As Nar Bulut Information Technologies Industry and Trade Inc. (“Nar Bulut Bilgi Teknolojileri San. Ve Tic. A.Ş.”) (“Narbulut”), we are committed to safeguarding the privacy of our members who use our services on our website to ensure their secure and seamless utilization of our services. In this regard, this Narbulut Privacy Policy (“Policy”) has been prepared to ensure the complete compliance of our members’ personal data processing with the Personal Data Protection Law No. 6698 (“Law”) and to inform our users in this context. The cookie policy of narbulut.com is an integral part of this Policy.

The purpose of this Policy is to determine the terms and conditions for the use of personal data shared with Narbulut by members/visitors/users (hereinafter referred to as “Data Owners”) of the www.narbulut.com website, agents and mobile application (collectively named as “Narbulut: Backup & Drive”) (hereinafter referred to as “Platform”), which is operated by Narbulut, during the operation of the Platform.

Which Data Is Processed?

The following are the data that are processed by Narbulut and are considered personal data under the Law. Unless otherwise explicitly stated, the term “personal data” in the provisions and conditions provided under this Policy will include the following information:

• Identity Information
• Contact Information
• User Information
• User Transaction Information
• Transaction Security Information
• Financial Information
• Marketing Information
• Request/Complaint Management Information

Data that have been rendered anonymous in a way that cannot be reversed in accordance with Articles 3 and 7 of the Law on the Protection of Personal Data will not be considered personal data under the provisions of the said law, and processing activities relating to such data will be carried out without being bound by the provisions of this Policy.

Purposes of Processing Personal Data

Narbulut processes personal data provided by Data Owners for various purposes. This includes the creation and maintenance of member accounts, records, and the facilitation of Data Owners in benefiting from Platform services. The company engages in activities to detect system errors, track performance, enhance Platform functionality, and provide maintenance, support, and backup services. Additionally, Narbulut’s business units undertake efforts to customize products and services based on the preferences, usage habits, and needs of individuals. These tailored offerings are recommended and promoted through planned activities. Furthermore, Narbulut processes personal data to carry out its commercial activities, ensure legal, technical, and commercial-business security for both Narbulut and its business partners, and to strategize and execute Narbulut’s commercial and/or business plans.

Personal Data to be Processed with the Explicit Consent of Data Owners and Processing Purposes

With the explicit consent of the Data Owner, Narbulut may process personal data to enhance user experience by tracking Data Owners’ activities on the Platform. This includes activities such as creating statistics, profiling, direct marketing, remarketing, generating personalized promotional offers, and communicating them to the Data Owner. In this context, the data obtained may be utilized in various advertising and material content, and Narbulut may share this data with the parties mentioned below.

Transfer of Personal Data:

Narbulut may transfer personal data belonging to the Data Owner, as well as new data obtained using this personal information, to third parties limitedly for the purpose of achieving the objectives defined in this Privacy Policy. Narbulut may share personal data for the improvement of the Data Owner’s experience (including improvement and personalization), ensuring the security of the Data Owner, detecting fraudulent or unauthorized uses, conducting operational evaluation research, addressing errors related to Platform services, and achieving any of the purposes specified in this Privacy Policy. Third parties with whom Narbulut may share data include external service providers, including those sending SMS messages, hosting service providers, legal offices, research companies, call centers, among others.

Personal data may be shared with Narbulut and Narbulut Company officials, shareholders, business partners, suppliers, legally authorized public institutions and organizations, and legally authorized private institutions within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law. This sharing may be limited to the methods and principles indicated in Article 9 of the Law and decisions of the Personal Data Protection Board, and may also involve the transfer of data abroad.

Method of Personal Data Collection and Legal Basis

Personal data is collected through the Platform and electronically. The personal data collected for the reasons mentioned above may be processed and transferred for the purposes specified in this Privacy Policy in accordance with Articles 5 and 6 of Law No. 6698.

Rights of the Personal Data Owner

In accordance with Article 11 of the Law, data owners have the right to:

• Learn whether their personal data is being processed, and request information if their personal data has been processed.
• Learn the purpose of processing personal data and whether they are used in line with that purpose, and be informed of third parties to whom personal data is transferred, domestically or abroad.
• Request the correction of incomplete or inaccurate personal data and, in this context, request the notification of the transaction to third parties to whom the personal data has been transferred.
• Request the deletion or destruction of personal data in case the reasons requiring the processing of personal data have disappeared, even though it has been processed in compliance with the law, and request the notification of this process to third parties to whom the personal data has been transferred.
• Object to the occurrence of a result against oneself by means of the exclusive analysis of the processed data through automated systems and, in the event of damage due to the unlawful processing of personal data, demand the remedy of the damage.

Requests related to the exercise of these rights can be submitted by the data owners through the methods specified in the Personal Data Processing and Protection Policy prepared by Narbulut under Law No. 6698, which is available at www.narbulut.com. Narbulut reserves the right to charge a fee, if any, determined by the Personal Data Protection Board for these requests and will conclude such requests within thirty days.”

Data Access and Usage:

Our application, upon user request, accesses and processes the following user data to provide the best user experience and ensure data backup functions:

Contacts: Optionally, we provide access to back up contact information on users’ devices. Contact information is stored encrypted on our cloud servers to facilitate user restoration at any time.

Photos and Videos: Optionally, we provide access to back up photos and videos on users’ devices. Photos and videos are stored encrypted on our cloud servers to facilitate user restoration at any time.

Audio and Other Files: Optionally, we provide access to back up audio and other files (documents, app data, etc.) on users’ devices. Audio and other files are stored encrypted on our cloud servers to facilitate user restoration at any time.

Device and Other Identity Information: To ensure the functionality of our application and optimize the user experience, we collect mandatory information such as device identity, model, operating system version, and similar details. This information is used to monitor the performance and compatibility of our application, troubleshoot errors, and enhance our application. Unlike other backup data, the collection of this information is not optional and is necessary to use the application.

Data access and usage are carried out only for the purposes stated above, and we respect our users’ privacy. We implement industry-standard security measures during data processing and storage. Users’ data is not shared with third parties and is used solely by our application, except with the explicit consent of the users.

Deletion of Data and/or User Account:

Deletion of Data: Optionally backed up data can be deleted at the user’s request through the application. Deleted data is stored in the recycle bin for 60 days as a precaution against possible user errors. After this period, if the data in the recycle bin is not restored by the user, it is permanently deleted and cannot be recovered.

Deletion of User Account: As a precaution against possible user errors, the user account is deactivated for 60 days from the expiration of the license. After this period, if the user has not renewed the license, the user account and associated data are automatically deleted and cannot be recovered.