GDPR Information Notice

Data controller within the scope of the Personal Data Protection Law: Company Name: bubi ADS Technology Inc. Registration No: XXXXXXXXXXXXXXXXXX Address: Istanbul, Turkey Email: gdpr@bubiads.com Phone: +90 544 235 23 96 Your personal data will be processed by bubi ADS as the data controller within the scope described below.

Categories of personal data processed by us: Identity Information: • Name, surname, national ID number (when necessary) Contact Information: • Email address, phone number, address Customer Transaction Information: • Order/subscription information, billing information Financial Information: • Bank account information, payment records Transaction Security Information: • IP address, log records, device information Marketing Information: • Cookie records, preferences, campaign participations

Your personal data is processed for the following purposes: • Membership/account creation and management • Provision and improvement of services • Fulfillment of contractual obligations • Processing billing and payment transactions • Responding to customer requests • Fulfillment of legal obligations • Ensuring information security • Statistical analysis and reporting • Marketing activities (with your explicit consent)

Your personal data may be transferred to the following recipient groups: Domestic Transfer: • Business partners and suppliers • Legal advisors and auditors • Authorized public institutions and organizations • Payment institutions and banks International Transfer: • Meta Platforms Inc. (service requirement) • Cloud service providers (AWS, Google Cloud) • Analytics and monitoring tools International transfers are carried out within the scope of your explicit consent or legal exceptions under the law.

Your personal data is retained for the period required by processing purposes: • Account information: During membership + 10 years • Transaction records: 10 years (as per Commercial Code) • Invoice information: 10 years (as per Tax Procedure Law) • Communication records: 3 years • Log records: 2 years • Marketing data: Until consent is withdrawn After the period expires, data is deleted, destroyed, or anonymized.

You have the following rights under the Personal Data Protection Law: a) Learning whether your personal data is being processed b) Requesting information if it has been processed c) Learning the purpose of processing and whether it is used in accordance with its purpose d) Knowing the third parties to whom it has been transferred domestically or abroad e) Requesting correction if it has been processed incompletely or incorrectly f) Requesting deletion/destruction within the scope of the law g) Requesting notification of operations under (e) and (f) to third parties to whom data has been transferred h) Objecting to the occurrence of a result against you through the analysis of processed data exclusively by automated systems i) Requesting compensation for damages if you suffer damage due to unlawful processing

To exercise your rights: Email: gdpr@bubiads.com Address: Istanbul, Turkey KEP: bubiads@hs01.kep.tr Your application must include: • Name, surname, and signature • National ID number • Address for notification • Email address and phone (if any) • Subject of request Applications are finalized free of charge within 30 days at the latest. If the transaction requires an additional cost, the tariff determined by the Board will be applied.