of products and services and your actions on web sites and mobile applications created by Superonline or third parties for provision, promotion and use of products and services including www.superonline.net ve www.turkcell.com.tr as well as the cookies on those web sites and mobile applications.
• Payment, Bank and Risk Data: : This data category is inclusive of credit ratings, credit card, debit card and other bank data required for preliminary assessment of eligibility for device campaigns and service subscriptions; payment performance data including former periods, data in loan agreements and their annexes in case of any loans, any issue which effect limits and data on assurances, delays and cancellation.
• Special Personal Data: This data category is inclusive of (i) data on eligibility for social benefits (handicap, disability, veteran, etc.) and (ii) data on digital signatures.

II. PURPOSES OF PROCESSING PERSONAL DATA, METHODS OF COLLECTION AND LEGAL GROUNDS

Your data are collected by automatic, partially-automatic or non-automatic means via subscription agreements, dealers and other face-to-face channels, call centers, web sites, mobile applications, SMS, e-mail, IVR and other written, verbal and digital methods and processed for the following purposes in accordance with the applicable regulations on protection of personal data on valid legal grounds. Your personal data are shared by you through the channels listed above, automatically collected during the use of products, services and devices and shared with Superonline by our business partners and authorized organizations and institutions.

Superonline processes your data in a connected, limited and restrained manner with clear, definite and legitimate purposes in accordance with the applicable legislation and in line with the principles set forth in Article 4 of the Law in any case.

The purposes for the processing of personal data and data types may vary based on the products and services you use as well as your requests and consents.

Expressly permitted by any law;

• Confirming your identification information and documents where necessary; performing the necessary transactions to detect or prevent abuse, loss or fraud,
• Network traffic management, interfacing and invoicing and resolution of customer complaints and disputes including those on interfacing and invoicing,
• Maintenance of data which should be logged as per the applicable legislation; copies and backups to prevent data loss; ensuring data consistency; taking the technical and administrative measures to ensure the security of networks and data,
• Meeting the legal liabilities imposed by the regulatory and audit authorities and the applicable regulations, managing the legal procedures and proceedings
• ID information, contact data, subscription data, network, traffic and location data, sales channel data, data on use of products and services and payment, bank and risk data are processed.
• In case of emergency assistance requests, location data are processed to detect your location and share the information with the authorities.
In case of physical challenges and based on the legal grounds that you are not in a position to give your consent or the data process is required to protect the life or physical integrity of the person whose legally incapable of giving consent or a third-party real person and for the purposes of;
• Confirmation of your ID data and documents where necessary,
• Management of network traffic and interfacing,

ID information, contact data, subscription data, network, traffic and location data are processed.

Based on the legal grounds that the processing of data of the parties of an contract is required provided that it is directly related with the execution of the contract and for the purposes of;
• Provision, pricing and invoicing of products and services; meeting and follow-up of your requests regarding the products and services ordered, purchased and/or used by you, management of network traffic and interfacing
• Informing you on benefits, terms, prices, subscription, lotteries, contests and awards related with the products and services and fulfilling the necessary procedures for their use,
• Resolution of consumer complaints and disputes, analyzing the level of customer satisfaction; providing call center services, responding to your questions, complaints and notifications,
• Maintenance of the required data; maintenance of backups to prevent data loss; ensuring data consistency; taking the technical and administrative measures to ensure the security of networks and data,

ID information, contact data, subscription data, network, traffic and location data, sales channel data, data on use of products and services and payment, bank and risk data are processed.

Based on the legal grounds that data processing is necessary for Superonline to comply with a legal obligation and for the purposes of;
• Provision, pricing and invoicing of products and services; meeting and follow-up of your requests regarding the products and services ordered, purchased and/or used by you, management of network traffic and interfacing,
• Cancellation of subscription without cancellation fee due to address change or acting on your request for campaign/plan change,
• Informing you on benefits, terms, prices, subscription, lotteries, contests and awards related with the products and services and fulfilling the necessary procedures for their use,
• Analyzing and profiling upon request by public authorities and provision of products and services,
• Confirming your identification information and documents where necessary; performing the necessary transactions to detect or prevent abuse, loss or fraud,
• Resolution of consumer complaints and disputes, providing call center services,
• Improvement, diversification, measurement, inspection and analysis of products and services and networks; training the employees and financial reporting;
• Maintenance of the required data; maintenance of backups to prevent data loss; ensuring data consistency; taking the technical and administrative measures to ensure the security of networks and data,

ID information, contact data, subscription data, network, traffic and location data, sales channel data, data on use of products and services and payment, bank and risk data are processed.

