PRENDRE CONTACT

INFORMATION ON THE PROTECTION OF PERSONAL DATA

1. Purpose

We, Bym Global (the“Company”),   inform you as a Data Controller under the Personal Data Protection Law Numbered 6698 (“KVKK”) that since you are a real person having the commercial activity with the Company, or a real person supplier and/or customer, the personal data that we request and you shared with us will be recorded, stored, reorganized for the purpose that requires processing, sharing with institutions authorized by law to request the personal data, transferring to the third parties domestically, transferring, classifying and processing in other ways stated in the KVKK in a limited and measured manner, in connection with the establishment, maintenance and performance of commercial activities and relations for processing.

2. Collection and Processing of Personal Data

Our company will process your personal data for the purposes specified in this disclosure text. If there is any change in the purpose of processing your personal data, your consent will be obtained from you separately.

Your personal data collected and used by our company are as follows:

3.To Whom and For What Purpose the Processed Personal Data Can Be Transferred

Your personal data collected for the purposes stated above, Turkish Commercial Code, Tax Procedure Law, Income Tax Law, Corporate Tax Law, Value Added Tax Law, Stamp Tax Law, Certified Public Accountant and Sworn-in Certified Public Accountant Law, Banking Law, Personal Data Protection Law and above to the institutions or organizations that are permitted and / or authorized by the provisions of other legislation, provided that they are not limited to the aforementioned legislation; Legally authorized public legal entities such as the Personal Data Protection Authority, the Ministry of Finance, the Ministry of Customs and Trade, the Banking Regulation and Supervision Agency and tax offices; To independent and / or sworn-in certified public accountants and accountants in order to fulfill their accounting obligations, to banks, notaries to carry out the contractual relationship, to business partners and suppliers that we cooperate with, such as communication, security and data storage; To the affiliates and shareholders of our company, who are jointly and severally responsible for taking data security measures such as preserving all kinds of personal data, preventing unauthorized access and preventing unlawful processing, to legally authorized private law persons, service providers in Articles 8 and 9 of the KVKK can be transferred within the framework of the specified personal data processing conditions and purposes.

4. Method of Collecting Personal Data and Legal Reasons

Your personal data are collected directly from you as verbal and physical documents, online application system, mail and e-mail, and closed-circuit camera system channels, automatically or non-automatically, for the purposes stated above and under the basic principles stipulated in the KVKK.

5. Your Rights as Personal Data Owner within the scope of Article 11 of KVKK

As personal data owners, in accordance with Article 11 of the KVKK you have the rights to;

• Learn whether your personal data is being processed,

• Request information if your personal data has been processed,

• Learn the purpose of processing your personal data and whether they are used appropriately for their purpose,

• Know the third parties in the country or in abroad to whom personal data have been transferred,

• Request the correction if you personal data are misprocessed and the notification of such correction ,if any, to the third parties,

• Request the deletion or destruction of your personal data within the framework of the conditions stipulated in Article 7 of the Law and to delete or destroy your personal data in the transferred persons,

• Object to the occurrence of a result against you by analyzing your processed data exclusively through automated systems,

• Request compensation in case you suffer damage due to unlawful processing of your personal data.

To use your rights stated in the 11th article of KVKK and written above regarding your personal data, bring your application to the address of the Company with a signature and with your identity copy; or apply via registered electronic mail (KEP) address, secure electronic signature, mobile signature or by the applicant to the address "Küçükbakkalköy Mahallesi, Tevfik Fikret Caddesi No: 32, K: 5 POB34750 Ataşehir, Istanbul, Turkey" via registered mail or a notary public. In addition, by using the e-mail address previously notified to the Company and registered in the Company's system, the Company's corporate e-mail address, info@bymglobal.com or https://www.bymglobal.com or for application, you can apply to the Company through an improved software or application.

Under Article 13 of the KVKK, application requests will be concluded free of charge within 30 (thirty) days at the latest, depending on the nature of the request. If the request is rejected, the reason (s) for rejection is justified in writing or electronically. If the transaction requires cost, the tariff determined by the KVK Board will be applied.

Customer Name and Surname:

Date:

Signature:

THE PROTECTION OF PERSONAL DATA

CONFIDENTIALITY AGREEMENT

1. THE PARTIES

This Confidentiality and Non-Disclosure Agreement (“Contract") is signed by "Bym Global (" the "World Trade Center Lausanne Avenue Gratta-Paille 2 Lausanne, VAUD, 1018 Switzerland") “Disclosing Party”) and _________________________ (“ Receiving Party ”) operating at ___________________ on __ / __ / 202*.

The Disclosing Party and the Receiving Party will be referred to separately as the "Party" and together as the "Parties".

2. SUBJECT AND PURPOSE OF THE AGREEMENT

This Agreement is within the framework of __ / __ / 202*  dated _____________ ("Articles of Association") signed between the parties; Under the Law on the Protection of Personal Data No.6698 and other relevant legislation ("KVKK" or "Law"), with the regulation of the obligations of the Parties, before or during or after the contractual relationship. The parties will share personal data and sensitive personal data; it determines the rights and obligations of the parties for the protection of all kinds of information.

