PERSONAL DATA PROCESSING AND PROTECTION POLICY

As Jozzy Oyun ve Teknoloji Anonim Şirketi (hereinafter referred to as the "Company"), we attach the utmost importance to the protection of the personal data of all natural persons with whom we come into contact during our activities—including our customers, employees, visitors, and business partners— as the protection of personal data constitutes a constitutional right. To this end, we hereby take all necessary technical and administrative measures to ensure full compliance with all relevant legislation, primarily Law No. 6698 on the Protection of Personal Data (hereinafter referred to as "KVKK") and, to the extent applicable, the European Union General Data Protection Regulation (hereinafter referred to as "GDPR"), to prevent unlawful processing of and access to personal data, and to ensure data security.

By this Policy on the Processing and Protection of Personal Data (hereinafter referred to as the "Policy"), the Company aims to inform you regarding our personal data processing, transfer, protection, retention, and disposal systems, as well as our fundamental principles.

This Policy hereby provides transparency regarding the Company's data processing activities; however, it does not encompass all possible scenarios on its own. In processes specific to products or services, detailed information is provided prior to or at the time of data collection through distinct clarification texts (privacy notices), and your explicit consent is obtained separately where necessary. Accordingly, you may access more comprehensive information regarding the processing of your personal data through the relevant clarification texts.

This Policy encompasses all physical and electronic data recording systems and environments used for the processing of personal data and special categories of personal data by automated means or non-automated means provided that they form part of any data recording system. The website operated by the Company (hereinafter referred to as the "Website") and all online/digital platforms connected thereto are also within the scope of this Policy. Third-party websites, platforms, or mobile applications not managed by the Company fall outside the scope of this Policy. Processing activities regarding your personal data on such third-party platforms are subject to the respective service provider's own policies and terms of use.

Explicit Consent

Consent regarding a specific subject matter, based on information, and expressed with free will.

Constitution

The Constitution of the Republic of Turkey numbered 2709.

Data Subject

The natural person whose personal data is processed.

Disposal

The deletion or destruction of personal data.

Jozzy

Jozzy Oyun ve Teknoloji Anonim Şirketi.

Personal Data

Any information relating to an identified or identifiable natural person.

Personal Data Processing Inventory

The inventory in which data controllers detail their personal data processing activities based on business processes, by associating them with processing purposes, data categories, recipient groups, and data subject groups, specifying the maximum retention period required for the processing purposes, personal data anticipated to be transferred abroad, and administrative and technical measures taken regarding data security.

Anonymization of Personal Data

Rendering personal data impossible to be associated with an identified or identifiable natural person under any circumstances, even when matched with other data.

Disposal of Personal Data

The operations of deletion, anonymization, or destruction of personal data.

Deletion of Personal Data

Rendering personal data inaccessible and unusable for the relevant users in any manner whatsoever.

Destruction of Personal Data

Rendering personal data inaccessible, irrecoverable, and unusable by anyone in any manner whatsoever.

Personal Data Protection Board (KVK Board)

The Personal Data Protection Board.

KVKK

The Law No. 6698 on the Protection of Personal Data.

Special Categories of Personal Data

Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect, or other beliefs, clothing and attire, membership to associations, foundations, or trade unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data.

Periodic Disposal

The ex-officio operation of deletion, destruction, or anonymization specified in the retention and disposal policy, executed at recurring intervals in the event that all processing conditions stipulated in KVKK cease to exist.

Policy

This Policy on the Processing and Protection of Personal Data.

Data Processor

The natural or legal person processing personal data on behalf of the data controller based on the authority granted by the data controller.

Data Recording System

The recording system in which personal data is structured and processed according to specific criteria.

Data Controller

The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.

In accordance with Article 20 of the Constitution and Article 4 of the KVKK, the Company engages in personal data processing activities lawfully and fairly, accurately and, where necessary, up-to-date, pursuing specific, explicit, and legitimate purposes, in a manner that is relevant, limited, and proportionate to the purpose for which they are processed. In this context, pursuant to Article 5 of the KVKK, personal data is processed based on one or more of the conditions set forth in Article 5 of the KVKK, and retained for the duration stipulated by law and/or required for the purpose of processing. Furthermore, the Company acts in compliance with regulations prescribed for the processing of special categories of personal data under Article 6 of the KVKK, complies with regulations stipulated by law and established by the KVK Board regarding personal data transfers under Articles 8 and 9 of the KVKK, and fulfills the obligation to inform Data Subjects pursuant to Article 10 of the KVKK, providing necessary notifications upon request.

