Customer Privacy Notice

1. Data Controller

Within the scope of the Law No. 6698 on the Protection of Personal Data (“KVKK”), your personal data may be processed by Blueprint Teknoloji (“Blueprint” or the “Company”), acting as the data controller, within the scope described below.

At Blueprint, we value the privacy and security of your personal data and take care to process such data lawfully and fairly, for specified, explicit and legitimate purposes, in a manner that is relevant, limited and proportionate to the purposes for which it is processed.

This Privacy Notice has been prepared to inform our customers, prospective customers, employees and representatives of our customers, representatives of our business partners, and other natural persons who contact Blueprint in connection with our services about how their personal data is processed.

2. Personal Data We Process

Depending on the nature of your relationship with Blueprint and the services used, the following categories of personal data may be processed:

Identity Information

Name, surname, title, position and similar identification information.

Contact Information

Telephone number, e-mail address, company contact details, address and information relating to other communication channels used by you.

Customer and Transaction Information

Information relating to requested or provided services, proposals, contracts, projects, business processes, meetings, support requests and customer relationships.

Financial Information

To the extent required by the relevant service or contractual relationship, invoice, payment, collection and other financial transaction information.

Communication and Request Records

Correspondence, requests, feedback and complaints submitted to Blueprint via e-mail, telephone, contact forms, meetings, support systems or other communication channels.

Digital Transaction and Technical Data

IP address, access and log records, device and browser information, session information, security records and technical information relating to Website usage.

For detailed information regarding personal data processing activities carried out through cookies and similar technologies used on our Website, please refer to our Cookie Policy.

Blueprint does not request the sharing of special categories of personal data unless required by the nature of the relevant service. Where the processing of such data is necessary, the conditions and appropriate security measures prescribed under applicable legislation are implemented.

3. Purposes of Processing Personal Data

Depending on the nature of your relationship with Blueprint, your personal data may be processed for the following purposes:

• Providing, carrying out and improving our products and services,
• Receiving, evaluating and responding to customer requests,
• Carrying out project, software, design, consultancy, maintenance, support and other service processes,
• Managing proposal, order, contract and customer relationship processes,
• Communicating with our customers and ensuring service coordination,
• Planning and monitoring meetings, projects and support processes,
• Providing technical support, maintenance and service continuity,
• Improving service quality and customer experience,
• Evaluating requests, suggestions and complaints,
• Carrying out information technology, system, network and information security processes,
• Preventing and detecting unauthorised access, misuse and security breaches,
• Carrying out finance, accounting, invoicing and collection processes,
• Fulfilling legal processes and contractual obligations,
• Responding to lawful requests from authorised institutions and authorities,
• Ensuring that Company activities are carried out in compliance with applicable legislation,
• Protecting and exercising the Company’s legal and commercial rights,
• Fulfilling retention, notification and audit obligations arising from applicable legislation.

Where marketing or commercial electronic communication activities are carried out, the necessary permission and consent processes are implemented in accordance with applicable legislation to the extent required by the relevant activity.

4. Methods of Collecting Personal Data

Your personal data may be collected through:

• The Blueprint Website,
• Contact and quotation forms,
• E-mail,
• Telephone,
• Online or physical meetings,
• Contracts and proposal processes,
• Customer support and project management systems,
• Corporate information technology systems used by the Company,
• Business partners and service providers,
• Other information and documents provided to us electronically or physically.

Personal data may be obtained by fully or partially automated means or by non-automated means, provided that the data forms part of a data filing system.

5. Legal Grounds for Processing Personal Data

Your personal data is processed pursuant to the legal grounds set out under Articles 5 and, where applicable, 6 of the KVKK, depending on the specific processing activity.

The primary legal grounds include:

• Processing being expressly provided for by law,
• Processing being necessary for the establishment or performance of a contract, provided that it is directly related to the parties to the contract,
• Processing being necessary for Blueprint to fulfil its legal obligations,
• Processing being necessary for the establishment, exercise or protection of a right,
• Processing being necessary for the legitimate interests of Blueprint, provided that such processing does not violate the fundamental rights and freedoms of the data subject,
• Your explicit consent, where required under applicable legislation.

