DRN GRUP GIDA SANAYİ VE TİCARET LİMİTED ŞİRKETİ — DRN Portal and UDF360 Privacy Notice on the Processing and Protection of Personal Data (Privacy Policy)

01

In brief

• Your documents do not come to us. Your documents are not uploaded to our servers. By default they are stored on your device. Saving to iCloud Drive or another cloud location happens by your choice. Your device's backup settings may also apply. UDF360 opens, edits, and signs your documents on your device. With mobile signature, the document goes, only at the moment of signing, to the mobile signature service that produces the signature, over an encrypted connection (TLS) (the recipient and the data sent are in the table in section 3); signing with an e-signature card is done on the device. If you choose to share a document or upload it to the portal, the document goes to the recipient you choose.
• Your client folders and scans are stored in the location you choose. The client folders you create and their names, the documents you save in these folders, the pages you scan with the camera, and the files you share to UDF360 from other apps are not sent to us. You choose the archive location; what happens to the app storage area and to the separate archive folder on deletion is explained in section 5.
• Easy Upload: The UYAP portal you select opens in its own web page inside the app; you start the sign-in, document download, upload, and submission actions yourself. On UDF360's own screens we do not ask for your UYAP or e-Devlet password; we do not read or save what you type into the official sign-in page. Page content and session data on the device are not sent to our servers or to the analytics, advertising, and crash reporting services we use (see sections 2 and 5).
• Text recognition (OCR) runs on your phone. The text on scanned pages is recognized on your device and added to the PDF as a searchable text layer. On Android, Google ML Kit text recognition is used; on iPhone, Apple Vision is used; the images and the recognized text are not sent to DRN, Google, or Apple for this process. ML Kit's technical usage measurements on Android are separate from this (see section 3).
• Scanning screen and share extensions: UDF360's own scanning screen uses the camera only to scan documents; the images are processed on your device. Files you receive from other apps through a share or action extension are copied into UDF360's app storage area on your device; the extension does not upload them to a server.
• Sharing with redaction is done on your phone. The document you open for redaction, the page images, the phrases you search for, and your redaction choices are not sent to us or to any other service. Only the redacted copy that you create goes to the app or location that you choose. Your source document is not changed; temporary copies created during the work are deleted when the process ends.
• An account is required for creating and editing documents, signing, saving, sharing, scanning, Easy Upload, and support; identity information is required only for signing and invoicing. An account is not required to open or view documents or to verify signatures. To sign, you need an account, a verified email and phone, full name, Turkish ID number, and an invoice address (an e-Arşiv invoice is also issued for entitlements assigned as gifts).
• Your Turkish ID number, first name, and last name are verified against the information in your signature certificate when you make your first signature, and your account is locked to that identity; the same information is compared again at every later signature. It is shown masked in the app; only you can see the unmasked form in the app (by signing in again). Our authorized administrator can view your full ID, address, and phone information when needed for support, account security, invoicing, and legal obligations; every viewing is recorded (see section 6). Your date of birth (including the year) is never requested.
• If another person signs a document in your account: The full name and Turkish ID number in that person's certificate are compared with your identity on our server at that moment, only to tell whether the signature belongs to you or to someone else, and are not saved. The number of signatures made by other people in your account this month and the match result of each signature are kept (see section 2).
• Advertising: You can sign by watching a rewarded ad (the reward you earn is not added to your signature credit balance; a time-limited, single-use ad token is assigned). Personalizing the ad for you happens only with your explicit consent; if you do not give it, a non-personalized ad is shown.
• You can delete your account at any time in the app or at drnportal.com/hesap.

02

1. Identity of the data controller

03

2. Personal data processed, purposes, and legal bases

The legal bases are abbreviated as follows according to Article 5 of the Law: Contract = being directly related to the conclusion or performance of a contract (Article 5/2-c); Legal obligation = being necessary to fulfill our legal obligation (Article 5/2-ç); Legitimate interest = being necessary for our legitimate interests, provided that your fundamental rights and freedoms are not harmed (Article 5/2-f); Explicit consent = your separate and explicit approval (Article 5/1). Recipients are detailed in section 3, and retention periods in section 5.

Data we do not collect: date of birth (including the year), location, contacts, camera images (when scanning documents, the images are converted to PDF on your device), microphone, the list of files on the device (the app lists your client folders on your device; the list does not come to us), e-signature card password or mobile signature password, and document contents. Document content is not processed on our servers; special categories of personal data inside your documents (health, religion, biometrics, etc.) also do not reach us.