Your personal data is processed by the Company in accordance with the processing principles set forth in Article 4 of the KVKK. Compliance with these principles is mandatory for each personal data processing activity:

• Processing in accordance with law and fairness: In processing your personal data, the Company acts in compliance with laws, secondary regulations, and general principles of law, placing paramount importance on limiting processing strictly to its specified purpose.
• Accuracy and keeping up-to-date: Due care is exercised to verify whether processed personal data is up-to-date. In this regard, the Data Subject is granted the right to request correction or deletion of inaccurate or outdated data.
• Processing for specific, explicit, and legitimate purposes: Processing purposes are determined prior to each data processing activity, ensuring compliance with lawfulness.
• Relevance, limitation, and proportionality to the processing purpose: Personal data is limited strictly to what is necessary for fulfilling the collection purpose, and technical and administrative measures are implemented to avoid processing irrelevant data.
• Retention for the duration stipulated by legislation or required for processing purposes: Personal data is deleted, destroyed, or anonymized following the expiration of the retention period prescribed by legislation or upon the cessation of the processing purpose.

Your personal data is processed by the Company upon the existence of at least one of the personal data processing conditions specified under Article 5 of the KVKK. Said conditions are as follows:

• Explicit Consent of the Data Subject: Processing may be conducted if the Data Subject grants unambiguous approval for a specific processing activity, based on sufficient information and expressed with free will.
• Explicitly provided for by law: Personal data may be processed without explicit consent within the framework of relevant legal regulations where explicitly stipulated by law.
• Failure to obtain explicit consent due to physical impossibility: Personal data belonging to a person unable to express consent or whose consent cannot be validated may be processed without explicit consent if mandatory to protect the life or physical integrity of said person or another individual.
• Direct relationship with the formation or performance of a contract: Processing may be conducted without explicit consent if necessary for processing personal data belonging to parties to a contract established or already concluded with the Company.
• Mandatory processing for the Data Controller to fulfill a legal obligation: Personal data may be processed without explicit consent to fulfill legal obligations mandated under applicable legislation.
• Data made public by the Data Subject: Personal data publicly disclosed by the Data Subject in any manner may be processed without explicit consent, limited strictly to the purpose of such public disclosure.
• Mandatory processing for the establishment, exercise, or protection of a right: Processing may be conducted without explicit consent if necessary for establishing, exercising, or protecting a legal right.
• Mandatory processing for the legitimate interests of the Data Controller: Personal data may be processed provided that it does not harm the fundamental rights and freedoms of the Data Subject. In this context, the legitimate interest to be obtained by the Company is first determined, potential impacts on the Data Subject's rights are evaluated, and if a fair balance is confirmed, processing is carried out without explicit consent.

Special categories of personal data are exhaustively listed under Article 6 of the KVKK, comprising data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect, or other beliefs, clothing and attire, membership to associations, foundations, or trade unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data.

The Company exercises maximum effort to limit exposure to special categories of personal data in view of its operational scope and sensitivity towards data privacy. The Company may process special categories of personal data upon implementing additional measures designated by the KVK Board under the following circumstances:

• Explicit Consent of the Data Subject: Processing may occur if explicit, informed, and specific consent is granted by the Data Subject.
• Explicitly provided for by law: Processing may occur without explicit consent where explicitly stipulated under relevant statutory provisions.
• Physical impossibility: Processing may occur without explicit consent if mandatory to protect the life or physical integrity of the Data Subject or another person where the Data Subject is unable to express consent or whose consent cannot be legally recognized as valid.
• Data made public by the Data Subject: Processing may occur without explicit consent, limited strictly to the purpose consistent with the Data Subject's intention of public disclosure.
• Mandatory for the establishment, exercise, or protection of a right: Processing may occur without explicit consent where required for legal rights.
• Public health, preventive medicine, diagnosis, treatment, care, planning, management, and financing of health services: Processing may occur without explicit consent strictly by persons under a legal obligation of confidentiality or authorized public institutions/organizations.
• Legal obligations in employment, occupational health and safety, social security, social services, and social welfare: Processing may occur without explicit consent where mandatory for fulfilling obligations in these specified domains.
• Foundations, associations, or non-profit entities established for political, philosophical, religious, or trade-union purposes: Processing may occur without explicit consent concerning current or former members and affiliates, or persons who are regularly in contact with such organizations or entities.

