Personal Data Protection & Confidentiality Policy

This Privacy Notice (the “Notice”) has been prepared by BULLS YATIRIM MENKUL DEĞERLER A.Ş. (“BULLS YATIRIM”), acting as the data controller, in accordance with the Law No. 6698 on the Protection of Personal Data (the “Law”), the Communiqué on the Principles and Procedures to be Followed in Fulfilment of the Obligation to Inform, and other applicable legislation, in order to inform our customers and prospective customers, as the relevant data subjects, about the processing of their personal data.

1. INFORMATION ON THE DATA CONTROLLER

Company: Bulls Yatırım Menkul Değerler A.Ş.

Head Office Address:
Büyükdere Cad. No: 173, Levent Plaza B Block, Floor: 5, Levent / Istanbul, Türkiye

Telephone: +90 (212) 410 05 00

Fax: +90 (212) 410 05 05

E-mail: info@bullsyatirim.com

2. HOW DO WE PROCESS YOUR PERSONAL DATA?
3. Personal Data Processed as a Prospective Customer

If you complete the account opening form (the “Form”) available under the “Become a Customer” section of the website (“Website”) at www.bullsyatirim.com, the personal data listed below that you submit to BULLS YATIRIM through partially automated means will be processed by BULLS YATIRIM for the purpose of contacting you regarding the opening of an account, based on the legal ground that the data has been made public by the data subject. Such personal data will not be transferred to any third party.

• Identity: Name and surname, date of birth
• Contact: E-mail address, telephone number, city
• Other: Investment information

1. Personal Data Processed as a Customer

After your personal data contained in the form you completed as a prospective customer has been processed by BULLS YATIRIM, a customer acquisition representative acting on behalf of BULLS YATIRIM will contact you by telephone. Following such communication, you will be requested to complete and submit to BULLS YATIRIM the agreement applicable to you from among the agreements available under the “Agreements” section of the Website.

Once you become a customer in this manner, the personal data specified below contained in the agreement you complete will be processed by BULLS YATIRIM through partially automated means for the purposes of providing BULLS YATIRIM services and enabling BULLS YATIRIM to fulfil its legal obligations, based on the legal grounds that such processing is necessary for the establishment and performance of the agreement and necessary for BULLS YATIRIM to fulfil its legal obligations.

• Identity: Name and surname, Turkish Identification Number, Tax Identification Number, Mother's Name, Father's Name, Place of Birth, Date of Birth, Type of Identity Document, Identity Document Number, Nationality, Marital Status, Documents Containing Information Such as Gender (e.g. Driver's License, Copy of Identity Card), Signature/Initial Information.
• Contact: E-mail Address (including internal extension number and corporate e-mail address), Telephone Number, Fax Number, Address, City and District.
• Professional Information: Profession, Name of Employer, Industry of Employment.
• Legal Transaction: Personal data processed for the determination, follow-up and enforcement of legal receivables, rights and obligations, as well as for compliance with legal obligations and our Company policies, including file and debt information relating to enforcement proceedings (including information contained in documents such as court and administrative authority decisions).
• Customer Transaction: Purpose of Opening an Account with the Company, Voice Recordings of Conversations with the Customer Representative, Invoice, Promissory Note, Cheque Information, Your Transaction Requests, Account Information.
• Transaction Security: IP Address Information, Website/Mobile Application Login-Logout and Transaction Information, Password and Passcode Information.
• Financial Information: Monthly Net Income, Money Transfer Information, Source of Assets, Whether Funds Will Be Transferred to the Account from Abroad, Countries from Which Funds May Be Transferred to the Account, Credit Score, Investor Risk Assessment, Asset Information, Investment Portfolio Information, Type of Capital, Account Status, Shareholding Percentage, Annual Interest Rate, Bank Code, Credit Information, Debt Information.
• Marketing: Responses to Surveys, Website and Mobile Application Cookie Records.
• Visual and Audio Records: Photograph (obtained through a copy of the Identity Document), Camera Recordings (excluding recordings falling within the scope of Physical Premises Security Information), Voice Recordings (telephone call recordings).
• Other: Document Number, Account Type, Member Code, Date of Access, PTT Barcode Number, CRM Status, Delivery Date, Statement Delivery Method.
• Other (For Foreign Nationals): Purpose of Stay in Türkiye, Duration of Residence in Türkiye, Planned Duration of Stay in Türkiye.