Portal data not transferred to DRN: When you open UYAP inside the app, the information you view on UYAP and e-Devlet pages, the information you type into sign-in fields, and UYAP session cookies are not transferred to our servers or to the analytics, advertising, and crash reporting services we use. The username and password you type into sign-in fields are not read or saved by us; UDF360's own screens do not ask for this information. The information you enter on UYAP's and e-Devlet's own pages, however, goes to the relevant official service for your sign-in and transactions; these services process your data in their own systems. The document you choose to upload is sent directly from your device to the UYAP portal you select; it does not pass through DRN servers.

04

3. Transfers: recipient groups, purposes, and transfers abroad

We transfer your data only to the recipients below, for the stated purposes. We do not sell it or share it for marketing purposes.

Transfer abroad (Article 9 of the Law). Transfers to recipients in the table above whose country is not Türkiye are transfers of personal data abroad. As of today, these transfers are: Google (EU and USA — authentication, database, invoice PDFs, logs), Google AdMob (USA), Apple (USA), Google Play (USA), Amazon Web Services (AWS) — Amazon SES (Germany, eu-central-1, EU) — sending the account email verification code, security notifications, and invoice emails; and Meta (USA) if the phone verification code is sent through the WhatsApp channel. When you use document scanning on Android, the technical usage data that Google ML Kit collects (not the scanned images) may also be processed on Google's servers worldwide, including outside Türkiye; Google uses this data, according to its own privacy policy, to improve the component and detect misuse. The document that goes to the mobile signature service stays within Türkiye. The legal basis of these transfers: for transfers to Google, the standard contract announced by the Kişisel Verileri Koruma Kurulu (Personal Data Protection Board) is being signed with Google; until this process is completed, the transfer relies on this text, through which you are expressly informed. For the transfer to AWS as well, the same standard contract is in the process of being signed with AWS; until this process is completed, the transfer relies on this text, through which you are expressly informed. When you use ML Kit text recognition on Android, too, only technical usage measurements are sent to Google; the images and recognized text are not sent. Not giving consent to usage statistics in Settings, or withdrawing your consent, does not turn off ML Kit's own technical usage measurements. On iPhone, text recognition with Apple Vision is done on the device; this process does not send the image or the recognized text to Apple. UDF360 does not upload your document content to DRN's servers; your document content is not sent abroad by DRN. With mobile signature, the document goes to the mobile signature service in Türkiye. A cloud service you choose as your archive or save location (e.g., iCloud Drive, Google Drive) may also keep your documents on its servers abroad; this is storage that takes place by your choice and is subject to that provider's rules.

05

4. Collection method

Your data is obtained, wholly or partly by automated means, through the following channels:

• From you, through app and portal forms: sign-up, "Complete my profile" (identity and address), phone verification, support message, purchase.
• From your signature certificate: At every signature, the name and ID number read from the e-signature card on your device or from the mobile signature certificate on your SIM are compared with the information in your account on the server (the first successful match makes your identity "verified" and locks your account to that identity); the result (matched / another person's certificate / did not match before the lock), name match, and time are recorded; the value in the certificate and the certificate itself are not stored. If the certificate is not yours (if another person is signing a document in your account), this signature is added to this month's sharing counter; the identity information of the person signing is not stored.
• From verification services: The result of SMS and email codes. Only the signature result returns to your device from the mobile signature service; the signature credit result (successful / canceled / error) is reported to our server.
• From the stores: Apple and Google notify us of purchase and subscription events.
• From the ad network: AdMob reports the rewarded ad that was watched to our server in signed form.
• Automatically: app version, error and security logs, security-related browser signals and browser storage on the portal account pages (see the Cookies and Browser Storage Notice), (with your consent) usage statistics.

06

5. Retention periods, account deletion, and what remains on your device

When you delete your account (UDF360: Settings › My Account › Delete account, shown in the app as Ayarlar › Hesabım › Hesabı sil · drnportal.com/hesap/sil): your account, identity, address, phone, entitlements and signature credit movements, identity match records, sharing counter, document work (document ticket) records, ad reward records, verification code and counter records, and your in-app support requests are deleted; your sign-in record is removed from Google Firebase; the uniqueness records of your Turkish ID number and phone number are released. Only the following remain: (a) the invoice and purchase records that we are legally required to keep — with the link to your account (your sign-in record) severed; (b) a deletion trace that does not directly show who you are (registration and deletion dates, total number of signatures, remaining balance, profile status, sign-in provider, version, and the deletion reason you selected, if any — ID number, phone, and email patterns are removed from the reason text); (c) the explicit consent log and administrator access records — with your account label converted into a digest; (d) the password/email change security log (event type and time; contains no identity information). The name, address, and Turkish ID number on the invoice record in (a) continue to be kept for 10 years as required by law (this is not anonymization); the account label in the purchase record is pseudonymized (identity separated). (b) and (c) are also pseudonymized and are deleted after account deletion + 3 years, and (d) 1 year after the event date (see the table above). To delete, you are asked to have signed in within the last 10 minutes; if you hold the administrator role, you must first transfer your role. Deletion cannot be undone; your remaining signature credits and your PRO period are lost. Deleting your account does not cancel your store subscription; you must cancel your Google Play / App Store subscription separately from your store account, otherwise the store may continue to charge you (see Terms of Use, section 12).