The Company collects personal data during interactions with users through products and services offered via the Website. In this scope, data may be collected automatically when you visit our Website, create an account, execute a payment, or submit a support request. Furthermore, technical data is gathered via cookies and similar technologies through your device, browser, or applications. Detailed cookie information is accessible via our Cookie Policy.

Depending on your interaction with the Company, collected personal data may include name, Turkish ID number, address, email address, phone number, payment details, IP address, and device information. Collected data categories may vary based on requested services or contractual relationships. Additionally, records of inquiries, feedback, support messages, and communications directed to our Company may be stored within our systems.

We collect your personal data for purposes including, but not limited to, the following:

• Executing account creation and membership login processes;
• Executing purchasing transactions and ensuring performance of sales contracts;
• Optimizing games and resolving technical errors;
• Processing payment transactions, securing collections, and maintaining financial records;
• Generating accounting entries and fulfilling tax legislation obligations;
• Addressing customer service inquiries and technical support requests;
• Measuring service quality across digital channels, enhancing user experience, and maintaining system security;
• Conducting statistical analyses, measuring performance, and resolving technical glitches via cookie data;
• Delivering personalized campaigns, discounts, promotional offers, and advertising upon obtaining user consent;
• Conducting customer satisfaction surveys to evaluate feedback and elevate service quality;
• Fulfilling official information requests, executing statutory obligations, and protecting legal rights in potential disputes.

Should we process your personal data outside the aforementioned purposes, such activities shall be conducted strictly within the legal framework and in alignment with relevant clarification texts.

In compliance with the KVKK and relevant statutory provisions, the Company processes personal data falling under the categories of Identity, Contact, Finance, Legal Transaction, Personnel, Visual and Audio Records, Professional Experience, and Customer Transaction. Comprehensive specifics regarding processed data are set forth in the clarification text provided to you.

The Company may transfer personal data and special categories of personal data to third parties by implementing necessary security measures in pursuit of lawful data processing purposes, acting in full compliance with Articles 8 and 9 of the KVKK.

Transfer of Personal Data

Even in the absence of explicit consent, personal data may be transferred to third parties with due care and technical security measures upon the existence of one or more of the following conditions:

• Transfer activities are explicitly provided for by law;
• Transfer is mandatory to protect the life or physical integrity of a person unable to express consent due to physical impossibility;
• Transfer is directly linked to the formation or performance of a contract;
• Transfer is mandatory for fulfilling the Data Controller's legal obligations;
• Data has been made public by the Data Subject, limited strictly to the purpose of disclosure;
• Transfer is mandatory for establishing, exercising, or protecting legal rights of the Company, Data Subject, or third parties;
• Transfer is mandatory for the legitimate interests of the Company, provided fundamental rights and freedoms are not harmed.

Additionally, cross-border data transfer may only occur under the following circumstances:

• To foreign countries declared to possess adequate protection by the KVK Board, upon meeting any of the above conditions;
• In the absence of an adequacy decision, provided one of the above conditions is met, the Data Subject has the ability to exercise their rights and access effective legal remedies in the destination country, and appropriate safeguards specified in the KVKK are provided by the parties;
• In the absence of an adequacy decision or appropriate safeguards, on an occasional basis strictly under circumstances specified in Article 9/6 of the KVKK.

Transfer of Special Categories of Personal Data

Special categories of personal data may be transferred in compliance with the principles set forth herein and upon taking all necessary technical and administrative measures, provided that:

• Explicit consent of the Data Subject is obtained;
• Transfer is explicitly provided for by law;
• Transfer is mandatory to protect life or physical integrity under physical impossibility;
• Data has been made public by the Data Subject, limited to the purpose of disclosure;
• Transfer is mandatory for establishing, exercising, or protecting legal rights;
• Transfer is required for public health, preventive medicine, medical diagnosis, treatment, care, or management/financing of health services by persons under confidentiality obligations or authorized bodies;
• Transfer is mandatory for legal obligations in employment, OHS, social security, social services, and welfare;
• Transfer relates to members/former members/contacts of political, philosophical, religious, or trade-union entities within their operational purpose without third-party disclosure.