Your personal data collected by BULLS YATIRIM are processed for the following purposes:

• Opening an account with the Central Securities Depository of Türkiye (Merkezi Kayıt Kuruluşu – MKK);
• Opening an account with Takasbank;
• Sending account statements;
• Creating and updating accounts maintained with our Company;
• Conducting restricted customer procedures;
• Conducting dispute resolution, internal audit and inquiry processes;
• Managing customer complaint processes;
• Conducting internal control processes;
• Conducting investigation processes;
• Preparing and reporting suspicious/erroneous transaction reports;
• Managing defence submissions before the Capital Markets Board of Türkiye (“SPK”);
• Conducting risk monitoring processes;
• Conducting information security processes;
• Following up legal processes and carrying out legal transactions;
• Making and following up tax notifications;
• Preparing customers' net worth reports;
• Submitting annual residency notifications to the Ministry of Treasury and Finance;
• Conducting MASAK reporting processes;
• Recording customer information in the system and carrying out account opening/closing procedures;
• Conducting customer collateral completion processes.
• Carrying out cash withdrawal transactions;
• Preparing customer Stop-Out reports;
• Conducting treasury operations relating to customer transactions;
• Conducting release and reconciliation processes;
• Retaining customer support records;
• Performing archiving activities;
• Reporting agreements;
• Retaining customer transaction records;
• Performing address verification;
• Updating customers' contact information;
• Conducting power of attorney procedures;
• Executing transfer (virman) instructions;
• Conducting cash transactions relating to VIOP (Turkish Derivatives Market) accounts;
• Maintaining account statement dispatch reports;
• Preparing and submitting the information form of the Turkish Capital Markets Association (TCMA) (Türkiye Sermaye Piyasaları Birliği – TSPB);
• Maintaining internal company records;
• Conducting litigation and enforcement proceedings;
• Conducting blacklist screening processes.

1. Personal Data Processed for Sending Commercial Electronic Communications

On the page where you decide to submit the Form you have completed on the Website to BULLS YATIRIM, you will be asked whether you wish to receive commercial electronic communications. If you indicate your preference to receive commercial electronic communications by selecting the relevant checkbox and submitting it to BULLS YATIRIM, the contact information among your personal data processed as a customer/prospective customer, as specified above, which will enable the sending of commercial electronic communications, will be processed by BULLS YATIRIM based on your explicit consent for the purposes of sending information regarding the products and services offered by BULLS YATIRIM, its subsidiaries and business partners, conducting advertising, campaign and promotional activities through commercial electronic communications, and uploading your data to the Message Management System (İleti Yönetim Sistemi – İYS) in accordance with the Law on the Regulation of Electronic Commerce, and will be transferred to our third-party service providers for the same purposes.

You may withdraw your consent to receive commercial electronic communications at any time (excluding communications that are mandatory under the applicable legislation governing BULLS YATIRIM). If you notify us that you no longer wish to receive commercial electronic communications, your personal data will no longer be processed for this purpose by BULLS YATIRIM as of the date your request is processed.

3. HOW IS YOUR PERSONAL DATA TRANSFERRED?

Your personal data processed by BULLS YATIRIM will be transferred to domestic suppliers and authorized public institutions and organizations, based on the legal grounds that such transfer is directly related to the establishment or performance of a contract, is necessary for the processing of personal data belonging to the parties to the contract, and is necessary for the data controller to fulfil its legal obligations, for the purposes of conducting activities in compliance with the applicable legislation and carrying out finance and accounting operations.

Your personal data will not be shared with third parties located abroad without your knowledge and explicit consent. Your personal data may be transferred to third parties located abroad only to the extent necessary for the purposes of processing and in accordance with the processing conditions set forth in the Law. Where you wish to carry out transactions in foreign markets, you will be separately informed regarding the transfer of your personal data abroad.

4. EXERCISING YOUR RIGHTS AS A DATA SUBJECT

Pursuant to Article 11 of the Law, which regulates the rights of data subjects, you have the right to learn whether your personal data are being processed, request information if your personal data have been processed, learn the purpose of the processing of your personal data and whether they are used in accordance with such purpose, learn the third parties to whom your personal data have been transferred, whether domestically or abroad, request the rectification of your personal data if they are incomplete or inaccurately processed, request the erasure or destruction of your personal data, request that the rectification, erasure or destruction of your personal data be notified to the third parties to whom your personal data have been transferred, object to any result against you arising exclusively from the analysis of your personal data through automated systems, and request compensation for any damages you suffer due to the unlawful processing of your personal data.

You may submit these requests to BULLS YATIRIM in accordance with the Communiqué on the Principles and Procedures for the Application to the Data Controller.

This Privacy Notice was last updated in June 2025.