GENERAL DATA PROTECTION AND PRIVACY POLICY

This Privacy Policy explains how Nobium Bilgi Teknolojileri Ve Danışmanlık

Tic.A.S.(“Qumpara", "our", "us", and "we") collects, uses, and discloses information about

you. This Privacy Policy applies to information we collect when you use our website located at

http://www.nobium.com.tr ("Site") and related services (collectively, the "Platform Services")

or when you otherwise interact with us.

We may change this Privacy Policy from time to time. If we make changes, we will notify you

by revising the date at the top of the policy and, in some cases, we may provide you with

additional notice (such as adding a statement to our homepage or sending you a notification).

We encourage you to review this Privacy Policy before you use or submit any information on

or through the Platform Services to stay informed about our information practices and the ways

you can help protect your privacy. By using the Platform Services, you consent to the collection,

use, disclosure and sharing of your information as further outlined below in this Privacy Policy.

This Privacy Policy is provided as a part of our Terms of Services and applies to all users of the

Platform Services. You must agree to both this Privacy Policy and our Terms of Service in

order to use the Platform Services.

Key terms:

Anonymisation : The process of either encrypting or removing personal data from a database,

so that the individuals whom the data describe remain anonymous. This is done for the purpose

of protecting individuals’ private activities while maintaining the integrity of the data gathered

and shared.

Behavioural Advertising :The act of tracking users’ online activities and then delivering ads or

recommendations based upon the tracked activities.

Biometric Data : Personal data resulting from specific technical processing relating to the

physical, physiological or behavioural characteristics of a natural person, which allow or

confirm the unique identification of that natural person, such as facial images or dactyloscopy

data.

Chief Privacy Officer: The individual appointed by Qumpara globally to carry out certain

responsibilities and functions in respect of privacy and data protection.

Consent: Any freely given, specific, informed and unambiguous indication of the data subject’s

wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement

to the processing of personal data relating to him or her.

Cookies: A small text file stored on a user machine that may later be retrieved by a web server

from the machine. Cookies allow web servers to keep track of the end user’s browser activities,

and connect individual web requests into a session.

Data Enrichment : A process used to enhance, refine or otherwise improve existing data.

Data Processing: Any operation or set of operations which is performed on personal data, such

as collecting, recording, organizing, storing, adapting or altering, retrieving, consulting, using,

disclosing by transmission, dissemination or otherwise making the data available, aligning or

combining data, or blocking, erasing or destroying data. Not limited to automatic means.

Data Protection Officer: The individual appointed by Qumpara locally to carry out certain

responsibilities and functions in respect of privacy and data protection.

Data Retention : The policies and processes used within Qumpara for determining the time

period for archiving and storing of personal data.

Data Subject: The natural person that the personal data refers to.

Direct Marketing: A form of advertising in which companies provide physical marketing

materials to consumers to communicate information about a product or service.

Encryption: The method by which plaintext or any other type of data is converted from a

readable form to an encoded version that can only be decoded by another entity if they have

access to a decryption key.

GDPR: General Data Protection Regulation.

Genetic Data : Personal data relating to the inherited or acquired genetic characteristics of a

natural person which give unique information about the physiology or the health of that natural

person and which result, in particular, from an analysis of a biological sample from the natural

person in question.

Health Data: Personal data related to the physical or mental health of a natural person, including

the provision of health care services, which reveal information about his or her health status

International Organisation: An organisation and its subordinate bodies governed by public

international law, or any other body which is set up by, or on the basis of, an agreement between

two or more countries.

IP Address: A unique address that identifies a device on the Internet or a local network and

which allows a system to be recognized by other systems connected via the Internet protocol.

Online Behavioural Advertising: Websites or online advertising services that engage in the

tracking or analysis of, e.g., search terms, browser or user profiles, preferences, demographics,

online activity, offline activity, location data, and offer advertising based on that tracking.

Personal Data: Any information relating to an identified or identifiable individual. An

identifiable individual is one who can be identified, directly or indirectly, in particular, by

reference to an identification number or to one or more factors specific to his physical,

physiological, mental, economic, cultural or social identity.

Personal Data Breach: A breach of security leading to the accidental or unlawful destruction,

loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or

otherwise processed.

Privacy and Data Protection : The collection of laws and regulation that applies to the

collection, usage, storage, protection and other processing of personal data. This includes data

protection, privacy, banking secrecy, electronic communications and confidentiality laws and

regulations, and any other applicable laws or regulations to the extent they relate to privacy of

personal data.