3. DEFINITIONS

3.1. Explicit Consent: Consent based on the information and expressed with free will regarding a specific subject.

3.2. Relevant User: Except for the person or unit responsible for the technical storage, protection and backup of the data, they are the persons who process personal data within the organization of the data controller or under the authorization and instruction received from the data controller.

3.3. Destruction: Deletion, destruction or anonymization of personal data.

3.4. Law / KVKK: Personal Data Protection Law No. 6698.

3.5. Recording Media: Any medium that contains personal data that is wholly or partially automated or processed non-automatic, provided that it is a part of any data recording system.

3.6. Personal Data: All kinds of information regarding an identified or identifiable natural person. So much, so that personal data includes all types of personal data of unique nature.

3.7. Sensitive Personal Data: Data on race, ethnicity, political opinion, philosophical belief, religion, sect or other beliefs, dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures and biometric and its genetic data are personal data of unique nature.

3.8. Processing of Personal Data: Obtaining, recording, storing, preserving, changing, reorganizing, disclosing, transferring, taking over, making available, through fully or partially automatic means of personal data or non-automatic means provided that it is a part of any data recording system, Any action taken on the data, such as classification or prevention of use.

3.9. Making Personal Data Anonymous: Making personal data unidentifiable or unrelated to a natural person, even matching with other data.

3.10. Transfer of Personal Data: The transfer of personal data verbally and / or in writing by the Disclosing party to the Receiving Party in any electronic medium or other means.

3.11. Deletion of Personal Data: Deleting personal data; making personal data inaccessible and unavailable in any way for Related Users.

3.12. Destruction of Personal Data: The process of making personal data inaccessible, unrecoverable and reusable by anyone.

3.13. Board: Personal Data Protection Board.

3.14. Data Subject: A real person whose personal data is processed.

3.15. Data Processor: Real or legal person who processes personal data on behalf of the data controller based on the authority given by him.

3.16. Data Controller: Real or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system

4. PRIVACY

4.1. All personal data, including unique personal data defined and included in this article, and all kinds of written, audio, visual and / or verbal information will be considered Confidential Information

4.2. At the stage of establishment, execution and after the termination of the Articles of Incorporation, each Party shall ensure that no official / unofficial documents, procedures, instructions, financial statements, trade secrets and correspondence and all kinds of commercial, financial and technical information belonging to the other Party. ; All kinds of information and documents transmitted physically or electronically to another party, except for those that will be made available to the public for the realization of the contract; Except for those written above, it cannot disclose any information and document and / or information subject to other legal protection, cannot illegally process it in an electronic or physical environment, use it in other companies it will work with, and cannot give it to other third parties for free or free of charge and cannot mediate its issuance.

4.3. The Receiving Party cannot operate, transfer or explain in an illegal manner; Within the scope of the Articles of Incorporation, all kinds of visual or written documents and information shared with the Receiving Party, especially those that are shared with the Receiving Party or that are self-consensual, and which are identified with third parties and other real persons and legal entities with whom the Disclosing Party has established a membership or commercial relationship; all kinds of information, document, formula, method, invention, design, brand, patent, utility model, source code, software, program, application, computer program, information about new products and development of new products, descriptions and their working methods, production and operating techniques and information regarding service, operation, production, marketing, sales, information technology, financial and administrative structure, all kinds of lists, information and documents about customers and potential customers, especially other matters that should be considered as trade secrets by the Disclosing Party. All kinds of information, especially address information, biometric data and health data, visual or audio documents and all kinds of personal data specified in the KVKK, need to be protected, and special quality personal data belonging to any natural or legal person sent under the Articles of Association. During or even after the termination of the contract in any way, without the knowledge and permission of the Disclosing Party.

4.4. Situations where Confidential Information needs to be disclosed within the scope of fulfillment of the obligation of performance pursuant to the Articles of Incorporation, situations where Confidential Information is required to be disclosed to official authorities by law, especially KVKK legislation, and situations with the written consent of the Party sharing the Confidential Information are reserved.

5. PROTECTION OF PERSONAL DATA

5.1. The Parties will process all personal data of natural persons, including unique personal data transferred between each other, under the principles and processing conditions stipulated in the Law. Regarding the processing and transfer of personal data, the parties are obliged to carefully comply with the requirements and regulations set out in the KVKK, without prejudice to other provisions in the laws of the Republic of Turkey. The parties shall be liable to the extent of causing any damage and fault for any damage arising from the failure to fulfil these and other obligations mentioned in the KVKK in terms of personal data to be obtained within the scope of this Agreement.

5.2. Parties;

5.2.1. While processing personal data, it will comply with the principles in article 5 of KVKK,

5.2.2. Will not use personal data directly or indirectly other than the purposes and requirements of the service between the Parties,

5.2.3. It takes all necessary security measures in its own eyes for the transfer of personal data,

5.2.4. Provides necessary technical, administrative and legal protection measures to prevent unlawful access to personal data,

5.2.5. During and after the transfer of personal data, it will have responsibilities regarding the data controller arranged in KVKK,

5.2.6. The data controller and the relevant user authorized by him / her will act under all legal regulations, especially KVKK,

5.2.7. To fulfil its obligations in the Articles of Association, it accepts, declares and undertakes that it will be responsible for the intent and gross negligence of the real and / or legal persons from whom it receives services within the scope of all kinds of services received from real and legal persons who are not a party to the Articles of Association.

