INFORMATION STATEMENT REGARDING THE PROCESSING OF PERSONAL DATA IN ACCORDANCE WITH THE LAW ON THE PROTECTION OF PERSONAL DATA NUMBER 6698

Data Controller

This Clarification Text is the Communiqué on the Procedures and Principles to be Complied with in the Fulfillment of the Clarification Obligation published in the Official Gazette dated 10.03.2018 and numbered 30356, the Law on the Protection of Personal Data No. 6698 (“KVKK”) published in the Official Gazette dated 07.04.2016 and numbered 29677. (“Communiqué”) and other relevant legislation, established in accordance with Turkish Laws and headquartered in Yenibosna Merkez Mh. Ladin Sk. No:4M Kuyumcukent AVM Z030 D:72 Bahçelievler, Istanbul, registered in the Istanbul Trade Registry with the registration number 149207-5, Aga Kıymetli Madenler Anonim Şirketi (“AGA”)”) was prepared by As AGA, we inform you that we protect your personal data and process this data in accordance with the relevant legislation. In cases where AGA has the title of data controller and/or data processor pursuant to KVKK and other legislation, it processes this data only within the scope specified below.

AGA’ya aşağıdaki iletişim bilgilerinden ulaşabilirsiniz.

Address: Yenibosna Merkez Mh. Ladin Sk. No:4M Kuyumcukent AVM Z030 D:72 Bahcelievler, Istanbul

Phone: +90 212 603 04 81

Website: https://www.agabullion.com/

E-Mail Address: info@agabullion.com

Your Processed Personal Data

As a result of your use of AGA services and products through the website, the following personal data (but not limited to) may be processed by AGA as a "Data Controller":

• Name, surname, TR ID number,
• E-mail address, address and telephone number,
• Your website membership password,
• The product information you purchased,
• Information about your payment method and payment instrument,
• IP address, date and time of submitting the form.

Purpose of Processing Your Personal Data

Your personal data,

• Presenting and delivering our products and services to our customers and making promotions and other information,
• Managing business relations and customer processes,
• Gathering information on a specific subject,
• Responding to or following up on comments or questions that our customers have sent us
• Sending relevant notices and/or newsletters and/or any marketing communications to our customers,
• Collecting comments on our services or products offered by AGA,
• Analyzing customer satisfaction regarding our services and products offered by AGA, conducting surveys and customer satisfaction surveys and all kinds of communication in order to provide services within this scope,
• Evaluation of customer complaints and suggestions,
• Developing, diversifying and increasing the quality of the services and products offered in line with the needs of our customers,
• In terms of suppliers and business partners; contacting potential suppliers and business partners, realizing contract processes, invoicing, analysis and reporting for our services and products, registration in systems, identity verification,
• Resolving legal disputes,
• Fulfilling all kinds of legal obligations,
• To use the rights arising from the current legislation,
• Prevention of fraud and false statement,
• Meeting information requests from administrative and judicial units,
• Marketing the product during the development and management of our current and R&D applications,
• Job application and human resources applications,

processed for such purposes. AGA acts in accordance with the obligations stipulated in all relevant legislation, especially the KVKK.

Collection Method and Legal Reason of Your Personal Data

Your personal data, by AGA through different channels, verbally, in writing or electronically and based on the above-mentioned purposes, for the purpose of carrying out activities; In order to develop the products and services we offer and to carry out our commercial activities, it is processed verbally, in writing or electronically, through automatic or non-automatic methods, through the call center, website, etc.

Personal Data, within the scope of KVKK and other relevant legislation (i) clearly stipulated in the laws, (ii) it is necessary to process the personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract, (iii) it is mandatory for the data controller to fulfill its legal obligations , (iv) can be processed without the consent of the personal data owner for one or more of the reasons that the data subject has been made public by himself.

In case of entering into a commercial or legal relationship with AGA in any way, Personal Data is required by AGA to process the personal data of the parties to the contract, provided that it is directly related to the conclusion or performance of a contract specified in the 2nd paragraph of Article 5 of the KVKK (i) ”, (ii) “It is mandatory for the data controller to fulfill its legal obligation”, (iii) “The data subject has been made public by himself”, (iv) “Data processing is mandatory for the establishment, exercise or protection of a right” and (v) “Provided that it does not harm the fundamental rights and freedoms of the person concerned,It is processed automatically by filling out an application or request form in the electronic environment, provided that it does not violate the fundamental rights and freedoms of the data subject based on legal reasons.

