KVKK

INFORMATION NOTICE ON PHOTOGRAPHY AND VIDEO RECORDINGS

Pursuant to the Law No. 6698 on the Protection of Personal Data

1. Data Controller
Pursuant to the Law No. 6698 on the Protection of Personal Data (“KVKK”), your personal data may be processed by CoBAC Workspace Ofis Hizmetleri A.Ş. (“CoBAC”), acting as the data controller, within the scope, for the purposes, and on the legal grounds explained below.

CoBAC implements appropriate technical and administrative measures to ensure that personal data is processed lawfully and fairly, for specific and legitimate purposes, in a manner that is connected with, limited to, and proportionate to such purposes, and securely retained for the necessary period.

2. Scope of This Notice
This Information Notice concerns photographs and video recordings made for promotional, corporate communication, and marketing purposes during events, organizations, community activities, and similar activities organized by CoBAC or held at CoBAC premises.

Closed-circuit television (“CCTV”) systems and recordings used for security purposes are outside the scope of this Notice. Security camera activities are addressed separately within the framework of their respective purposes and legal grounds.

3. Personal Data Processed
Depending on the nature of the relevant activity, the following visual and audio personal data may be processed:

Photographs and visual recordings
Video recordings
Physical appearance, where visible in the image
Voice and audio recordings, where audio is included in the video recording
This Notice does not replace the general information notices concerning identity, contact, membership, customer, transaction security, or request and complaint data processed within the scope of CoBAC’s other activities.

4. Purposes of Processing Personal Data
Photographs, videos, and, where applicable, audio recordings may be processed, subject to the provision of explicit consent and limited to the scope of the relevant selection, for the following purposes:

Promoting CoBAC’s activities, workspaces, community activities, and events
Preparing announcements, summaries, and promotional content relating to events and organizations
Publishing content on CoBAC’s website and digital communication channels controlled by CoBAC
Publishing organic content on CoBAC’s corporate social media accounts
Conducting CoBAC’s corporate promotional, brand communication, marketing, and advertising activities
Personal data will not be processed for general or unspecified purposes unrelated to the purposes stated above. If a new and different processing purpose arises, the data subject will be provided with the necessary information separately and, where required, separate explicit consent will be obtained.

5. Method of Collection of Personal Data
Your personal data may be obtained automatically or non-automatically in CoBAC common areas, during events and organizations, during photography and video recording activities, through authorized photography and video service providers acting on behalf of CoBAC, or during the transfer of relevant content to CoBAC’s digital systems.

6. Legal Basis for Processing Personal Data
The processing of photographs, videos, and, where applicable, audio recordings covered by this Information Notice for use on CoBAC’s website, corporate social media accounts, promotional, marketing, advertising, and corporate communication activities is based on the legal ground of explicit consent regulated under Article 5, paragraph 1 of the KVKK.

Where explicit consent is required, the obligation to inform the data subject and the process of obtaining explicit consent are conducted separately. The provision of this Information Notice alone does not mean that you have consented to the processing of your personal data for the purposes stated herein.

7. Transfer of Personal Data

7.1. Domestic Transfers
Your personal data may be shared with the following categories of recipients, provided that such sharing is connected with, limited to, and proportionate to the relevant purpose and that the applicable data processing conditions are met:

CoBAC employees who are required to access such data within the scope of their duties and authority
Service providers providing photography and video recording, editing, production, or content creation services on behalf of CoBAC
Service providers established in Türkiye from whom CoBAC receives website, hosting, digital infrastructure, corporate communication, and social media management services

7.2. Transfers Abroad
If the technical infrastructure of social media, cloud, hosting, or digital communication services used by CoBAC is located abroad, or if the relevant service provider is established abroad, uploading the relevant photographs, videos, or audio recordings to such services may constitute a transfer of personal data abroad.

Transfers of personal data abroad shall only be carried out where one of the applicable conditions stipulated under Article 9 of the KVKK is satisfied. In this context, the transfer shall be based on an adequacy decision, one of the appropriate safeguards provided for under the law, or, where applicable, one of the exceptional circumstances permitted by law. A service or channel for which an appropriate transfer mechanism is not available shall not be used for the relevant personal data processing activity.

Operational Compliance Note

CoBAC’s foreign service providers and the applicable Article 9 transfer mechanism for each transfer should be separately inventoried and kept up to date internally.

8. Retention Period, Deletion, and Destruction
Personal data covered by this Notice may be retained for as long as the processing purpose continues and valid explicit consent remains in place. In the event that explicit consent is withdrawn or the processing purpose ceases to exist, the relevant data shall be deleted, destroyed, or anonymized in accordance with applicable legislation and CoBAC’s data retention and destruction procedures.

Upon withdrawal of explicit consent, future use through channels controlled by CoBAC shall be discontinued, and, to the extent technically possible, the necessary actions shall be initiated to remove the relevant content from publication. Withdrawal of consent does not affect the lawfulness of processing activities carried out lawfully before the date of withdrawal.

9. Data Security
CoBAC implements access authorizations, user and system controls, data security processes, service provider agreements, and other necessary technical and administrative measures to prevent the unlawful processing of or access to personal data and to ensure the secure retention of such data.

10. Your Rights Under Article 11 of the KVKK
As a data subject, pursuant to Article 11 of the KVKK, you have the following rights:

To learn whether your personal data has been processed
To request information if your personal data has been processed
To learn the purpose of processing your personal data and whether it has been used in accordance with such purpose
To know the third parties to whom your personal data has been transferred, whether domestically or abroad
To request the correction of incomplete or inaccurately processed personal data
To request the deletion or destruction of your personal data within the conditions stipulated under Article 7 of the KVKK
To request that the correction, deletion, or destruction of your personal data be notified to third parties to whom your personal data has been transferred
To object to a result arising against you as a result of the analysis of processed data exclusively through automated systems
To request compensation for damages in the event that you suffer damage due to the unlawful processing of your personal data

11. Exercising Your Rights
You may submit your requests within the scope of Article 11 of the KVKK to CoBAC in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller.

Applications may be submitted through any of the following applicable methods:

By delivering a written and signed application in person or sending it by post to CoBAC’s address specified below
Via registered electronic mail (“KEP”) to the current KEP address announced by CoBAC
Electronically using a secure electronic signature or mobile signature
By sending an application from an email address previously notified by the data subject to CoBAC and registered in CoBAC’s systems, to hello@cobac.com.tr
Through a software or application provided by CoBAC specifically for application purposes, if such a channel is made available
The application must include the applicant’s name and surname, signature where the application is submitted in writing, Turkish Republic identification number for Turkish citizens, nationality and passport number or identification number, if applicable, for foreign nationals, the residential or workplace address for notification purposes, email address, if applicable, telephone and fax number, and the subject matter of the request. Information and documents relating to the request may be attached to the application.

Applications shall be evaluated in accordance with the periods and procedures stipulated under the KVKK and applicable legislation. Depending on the nature of the application, additional information or documents may be requested for identity verification purposes.

12. Contact Information
Data Controller: CoBAC Workspace Ofis Hizmetleri A.Ş.

Website: https://cobac.com.tr

Email: hello@cobac.com.tr

Address: Ragıp Gümüşpala Caddesi No: 29, Eminönü, Istanbul, Türkiye

Telephone: +90 212 905 53 00

The telephone number is not an application method for formal KVKK applications and may be used for general information and communication purposes.

13. Legal Basis
This Information Notice has been prepared based on the Law No. 6698 on the Protection of Personal Data, relevant communiqués and regulations, and the decisions and guidelines issued by the Personal Data Protection Board.

Last Updated: 19 August 2026