ANGELYLMZ D.O.O. PERSONAL DATA PROTECTION POLICY

(Compliant with KVKK, GDPR, and relevant international regulations)

Effective Date: 09.04.2026

Version: 1.0

Last Update: 09.04.2026

1) Purpose

The purpose of this policy is to establish procedures for the protection of personal data processed by AngelYlmz d.o.o. (“AngelYlmz” or the “DATA CONTROLLER”) under Law No. 6698 on the Protection of Personal Data (KVKK), GDPR, and other applicable national and international regulations. It aims to safeguard privacy, fundamental rights and freedoms, and define the responsibilities of all persons, institutions, and organizations in legal, commercial, and financial relations with AngelYlmz.

2) Scope

This policy applies to all personal data processed wholly or partially by automated means, or as part of a data recording system by non-automated means, belonging to customers, potential customers, employees, candidates, visitors, suppliers, business partners, and any other third parties who have a relationship with AngelYlmz. It covers all categories of personal data, storage-destruction activities, and data transfer processes conducted by AngelYlmz.

3) Definitions and Abbreviations

Key terms used in this Policy are defined below. Where not defined, relevant legislation shall apply.

• KVKK: Law No. 6698 on the Protection of Personal Data (Turkey).
• GDPR: EU Regulation 2016/679 (General Data Protection Regulation).
• KVK Board / Authority: Turkish Personal Data Protection Board / Authority.
• VERBIS: Data Controllers Registry Information System.
• Data Subject: The natural person whose personal data is processed.
• Data Controller: The natural or legal person determining purposes and means of processing personal data (AngelYlmz d.o.o.).
• Data Processor: The natural or legal person processing data on behalf of the controller.
• Special Categories of Personal Data: Sensitive data defined under Article 6 of the KVKK.
• Anonymization, Deletion, Destruction: Procedures ensuring data cannot be accessed or restored.
• Notification / Clarification: Information provided to the data subject under Article 10 of the KVKK.
• Adequacy Decision: A decision issued by the KVK Board under the Regulation on Cross-Border Data Transfers.

4) Data Controller and Contact Details

AngelYlmz d.o.o.

• Company Type: Limited (d.o.o.)
• Address: 19 V Proleterske Brigade, Podgorica 81000, Montenegro
• Phone: +382 68 093 839
• WhatsApp: +382 68 798 836
• E-mail: info@angelandangels.com
• Website: https://angelandangels.com
• Company Owner: Melek Yılmaz

5) Fundamental Principles of Data Processing

AngelYlmz adheres to the following basic principles when processing personal data:

• Lawfulness and fairness
• Accuracy and up-to-dateness when necessary
• Processing for specific, explicit, and legitimate purposes
• Relevance, limitation, and proportionality to the purpose
• Retention only for the necessary period

6) Legal Grounds for Processing

According to Article 5 of the KVKK, personal data may be processed under the following circumstances:

• Explicit consent of the data subject,
• Where explicitly permitted by law,
• Where processing is necessary to protect life or physical integrity and consent cannot be obtained,
• Processing necessary for contract establishment or performance,
• Fulfillment of the controller's legal obligation,
• Data made public by the data subject,
• Establishment, exercise, or defense of a legal right,
• Processing required for the legitimate interests of the controller.

7) Processing of Special Categories of Personal Data

Special categories of personal data may only be processed under the conditions stated in Article 6 of the KVKK, such as:

• Explicit consent of the data subject,
• Cases explicitly provided by law,
• Protection of public health, medical diagnosis, treatment, and management of healthcare services,
• Obligations related to occupational health, social security, or public welfare.

AngelYlmz implements additional safeguards defined by the KVK Board for sensitive data.

8) Obligation to Inform

AngelYlmz fulfills its information obligation by providing the following to data subjects:

• Identity of the data controller,
• Purposes of processing,
• Possible data recipients,
• Collection method and legal grounds,
• Rights of the data subject.

9) Purposes of Data Processing

AngelYlmz processes personal data for:

• Service delivery, management, and improvement,
• Execution of contracts,
• Financial, accounting, and invoicing activities,
• Communication and customer relationship management,
• Compliance with legal obligations,
• Informing competent authorities,
• Security and audit operations.

10) Data Transfer

10.1. Domestic Transfer

Personal data may be transferred to third parties within Türkiye under Article 8 of the KVKK, based on explicit consent or other legal conditions.

10.2. International Transfer

Data may be transferred abroad in accordance with Article 9 of the KVKK and the Regulation on Cross-Border Data Transfers, if the target country has an adequacy decision or appropriate safeguards are ensured. If no adequacy decision exists, AngelYlmz obtains authorization from the KVK Board before transfer.

11) Retention, Deletion, Destruction, and Anonymization

Personal data are retained as long as necessary for the purpose of processing. Once the purpose ceases or the retention period expires, data are deleted, destroyed, or anonymized in accordance with applicable regulations.

12) Data Security

AngelYlmz takes all necessary technical and organizational measures to prevent unlawful processing and access, ensure secure storage, and protect data from alteration, loss, damage, or unauthorized disclosure. In the event of a data breach, both the data subject and the KVK Board are notified as soon as possible.

13) Rights of Data Subjects

Under Article 11 of the KVKK, the data subject has the right to:

• Learn whether their data are processed,
• Request information if processed,
• Learn the purpose of processing and its compliance,
• Know domestic or foreign third parties to whom data are transferred,
• Request correction of incomplete or inaccurate data,
• Request deletion or destruction of data,
• Request notification of third parties,
• Object to automated processing decisions,
• Claim compensation for damages.

14) Application Procedure and Response Period

Data subjects may submit requests through the following channels:

• E-mail: info@angelandangels.com
• Post: AngelYlmz d.o.o., 19 V Proleterske Brigade, Podgorica 81000, Montenegro

Applications are processed within 30 days at the latest.

15) Enforcement and Updates

This policy entered into force on 09.04.2026. It may be revised as required by legislative or operational changes. The latest version will always be available at https://angelandangels.com.

AngelYlmz d.o.o.
Address: 19 V Proleterske Brigade, Podgorica 81000, Montenegro
E-mail: info@angelandangels.com
Web: https://angelandangels.com