Where explicit consent is used as the legal basis for processing, such consent is obtained separately from this Privacy Notice, and refusal to provide explicit consent does not prevent you from benefiting from services that do not depend on such consent.

6. Transfer of Personal Data

For the purposes described above and to the extent permitted under applicable legislation, your personal data may be transferred to:

• Authorised public institutions and organisations,
• Courts, enforcement offices and other judicial or administrative authorities,
• Financial advisors, auditors, lawyers and other professional consultants,
• Information technology, hosting, infrastructure, security, communication and support service providers,
• Banks and financial institutions,
• Suppliers, subcontractors and business partners to the extent required by business processes.

Where a transfer takes place, the principle of data minimisation is observed and only the personal data necessary for the relevant service or transaction is shared.

7. Transfer of Personal Data Abroad

The infrastructure of certain information technology, cloud computing, communication, e-mail, analytics, project management, file-sharing or similar services used by Blueprint may be located outside Türkiye.

Where the use of such services results in a transfer of personal data abroad, such transfers are carried out in accordance with Article 9 of the KVKK and applicable legislation governing international transfers of personal data, using the appropriate mechanism available under the legal framework, including adequacy decisions, appropriate safeguards, standard contracts or other transfer mechanisms provided under applicable legislation.

Blueprint evaluates service providers and supplier relationships involving international data transfers in terms of data protection obligations and applies appropriate contractual, technical and administrative security measures to the extent possible.

8. Retention of Personal Data

Your personal data is retained for:

• The period necessary for the purposes for which it is processed,
• The duration of the relevant contractual or customer relationship,
• The statutory retention periods prescribed under applicable legislation, and
• The period necessary for the establishment, exercise or protection of rights in the event of a potential legal dispute.

Where the applicable retention period expires and no other legal basis exists for the continued processing of personal data, such data is deleted, destroyed or anonymised in accordance with applicable legislation.

9. Security of Personal Data

Blueprint applies reasonable and necessary technical and administrative measures to:

• Prevent the unlawful processing of personal data,
• Prevent unlawful access to personal data,
• Prevent the loss, alteration or unauthorised disclosure of personal data,

and to ensure an appropriate level of security.

Such measures may include access authorisations, user and system security controls, recording and logging mechanisms, up-to-date security technologies, backups, access restrictions, contractual confidentiality obligations and employee awareness measures.

10. Your Rights Under the KVKK

Under Article 11 of the KVKK, you have the right to apply to Blueprint and:

• Learn whether your personal data is being processed,
• Request information if your personal data has been processed,
• Learn the purpose of processing and whether your personal data is being used in accordance with that purpose,
• Learn the third parties to whom your personal data has been transferred in Türkiye or abroad,
• Request correction where your personal data has been processed incompletely or inaccurately,
• Request the deletion or destruction of your personal data where the conditions prescribed by law are met,
• Request that correction, deletion or destruction operations be notified to third parties to whom your personal data has been transferred,
• Object to a result arising against you as a result of the analysis of processed data exclusively through automated systems,
• Request compensation if you suffer damage as a result of the unlawful processing of your personal data.

11. How Can You Exercise Your Rights?

You may submit your requests under the KVKK to Blueprint using the following details:

Data Controller: Blueprint Teknoloji

E-mail: hi@blueprint.com.tr

or through other methods prescribed under applicable legislation.

Your application should include:

• Your name and surname,
• Your signature, if the application is submitted in writing,
• Your Turkish ID number if you are a citizen of the Republic of Türkiye; for foreign nationals, your nationality, passport number or identification number, if applicable,
• Your residential or business address for notification purposes,
• Your e-mail address, telephone number and fax number, if applicable,
• The subject matter of your request.

Your application will be concluded as soon as possible depending on the nature of your request and within the period prescribed by applicable legislation.

12. Updates to This Privacy Notice

Blueprint may update this Privacy Notice in line with changes to applicable legislation, personal data processing activities, technologies used or service processes.

The most current version of this notice will always be published at www.blueprint.com.tr.