Data that does not come to us and is processed on your device: the documents you open and the encrypted recovery copy taken automatically during editing (in a private area of the device accessible only to the app; until you save and close, or for at most 7 days), what you saved to the archive you chose, the recently opened documents list (name, location, date), the last copy created for sharing (in a temporary folder until the next share), the position of the signature seal within the document, if you chose "Remember my number on this device," the mobile phone number and operator (in the device's encrypted storage), e-signature card operation logs (at most 30 files; contain no PIN, ID number, or document; deleted from Settings › Privacy or sent for support when you share them), your ad personalization and usage statistics preferences, client folders (the person name or company name you write as the folder name) and the documents, scans, and copies of files received through sharing that you saved in them. Temporary copies created during scanning and sharing are deleted when the process ends, within 24 hours at the latest.

Archive location and storage: The archive location is asked once, when you create your first client folder or at the first persistent save. You can choose to create a separate archive folder on your device, choose another location, or, for now, keep documents in the app storage area. iCloud Drive being turned on on your device does not mean you have chosen to save there; saving to iCloud Drive or another cloud location happens only by your choice. The actual location you choose is shown in the app. If you choose a cloud location, your documents are kept in your own account with that provider; that service's rules apply for synchronization and storage. Documents saved to iCloud Drive in an earlier version remain accessible; you can move them to the archive you choose. Your device's backup settings may also apply; UDF360's app data is not included in Google's automatic backup.

Documents in the app storage area are deleted when you delete the app. Files in an archive folder you choose outside the app storage area may remain after the app is deleted, depending on the location you chose and the provider's rules. UDF360 does not automatically delete your external archive folder because you delete the app or your account. You manage and delete these files yourself; an archive folder alone does not replace a backup.

Origin record in the archive: A separate record file (.udf360/arsiv.json) is kept in the archive folder. This file contains the archive version, the permanent IDs of clients and documents, the content digest of the document, and the relevant UDF360 account ID; this record does not cause the document content to be sent to DRN. This record is used to recognize the folders and documents when you reinstall the app and select the archive again, and to recognize that the document was created in the same UDF360 account when the document digest and the account ID match. Recognizing the origin depends on the record file being preserved, the document digest matching, and your signing in with the same account. If you choose to share the archive or keep it in a cloud location, this record file is also located inside the archive, in the same location.

If access to the archive folder is lost, you are asked to reconnect it; records are not shown as if they were lost. If the local location cannot be written to, the app does not silently switch to a cloud location; work that cannot be saved is kept in the recovery record on the device. When the archive location is changed, the new location is used after the files and their relationships have been copied and verified; you decide whether the old copies are deleted. If the move is interrupted, the old intact archive is preserved.

Temporary data in the portal window: The WebView session cookies and cache in Easy Upload are kept only on your device; they are not transferred to DRN servers or to the analytics, advertising, and crash reporting services we use, and are not included in the device backup. When you close the window, this data on the device is cleared; if the app is swiped away from the recent apps list or closed by the system, the remaining data is cleared at the next launch. This does not mean that the session on the UYAP server has been ended; to end the session, use the portal's own sign-out option. Documents you choose to download from the portal are not temporary WebView data: they are saved to the client folder or save location you choose, are not deleted when you close the window, and are not sent to DRN servers. If you chose a cloud location, that service's retention rules apply.

The text produced by text recognition is stored in the text layer of the PDF you save, in the save location you choose, and is deleted along with the PDF when you delete the PDF. Files received by the share and action extension are processed in the UDF360 app storage area on your device; on iPhone, in the app group area that the extension and the main app access jointly. You delete the copies you save yourself; the period above applies to temporary copies. If you later choose to share these files with another app or save them to a cloud service, the processing and retention rules of the service you choose apply.

