As part of its legal and social responsibility, Terra Reporting commits to comply with the national personal data protection, processing and destruction regulations. This Personal Data Protection, Policy (“Policy”) is applied to Terra Reporting under its control within the framework of legislation in effect and is based on core principles recognized nation-wide regarding personal data protection, processing and destruction.

Concerning the protection of personal data being a Constitutional right, Terra Reporting shows great effort for the protection of personal data belonging to customers, potential customers, employee candidates, company shareholders, company officials, visitors, employees and officials of institutions we are in cooperation with, such protection and processing being managed by this Policy and implements such protection and processing of aforementioned data as a Company policy.

Within this scope, necessary administrative and technical measures are taken by Terra Reporting for the protection of personal data processed in accordance with the relevant legislation.

Within this Policy detailed explanations shall be provided concerning basic principles Terra Reporting has adopted for the processing of personal data and listed below:

• Processing of personal data in accordance with laws and in good faith,

• Personal data are accurate and up to date when necessary,

• Processing personal data for specified, clear and legitimate purposes,

• Processing personal data in connection with purposes for which they are processed with restrictions and purposes,

• Retaining personal data for terms foreseen by relevant legislation or for purposes they are processed for,

• Notifying and informing data subjects,

• Establishing the required system for the exercising of data subjects’ rights,

• Taking necessary measures for the protection of personal data,

• Acting in compliance with relevant legislation and regulations of the Board when transferring personal data to third parties in line with requirements of processing such personal data,

• Showing required sensitivity for the processing and protection of special categories of personal data.