Processor: A natural or legal person, public authority, agency or other body which processes

personal data on behalf of the controller.

Profiling: Any form of automated processing of personal data consisting of the use of personal

data to evaluate certain personal aspects relating to a natural person, in particular to analyse or

predict aspects concerning that natural person's performance at work, economic situation,

health, personal preferences, interests, reliability, behaviour, location or movements.

Pseudonymization: The processing of personal data in such a manner that the personal data can

no longer be attributed to a specific data subject without the use of additional information,

provided that such additional information is kept separately and is subject to technical and

organisational measures to ensure that the personal data are not attributed to an identified or

identifiable natural person.

Recipient: A natural or legal person, public authority, agency or another body, to which the

personal data are disclosed, whether a third-party or not. However, public authorities which

may receive personal data in the framework of a inquiry in accordance with regulations shall

not be regarded as recipients; the processing of those data by those public authorities shall be

in compliance with the applicable data protection rules according to the purposes of the

processing.

Restriction of Processing: The marking of stored personal data with the aim of limiting their

processing in the future.

Special Categories of Personal Data: Special categories of personal data, include: racial or

ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership,

genetic data, biometric data (for uniquely identifying an individual) and of data concerning

health, sex life or sexual orientation.

Third-Party: A natural or legal person, public authority, agency or body other than the data

subject, controller, processor and persons who, under the direct authority of the controller or

processor, are authorised to process personal data.

Collection of Information:

We may collect the following kinds of information about you through your use of the Site or

Platform Services:

Information You Provide Directly To Us.

We collect information you provide directly to us in the course of using the Platform Services,

including personally identifiable information. For example, we collect information when you

create an account on the Site, provide payment and billing information, provide identification

verification, participate in any interactive features of the Platform Services, fill out a form,

perform project and topic searches, post bids for projects, request customer support or otherwise

communicate with us. The types of information we may collect include your name, phone

number(s), email address, postal address, credit card or other billing information, date of birth,

taxpayer ID, and any other information you choose to provide. We may combine such

information with information we already have about you. We will use your billing information

linked to your Qumpara account for campaigns. The processing of campaigns will be subject

to the terms, conditions, and privacy policies of the campaign processor in addition to this

Privacy Policy and our Terms of Service.

Information We Collect Automatically

When you access or use the Platform Services, we automatically collect information about you,

including:

 Log Information: We collect log information about your use of the Platform Services,

including the type of browser you use, access times, pages viewed, your IP address, the

page you visited before navigating to the Platform Services, and Project bids.



 Device Information: We collect information about the computer or mobile device you

use to access the Platform Services, including the hardware model, operating system

and version, unique device identifiers and mobile network information.

Information Collected by Cookies and Other Tracking Technologies: We use

various technologies to collect information, including cookies and web beacons.

Cookies are small data files stored on your hard drive or in device memory that help us

improve the Platform Services and your experience, see which areas and features of the

Platform Services are popular and count visits. Web beacons are electronic images that

may be used in the Platform Services or emails and help deliver cookies, count visits

and understand usage and campaign effectiveness. For more information about cookies,

and how to disable them, please see "Cookies" below.

Information We Collect From Other Sources

We may also obtain information from other sources and combine that with information we

collect through the Platform Services. For example, we may collect information about you from

third parties, including but not limited to identity verification services, credit bureaus, mailing

list providers, publicly available sources, and prohibited persons lists.

How We Use Your Information

We may use information about you for various purposes, including to:

 Provide, maintain, and improve the Platform Services;

 Provide our services, process transactions, and send you related information, including

confirmations and invoices;

 Match Qumpara clients with users of the Site;

 Send you technical notices, updates, security alerts, and support and administrative

messages;

 Ensure compliance with our Terms of Service, including but not limited to identifying

and preventing misuse, inappropriate behavior, fraud, or any criminal activity;

 Respond to your comments, questions and requests and provide customer service;

 Communicate with you about products, services, offers, promotions, rewards, and

events offered by Qumpara and others, and provide news and information we think will

be of interest to you;

 Monitor and analyze trends, usage and activities in connection with the Platform

Services;

 Personalize and improve the Platform Services and provide advertisements, content or

features that match user account profiles or interests;

 Link or combine with information we get from others to help understand your needs and

provide you with better service; and

 Carry out any other purpose described to you at the time the information was collected.