• ID information, contact data, data on use of products and services and payment, bank and risk data are processed for the purposes of managing the legal procedures and proceedings.

In case of emergency assistance requests, location data are processed to detect your location and share the information with the authorities.

Based on the legal grounds that your personal data is made manifestly public by you;
• ID information, contact data, subscription data, location data, sales channel data, data on use of products and services and payment, bank and risk data which are made public are used for the purposes of improvement, diversification, measurement, inspection and analysis of products and services and networks, training the employees, financial reporting, assessment of your interest in products and services and analyzing the level of customer satisfaction in line with the purpose of making the data public.
• ID information and contact data are processed to provide directory-based services provided that you are listed in the directory.
Based on the legal grounds that data processing is required for establishment, use or protection of a right;
• ID information, contact data, subscription data, network, traffic and location data, sales channel data, data on use of products and services and payment, bank and risk data are processed for the purposes of providing the services and performing and following up your requests regarding the products and services you ordered, purchased and/or used.
• ID information, contact data, subscription data, sales channel data, data on use of products and services and payment, bank and risk data are processed for the purposes of confirming your identification information and documents and credit rating check where necessary.
• ID information, contact data, subscription data, sales channels data, data on use of products and services and payment, payment, bank and risk information are processed for the purposes of determining and managing your debt follow-up processes and risk level, including assignment of claims.
Based on the legal grounds that data processing is necessary for the purposes of the legitimate interests pursued by Superonline, except where such interests are overridden by the interests or fundamental rights and freedoms of you;
• Confirming your identification information and documents where necessary; credit rating check and reporting; taking the necessary action to detect or prevent abuse, loss or fraud, management of network traffic and interfacing,
• Improvement, diversification, measurement, inspection and analysis of products and services and networks; training the employees and financial reporting; assessment of your interest in products and services and analyzing the level of customer satisfaction,
• Determination/management/detection of the level of risk,
• Maintenance of backups to prevent data loss; ensuring data consistency; taking the technical and administrative measures to ensure the security of networks and data,
• Managing the legal procedures and proceedings,

ID information, contact data, subscription data, network, traffic and location data, sales channel data, data on use of products and services and payment, bank and risk data are processed.

Based on your explicit consent;

Your biometric signature in case you use your digital signature for digital subscription processes and data on disability/health are processed upon your open consent.

Furthermore, in case of your express consent; ID information, contact data, subscription data, network, traffic and location data, sales channel data, data on use of products and services and payment, bank and risk data are processed for the following purposes:

• Promotion and marketing of products and services, reaching you, informing you on campaigns and discounts, offering advantages related with subscription, events and financial advantages and performing the procedures regarding their use,
• Providing you with offers, gifts and promotions; promotions offered with the intent of analyzing and profiling, carrying out targeted promotion; sending you messages for special celebrations and messages of good wishes, sending you the results of awards, lotteries and contents you like, you may want to access again, and you will be pleased to be reminded of,
• Credit rating check,
• Promoting products and services we offer in collaboration with our business partners and their own products and services,
• Provision of services and determination and management of the level of risk in case of your loan applications under the services or use of mobile payment services.

III. TRANSFERS OF PERSONAL DATA

Superonline may share your personal data with the following local and international receiver groups in line with the Law and the applicable law for the purposes set forth in this Privacy Notice.

Local and international Turkcell Group companies and third parties authorized to act on behalf of Turkcell as listed at httpss://www.turkcell.com.tr/tr/hakkimizda/genel-bakis/istiraklerimiz

Suppliers and business partners for the purposes of delivering or transporting the products or services to your location,

Business partners and suppliers we collaborate with and/or receive service from to promote and market our products and services as well as banks, finance institutions and TBB Risk Center,

Authorities required to locate you in case of an emergency assistance request,

• Lawyers, auditors, consultants and other service providers,
• Your authorized attorneys, guardians and representatives,
• Official institutions and organizations authorized to request your personal data and their agents,
• Your invoice amount and payment information for electronic communication services to electronic communication operators in order to manage the risk of collection and prevent malicious use.