In addition to the above, special categories of personal data may only be transferred abroad where the following conditions exist:

• To foreign countries for which an adequacy decision has been issued by the KVK Board, where any of the above conditions exists;
• Where there is no adequacy decision, where any of the above conditions exists and the Data Subject has the ability to exercise their rights and access effective legal remedies in the country to which the transfer will be made, provided that one of the appropriate safeguards specified in the KVKK is provided by the parties;
• Where there is no adequacy decision and none of the appropriate safeguards provided for in the KVKK can be ensured, on an occasional basis and only where one of the circumstances specified in Article 9(6) of the KVKK exists.

Sharing of Your Personal Data

To deliver products and services via our Website, certain processes are managed by authorized business partners or service providers. In such cases, your personal data may be shared strictly to the extent required for service delivery with:

• Banks and Payment Service Providers: For receiving payments, executing collections, managing refunds, preventing fraud, and ensuring payment security.
• Service Providers and Consultants: For maintaining legal compliance, managing legal proceedings, and operational efficiency with audit firms, law offices, financial advisors, and technical suppliers.
• Analytics and Database Providers: For processing search behavior and site interactions statistically via cookies and analytical tools to enhance user experience.
• Accounting, Financial Consultancy, and Integration Systems: For issuing invoices, accounting entries, tax returns, and legal compliance with certified accountants and software integrators.
• Official Authorities and Judicial Bodies: For responding to lawful requests from public authorities, courts, or regulatory bodies when required by law.
• Mobile Applications: Transactions regarding game downloads or in-game purchases in Company mobile games are executed via Apple AppStore and GooglePlay store platforms.

Even if explicit consent is granted for personalized ads, the Company processes in-app transactions and responses to displayed ads in an anonymized format.

The Company may collaborate with third-party vendors for analytics, hosting, advertising, and marketing services. You may access the list of third-party service providers and their privacy policies below:

The Company may send notifications through the games to the device you use to connect to the games only upon your explicit consent. You may modify your notification settings on your device at any time.

These parties process your personal data either in the capacity of a data processor on behalf of our Company or as a data controller within the scope of their own statutory obligations. All sharing activities are executed within the framework of contractual security safeguards and technical-administrative measures.

The Company takes the necessary security measures in accordance with international standards to protect the confidentiality, integrity, and accessibility of personal data; and implements all technical and administrative measures required to prevent unauthorized access, disclosure, or loss of data.

The persons and organizations listed above represent some of the parties with whom data sharing may occur, and this list is not exhaustive. Depending on the nature of the transaction or service you conduct with the Company, you can always access detailed information regarding with whom and to what extent your personal data is shared through the clarification texts specifically provided to you for the relevant process.

In accordance with Article 12 of the KVKK, the Company takes all necessary technical and administrative measures and conducts required audits to ensure the appropriate level of security to prevent unlawful processing of and access to personal data, and to safeguard data retention.

Fundamental data protection principles adopted by the Company include:

• Only personal data strictly necessary for offering products and services is collected and retained;
• Clear information is provided regarding data usage and access privileges;
• Up-to-date encryption, access control mechanisms, and firewalls are utilized to protect information systems against unauthorized access, disclosure, or misuse;
• Personal data is never shared with third parties without explicit consent, except where mandated by statutory obligations or court orders;
• Third-party service providers are contractually bound to comply with Company policies and security conditions;
• Access to personal data by Company employees is strictly restricted based on role-based responsibilities;
• All employees are informed about confidentiality obligations.
• Agreements signed contain data security provisions.
• Information security processes are systematically reviewed and updated against emerging technologies and evolving risk profiles.

The Company carries out the necessary efforts to regularly review and continuously improve its security systems regarding the protection of personal data in line with developing technologies and current risks. However, being aware that no security measure can provide absolute protection, we adopt a preventive (proactive) security approach in order to identify, prevent, and minimize potential risks in advance.

Personal data is retained for the period necessary for processing purposes and for minimum statutory periods mandated by applicable legislation. Where statutory retention periods exist, such timelines are strictly observed; in the absence of explicit statutory periods, data is stored for the duration required to achieve processing purposes, taking into account data sensitivity, potential dispute risks, and operational needs.

