Data Subject Request Form

1. What this form is for

The GDPR gives you rights over your personal data. With this form you can exercise one or more of these rights.

Controller: Topluyıldız Danışmanlık A.Ş. (mybusyness), registered office in Türkiye · e-mail sales@mybusyness.com

2. READ FIRST: who to contact

If a business has entered your data into mybusyness, that business is your point of contact.

If you send the form to us in the second case anyway, we cannot answer your request on the merits; we forward it without delay to the business concerned and let you know. You do not lose any rights as a result.

3. Your rights

4. Channels

Note: If we cannot verify your identity, we cannot answer the request on the merits. This prevents your data from going to someone else. If your identity cannot be verified, we ask for additional information.

Do not send a copy of your identity document. One of the channels above is usually enough to verify your identity; if necessary, we ask specifically.

5. Time limit and costs

5.1. We answer your request within one month of receipt (Article 12(3) GDPR). Where necessary, taking into account the complexity and number of requests, this period can be extended by two further months; in that case we inform you within the first month, giving reasons.

5.2. The answer is given through the channel you specify.

5.3. Handling your request is free of charge in principle.

6. If we refuse

If we refuse, restrict or postpone your request in whole or in part, we tell you why. You have the right to lodge a complaint with the Autoriteit Persoonsgegevens (Article 77 GDPR); the route to the courts remains open.

7. Important limits — so that you know them in advance

7.1. Identity check. We release data only once your identity has been verified.

7.2. The audit trail is not erased. The product's audit trail serves as proof and meets legal obligations; it is an append-only chain with no way to delete or change it. When you request erasure, the entry in the audit trail remains; job texts and document contents, however, are reduced to a masked summary and then no longer contain personal data.

7.3. Destruction usually means reduction. The row remains; the raw personal data in it is irreversibly replaced by a masked summary.

7.4. Backups. A record destroyed in the product can remain in the regular database backups at most for their retention period (today 7 days) and disappears afterwards as the backups rotate.

7.5. Statutory retention obligations. Records that the law requires to be kept (for example accounting records and vouchers) cannot be erased before those periods expire.

7.6. We explain these limits concretely in our answer — stating which record cannot be erased and for what reason.

FORM

(The following fields appear as a form on the data subject request page; for a written request, the same information belongs in the letter.)

A · Details of the requesting person

B · Your relationship with us

• I visited the website
• I have / had an account with mybusyness
• I am a customer, employee or supplier of a business that uses mybusyness — (in this case, that business is your point of contact; see section 2)
• Other: ____________________

Approximate date of the relationship: ____________________ Name of the business concerned (if known): ____________________

C · Your request

Tick which rights you want to exercise:

• 1 — Access to whether and which personal data about me is processed
• 2 — Information on purposes, retention period, source and recipients
• 3 — Rectification of inaccurate personal data
• 4 — Erasure of my personal data
• 5 — Restriction of processing
• 6 — Receiving or transmitting my personal data
• 7 — Objection to processing
• 8 — Review of an automated individual decision by a human

D · Details

(Describe your request as concretely as possible: which data, which date, which operation? Attach documents where relevant. Do not attach an image of your identity document here.)

E · Delivery of the answer

• By e-mail
• By post to my address

F · Declaration

I confirm that the information in this form is accurate and up to date, and I agree to it being used to handle my request.

First name and surname: ____________________ Date: ____________________ Signature: ____________________

This document describes the behaviour of mybusyness as measured in the code. This is not legal advice.