07

6. Security measures

• The Turkish ID number is kept on the server in a closed area that only certain server-side functions can read; comparisons are made, in constant time, over a one-way digest produced with a secret key. The ID number is shown masked (123******01) on app and portal screens; its full form is revealed only to you (next item) and, through a recorded action, to our authorized administrator.
• You can see your unmasked ID number in the app: provided that you have signed in again within the last 5 minutes, a limited number of times per day; every display is recorded. Our authorized administrator, for the purposes in section 3, can view your full ID, address, and phone information when needed and perform identity comparisons; every viewing and every comparison is entered into an undeletable record together with who saw which information and when (the values displayed are not written to the record). Moderators can never see your full ID, address, or phone information.
• Address information is accessible to you, to the invoicing system, and, through a recorded action, to our authorized administrator; moderators cannot read it.
• Data can under no circumstances be written directly from the app; every write is validated on the server side. No field, including the signature credit balance, can be changed from the client.
• All connections are encrypted (HTTPS). Secret keys are kept in Google Secret Manager and are not in the code.
• The "four-eyes" principle in administrator actions: an administrator cannot add signature credits to themselves or change their own role.
• Administrator authority is valid only when signing in with a Google account; we require two-step verification to be turned on for Google accounts used as administrator.
• Anonymous (accountless) sign-in is turned off. To prevent forged requests, the device integrity token (Play Integrity / App Check) is monitored; on the portal account pages, Firebase App Check and Google reCAPTCHA are used for the same purpose.
• To make it impossible to delete the account or show the ID if a Firebase Auth session is stolen, these actions require you to have signed in again recently.

08

7. Your rights and how to apply

To exercise your rights under Article 11 of the Law (learning whether your data is processed, requesting information, correction, deletion, learning the third parties to whom it has been transferred, objecting, and claiming compensation for damage), you can reach us through the means described on the KVKK Application page: to privacy@drnportal.com from the email address registered in the system, through in-app/portal support, with a secure e-signature/mobile signature, or in writing to the address Mustafa Kemal Mahallesi, 2118. Cadde, No: 4C, İç Kapı No: 140, Çankaya/Ankara. Applications are resolved free of charge within 30 days at the latest. You can make some requests (account deletion, correcting information, withdrawing consent) yourself within the app.

09

8. Age limit

UDF360 and the DRN Portal account are intended for people who have turned 18 (electronic signature authority). We do not knowingly collect data from people under 18; if such an account is detected, it is deleted.

10

9. Changes

When this text changes, the version and date above are updated; if there is a significant change in the purposes of processing or in the recipients, we notify you separately in the app and by email and inform you before the new processing begins. The current text is always at drnportal.com/legal/gizlilik.

This privacy notice is an information notice; it does not contain an approval or consent statement. The app and portal present the privacy notice only with an "I have read and understood" acknowledgment; acceptance of the Terms of Use and explicit consent choices are obtained on separate screens.

11

Signatories who are not account holders

This section is for people who sign documents in the app in another person's account, with their own e-signature card or mobile signature, but who are not the owner of that account. The data controller and contact details are in section 1.

• Which data: The full name and Turkish ID number in your electronic certificate. In mobile signature, additionally, your mobile phone number and operator, which the account holder types into the app.
• What for: Only to tell whether the signature belongs to the account holder or to someone else, and to count the signatures made by other people in the account holder's account.
• How it is obtained: The full name and Turkish ID number are read automatically from your certificate: with card-based e-signature, when the card is inserted, before the PIN is asked (even if you give up signing); with mobile signature, after the signature returns, from the certificate within the signature. With mobile signature, the account holder types your mobile phone number and operator into the app; this information is processed on the device.
• How it is processed: Your ID number is compared on our server with the account holder's one-way digested ID number at that moment. Your full name, ID number, and certificate are not saved and are not written to logs. After the comparison, the match result ("another person's signature"), name match (whether your name is the same as the account holder's name), time of the operation, and app version may remain in the account holder's record for 90 days; your name, ID number, or certificate information is not in this record. If the account holder chooses "Remember my number on this device" on their own device, your number remains only on that device. In card-based e-signing, your document content and PIN are not sent to the internet; the PIN is passed only to the inserted e-signature card, and the signature is produced inside the card.
• To whom and for what it is transferred: Your identity information is transferred to the cloud infrastructure in the European Union (Belgium) of Google, our data processor, to be compared with the account holder's identity. This is a transfer of personal data abroad; its legal basis is explained in section 3. With mobile signature, the document and your mobile phone number go, for the creation of the signature, directly from the account holder's device to the mobile signature service and to your operator (see section 3); your number does not come to our server.
• Legal basis: Our legitimate interest, provided that your fundamental rights and freedoms are not harmed (Article 5/2-f of the Law): to manage the personal use of the account and to prevent misuse. We do this without saving your identity at all.
• Your rights: You can exercise your rights under Article 11 of the Law through the means in section 7.