General retention principles applied by the Company:

• Financial records, invoices, and payment details are retained for periods required or permitted under tax legislation;
• User account data is retained while the account remains active; upon account deletion or membership termination, data is retained for the periods stipulated or permitted by applicable legislation;
• Marketing and communication consent data is retained while consent remains valid; upon consent withdrawal, processed data is deleted or anonymized, subject to statutory exceptions.

Personal data is disposed of at the end of the determined retention periods in accordance with periodic disposal schedules or upon the Data Subject's application, utilizing the designated disposal methods (deletion and/or destruction and/or anonymization).

In cases where a longer period is legally required or permitted (such as a dispute or legal proceeding), your personal data may be retained strictly for a limited period until the conclusion of the relevant process. In such cases, your personal data is disposed of once the purpose of data retention ceases to exist.

Data subjects have the right to request the deletion or destruction of their personal data under Article 11 of the KVKK. However, in some cases, this request may not be fulfilled immediately. For instance, based on legal reasons such as the necessity of retaining data to fulfill a statutory obligation or the necessity for the establishment, exercise, or protection of a legal right, the relevant data may continue to be retained throughout the legal retention period. In such cases, you will be informed about why your data deletion request could not be fulfilled, and the justifications will be clearly shared with you.

Pursuant to Article 10 of the KVKK, the Company informs Data Subjects at the time of data collection (or within a reasonable period if obtained from third-party sources), declaring:

• Identity of the Company (Data Controller);
• Purposes of personal data processing;
• Recipients and purposes of data transfers;
• Method and legal grounds of data collection;
• Statutory rights enumerated under Article 11 of the KVKK.

Pursuant to Article 11 of the KVKK, Data Subjects possess the following legal rights:

• To learn whether their personal data is processed;
• To request information if personal data has been processed;
• To learn the purpose of processing and whether data is used in accordance with its purpose;
• To know third parties to whom personal data is transferred domestically or abroad;
• To request correction of incomplete or inaccurate personal data;
• To request deletion or destruction of personal data under Article 7 of the KVKK;
• To request notification of correction, deletion, or destruction operations to third parties to whom data has been transferred;
• To object to adverse outcomes resulting exclusively from automated data analysis;
• To claim compensation for damages suffered due to unlawful processing.

Data Subjects may submit requests regarding these rights in Turkish pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller, in writing to the Company address at "İkitelli Osb Mah. Ytü İkitelli Teknopark Sk. Yıldız Teknik Üniversitesi Teknopark Blok No: 1 Iç Kapı No: 2b7 Başakşehir / İstanbul", or via [email protected] Registered Electronic Mail (KEP), Secure Electronic Signature, Mobile Signature, or via the e-mail address previously notified to the Company and registered in our systems, or through any other application method determined by the KVK Board.

The Company implements all necessary technical and administrative measures to process Data Subject applications efficiently, lawfully, and fairly.

Applications may be accepted or rejected with stated reasons. Responses shall be delivered in writing or electronically.

Requests submitted in compliance with specified procedures shall be finalized free of charge as soon as possible and within 30 (thirty) days at the latest. However, if the transaction incurs an additional cost, fees specified in the tariff established by the KVK Board may be charged.

The Company reserves the right to amend, update, or revise this Policy at any time to reflect legal changes, internal process updates, or service innovations. Revised policy provisions enter into force immediately upon publication on the website.

Our users are advised to visit our Website periodically to review the most up-to-date conditions governing personal data processing.

For any questions, requests, suggestions, or complaints regarding the implementation of this Policy, personal data processing, or the exercise of your statutory rights under the KVKK, you may contact the Company via the following channels:

• Company Title: Jozzy Oyun ve Teknoloji Anonim Şirketi
• Address: İkitelli OSB Mah. YTÜ İkitelli Teknopark Sk. Yıldız Teknik Üniversitesi Teknopark Blok No: 1 Iç Kapı No: 2B7 Başakşehir / İstanbul / Turkey
• E-mail: [email protected]
• KEP Address: [email protected]

Requests submitted to us shall be finalized as soon as possible and, in any event, within 30 (thirty) days at the latest pursuant to Article 13 of the KVKK. The Company reserves the right to request additional information or documentation to verify applicant identity where identity verification is required.