If the user logging into the website does not have a previously obtained explicit consent; Obtaining express consent as required by legal obligation for Personal Data processed, which does not fall within one of the reasons for compliance with the law in paragraph 2 of Article 5 of the KVKK, but is limited to AGA's ability to offer products and services and to the security of the user who accesses the website. required. In this case, we inform you that such express consent can be given electronically, with the same legal nature and value as the written consent. You can review the information text on the processing of personal data in electronic environment and give your express consent statement by instant notification on SMS, e-mail and website.

Sharing and Transferring Your Personal Data

Your Personal Data is shared with third parties only with your explicit consent and Personal Data is not transferred to third parties without your explicit consent.

AGA may share and transfer your Personal Data to one of the databases of group companies, affiliates, business partners or one of its external partners located abroad. As data protection levels vary around the world, we may only transfer your Personal Data to group companies or third-party companies outside the European Union if they maintain at least the same level of personal protection.

Personal Data processed by AGA may be shared with our business partners, company partners and company officials in order to fulfill their legal obligations.

Personal Data provided by the Company for the above-described methods and purposes, provided that adequate and effective measures are taken in accordance with the security and confidentiality principles set forth in the KVKK and relevant legislation; Within the framework of AGA's legal obligations and limited to these, the execution of AGA's activities and limited to the above-mentioned purposes by AGA; Third parties, including legal consultants, tax consultants, with whom we have a contract with domestic or foreign group companies, our business partners, shareholders, customers with whom we have contracted and served as required by our activities, to resolve legal disputes or to the Social Security Institution in case of request in accordance with the relevant legislation, General Directorate of Security and other law enforcement forces, authorized public institutions and organizations,

AGA takes necessary technical and legal measures to prevent any violation of rights during data transfer to third parties. In this context, AGA is not responsible for violations that occur in the risk area under the responsibility of the third party, due to the data protection policies of the third party receiving the Personal Data.

Personal Data transfers can be made to countries where it is determined and declared that there is no adequate protection by the Personal Data Protection Board, provided that the data controllers in Turkey and the relevant foreign country undertake an adequate protection in writing and the permission of the Personal Data Protection Board can be obtained for the relevant transfer. will be possible.

Your Rights Under Article 11 of KVKK

On the Personal Data processed by AGA, within the scope of Article 11 of the KVKK, without prejudice to the cases stipulated in Article 28 of the KVKK titled “Exceptions”;

• Learning whether your personal data is processed,
• Requesting information regarding the processing of your personal data,
• Learning the purpose of processing personal data and whether they are used in accordance with its purpose,
• Learning the third parties to whom personal data is transferred at home or abroad,
• Requesting correction of your personal data if it is incomplete or incorrectly processed,
• Requesting the deletion or destruction of your personal data in case the reasons for processing disappear,
• Requesting that your corrected, deleted or destroyed personal data be notified to third parties,
• Objecting to the emergence of a result against you by analyzing your processed data exclusively through automated systems,
• Requesting the compensation of the damage in case your personal data is damaged due to unlawful processing

In order to exercise your above-mentioned rights, your request, which includes the necessary information to identify you and your explanations about your right that you want to exercise from the rights specified in Article 11 of the KVKK, must be submitted in writing and with wet signature or by other methods to be determined by the Personal Data Protection Board. Yenibosna Merkez Mh. Ladin Sk. No:4M Kuyumcukent AVM Z030 D:72 Bahçelievler, Istanbul by hand, send it via a notary public or other methods specified in the KVKK.

We kindly request you to include the following elements in your application:

• Name, surname and wet signature.
• Turkish identity number for citizens of the Republic of Turkey, nationality, passport number or identity number, if any, for foreigners.
• Domicile or workplace address for notification.
• If available, the e-mail address, telephone and fax number for notification.
• Demand.

Your requests in your application will be concluded free of charge by AGA as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request. However, if the transaction requires a separate cost for AGA, the fee in the tariff determined by the Personal Data Protection Board will be charged. In case the application is caused by the fault of AGA, the fee collected will be returned to the relevant person.

This Clarification Text was prepared on 15.06.2021 and was last updated on 15.06.2021_. In case of any change in the Clarification Text, the effective date and content of this Clarification Text will be updated by AGA and will enter into force immediately.

We report as "Data Controller" within the scope of KVKK.

AgaBullion Precious Metals Inc.

Acceptance and Declaration

In accordance with Article 10 of the KVKK, titled “Information Obligation of the Data Controller”, by whom and for what purpose my personal data will be processed, to whom and for what purpose the processed personal data can be transferred, the method and legal reason for collecting personal data and my rights in Article 11 of the KVKK. I accept and declare that I have read and understood this Clarification Text prepared and that I have been informed in detail by AGA, which is the data controller.