How We Share Your Information

We may share information about you as follows or as otherwise described in this Privacy Policy

 With vendors, consultants, third party payment processors and other service providers

who need access to such information to carry out work on our behalf;



 With third parties for their own services and marketing purposes, unless you opt out of

this type of sharing by logging into your Qumpara account and updating your account

settings;

In response to a request for information if we believe disclosure is in accordance with,

or required by, any applicable law, regulation or legal process;

If we believe your actions are inconsistent with our user agreements or policies, or to

protect the rights, property and safety of Qumpara or others;

In connection with, or during negotiations of, any merger, sale of company assets,

financing or acquisition of all or a portion of our business by another company;





 Between and among Qumpara and our current and future parents, affiliates, subsidiaries

and other companies under common control and ownership; and

 With your consent or at your direction.

We may also share aggregated or de-identified information, which cannot reasonably be used

to identify you.

Advertising and Analytics Services

We may allow others to provide analytics services and serve advertisements on our behalf

across the Internet and in applications. These entities may use cookies, web beacons, device

identifiers and other technologies to collect information about your use of the Platform Services

and other websites and applications, including your IP address, web browser, mobile network

information, pages viewed, time spent on pages or in apps, links clicked and conversion

information. This information may be used by Qumpara and others to, among other things,

analyze and track data, determine the popularity of certain content, deliver advertising and

content targeted to your interests on the Platform Services and other websites and better

understand your online activity. You may also opt-out of having your information used for

advertising purposes by logging into your Qumpara account and updating your account settings.

Modifying and Reviewing your Data:

You have the right to review, change and delete information about you at any time. You can do

so by editing your profiles on the Site or emailing us at [email protected] Deleting all your

information may result in account deactivation. You can choose to have your account deleted

from the system by emailing [email protected], but note that we may retain certain

information as required by law or for legitimate business purposes. We may also retain cached

or archived copies of information about you for a certain period of time.

Data Security:

We take the protection of your information seriously and use reasonable measures designed to

help protect your information from loss, theft, misuse and unauthorized access, disclosure,

alteration and destruction. You should understand that no data storage system or transmission

of data over the Internet or any other public network can be guaranteed to be 100% secure.

Please note that information collected by third parties may not have the same security

protections as information you submit to us, and we are not responsible for protecting the

security of such information. Additionally, we are not responsible for the confidentiality of any

information and content created and shared between users of the Site when they agree to share

any such information. Users who choose to share any information with other users of the Site

are responsible for maintaining the privacy and security of that data in accordance with our

Terms of Service.

Cookies:

Most web browsers are set to accept cookies by default. If you prefer, you can usually choose

to set your browser to remove or reject browser cookies. Removing or rejecting browser cookies

does not necessarily affect third party flash cookies used in connection with the Platform

Services. Please note that if you choose to remove or reject cookies, this could affect the

availability and functionality of the Platform Services.

Links to Other Websites and Applications:

There may be links to other websites and applications on the Site, but the inclusion of these

links does not represent our endorsement, authorization or affiliation with the other websites or

applications. This Privacy Policy and our Terms of Service do not cover any third party

applications or websites. Users should consult the terms and conditions of third party websites

or applications to understand their privacy policies and how they collect and use your

information.

Do-Not-Track Signals and Similar Mechanisms

Some web browsers transmit "Do-Not-Track" signals to websites. The Site does not currently

respond to browser "Do-Not-Track" requests.

Marketing E-Mails:

We may send you periodic promotional or informational e-mails. You may opt-out of such

communications by following the opt-out instructions contained in the e-mail. Please note that

it may take up to 5 business days for us to process opt-out requests. If you opt-out of receiving

e-mails about recommendations or other information we think may interest you, we may still

send you e-mails about your account on the Site or the Platform Services.

Your Turkish Data Protection Rights:

Turkish law permits residents and/or citizens of Turkish Republic to request certain details

about how their information is shared with third parties for direct marketing purposes. If you

are a Turkish Republic resident and would like to opt-out of having your information shared

with third parties for direct marketing, please log in to your Qumpara account and update your

preferences in your account settings.

Data Retention:

The time periods for which we retain your personal information will depend on the purposes

for which we use it. We will retain your personal information for so long as is necessary to

provide the Platform Services, unless applicable law requires we either dispose of it or keep it

longer. We may also continue to store your personal information to allow us to resolve disputes,

enforce our agreements, comply with legal obligations and/or for other legally permissible

purposes consistent with this Privacy Policy and our Terms of Service

Children’s Privacy:

No part of the Platform Services or Site is directed to persons under 18 years of age. We do not

knowingly allow individuals under the age of 18 to create accounts that allow access to the

Platform Services.

Contact Us:

If you have any questions about this Privacy Policy, please contact us at: [email protected]