5.3. Disclosing Party agrees, declares and undertakes that they will securely store personal data sent/transferred to the Receiving Party under the Articles of Association or associated with the other Party, of which the Receiving Party is automatically consented, in the physical or electronic environment within the appropriate period of Data Transfer. Furthermore, Receiving Party accepts, undertakes and declares that they will delete or destroy the data under its protection, storage and destruction policy if the periods foreseen in the legislation, especially the KVKK Law, expire, or if there is no period stipulated in the relevant legislation regarding the storage of the personal data and will make them anonymous. Consequently, the data will be destroyed in a way that cannot be used and retrieved in any way.

5.4. If any of the parties violates any of the obligations given above and listed in the KVKK and the Board determines the violation, the Party that has been subjected to penalties and sanctions due to its fault irrevocably accepts, declares and undertakes that the other Party will not have any material or moral responsibility due to any penalty or sanction imposed by the Board.

5.5. The adverse Party is not obliged to control and audit whether the obligations of the Parties specified in this Agreement are fulfilled or not.

6. AMENDMENT AND WAIVER

6.1. Amendments, acceptances, changes, or additions to this Agreement will not be deemed valid and binding without the Parties' written Agreement. The waiver is not binding unless made in writing by the disclaimer.

6.2. Failure to exercise any of the rights under this Agreement by the Parties or to postpone their usage will not be considered a waiver of the rights, and the use of such rights alone or in part will not prevent the exercise of other rights.

7. PROTECTION OF PERSONAL DATA, PRIVACY AND BREACH OF PRIVACY

7.1. The parties acknowledge and undertake that they will fully fulfil their obligations within the scope of the Personal Data Protection Law No.6698 ("KVKK") and the relevant legislation in force and to come into force. The parties accept and undertake that any information specified in Article 2 of this agreement and obtained within the scope of the Articles of Association is Confidential Information and acknowledge that they are obliged to show the necessary care expected from them in preventing the disclosure of the trade secrets and Confidential Information that they have been fond of during the Data Transferred Articles of Association.

7.2. Receiving Party is obliged to obtain express written consent from the Disclosing Party to collect, record, process, store, transfer, and share with the Institutions and Organizations and its domestic and foreign affiliates to fulfil its obligations under the Articles of Association. Otherwise, all kinds of direct and indirect damages, damages and compensation and / or administrative fines under whatever name all third parties demand from the Disclosing Party and the Disclosing Party will have to pay will be recourse to the Receiving Party.

7.3. Receiving Party understands that unauthorized use or disclosure of all or any part of Confidential Information may harm the Disclosing Party. Therefore, the Receiving Party acknowledges, declares and undertakes that the partial or complete violation of this contract will violate the provisions of the Turkish Commercial Code, Turkish Penal Code and Personal Data Protection Law. All kinds of legal, financial, administrative and criminal liability due to such a violation belongs to him, and all positive and negative damages of the Disclosing Party caused / to be caused by any name whatsoever, without the need for any notice, warning and judgment (attorney fees and agrees, declares and undertakes to indemnify compensation (including the costs of the proceedings at any stage). In addition, it accepts, declares and undertakes to pay __________ TL as penal clause.

8. NOTIFICATION ADDRESSES

The notification procedure and all kinds of notification addresses specified by the Parties in the Articles of Association are valid to fulfil the matters in this Agreement and make the required notices and notifications. Suppose any procedure or address for notification is not specified or cannot be understood in the Articles of Association. In that case, only the corporate e-mail addresses of the Parties and the addresses included in the 1st article of this Agreement will be accepted as the notification address. Without prejudice to the provisions of the Articles of Association, the Parties agree, declare and undertake that all notices and notices to be made to the addresses included in this contract will be valid if they do not notify the other party of the address changes stated in Article 1 through a notary.

9. APPLICABLE LAW AND COMPETENT COURT

Istanbul Courts and Enforcement Offices are authorized to interpret this contract and in all disputes that will arise due to this contract, and Turkish law is applied.

10. PARTIAL INVALIDITY

If any of the articles of this contract are deemed invalid or cancelled, this does not affect the other articles' validity.

11. NOTIFICATIONS

The notices and notifications in Article 18/3 of the Turkish Commercial Code numbered 6102 will be made through a notary public, registered letter with return receipt, telegram or registered electronic mail system using a secure electronic signature.

12. EFFECTIVENESS AND VALIDITY

12.1. This Agreement is an annex and integral part of the Articles of Association signed between the Parties and cannot be interpreted separately from the Agreement. The parties acknowledge and agree that all changes made with this Protocol will affect __ / __ / 202*.

12.2. In the event of a conflict between the Articles of Association and this Agreement, the provisions of this Agreement are given priority, except for Article 8 of this Agreement.

12.3. This Agreement has been drawn up in 2 (two) copies and signed by the Parties with each copy remain in both parties.