Privacy Notice under Turkish Data Protection Law

For the purposes of Turkish Personal Data Protection Law No. 6698 (KVKK), the data controller is Ultra Bilişsel Akıl Danışmanlık Bilişim Destek ve Servis Hizmetleri Limited Şirketi. Enbilir is the financial literacy, education, AI-assisted information, virtual portfolio, and competition service provided by the Company through enbilir.com.

This notice covers visitors, members, applicants for membership, users of community and chat features, persons submitting support requests, and anyone contacting the platform for another reason. Separate notices apply where the Company conducts distinct employee, supplier, or business-partner processes.

The duty to inform and explicit consent are separate. Reading or confirming this notice does not by itself mean that you have given explicit consent.

Depending on the feature you use, some or all of the following data may be processed. The platform does not request special-category data that is unnecessary for the service; do not enter health, biometric, political, or similarly sensitive information into AI or chat fields.

• Identity and account data: name, username or nickname, display-name preference, user role, account status, and membership tier.
• Contact and verification data: email address, verification time, communication preferences, support requests, and correspondence.
• Security data: one-way password hash, session token, verification tokens, duplicate-action prevention records, timestamps, and technical error/security logs.
• Virtual portfolio and competition data: virtual balance, positions, virtual trades and trade reasons, portfolio snapshots, score, league, ranking, badges, and weekly competition results.
• Preference and usage data: risk-appetite answers and result, education progress, favorite assets, guided-help and onboarding progress, and feature-use events.
• AI and community data: text or voice submitted to the assistant, generated reports, favorites, chat messages, room and poll activity, blocks, and reports.
• Payment and subscription data: plan type, subscription dates, payment-status records, and payment-provider redirect details. Enbilir does not store full card details.

Data is processed for specified, explicit, and legitimate purposes and in a manner that is relevant, limited, and proportionate. A new purpose is reassessed for its legal basis and transparency requirements.

• Creating memberships, verifying email, providing secure login, and managing account preferences.
• Calculating and displaying virtual trades, leagues, rankings, badges, and daily or weekly reports.
• Providing the risk-appetite test, education progress, AI assistant, AI market terminal, reports, and chat features.
• Answering requests, sending service notices, and, where permission exists, sending commercial electronic messages.
• Preventing fraud, duplicate or unauthorized actions, security incidents, and breaches of community rules.
• Measuring performance, fixing errors, improving user experience, and producing anonymous or aggregated statistics.
• Managing subscription entitlements and payments, meeting accounting and legal duties, and protecting rights in disputes.

Personal data is processed under the applicable legal basis in Article 5 of the KVKK. Explicit consent is used only for optional processing where no other legal basis applies and consent is required by law.

• Necessity for entering into or performing membership, virtual portfolio, or subscription services (Art. 5/2-c).
• Compliance with the controller's legal duties, including electronic records, accounting, consumer, and competent-authority obligations (Art. 5/2-ç).
• Establishment, exercise, or protection of a right and management of complaints or disputes (Art. 5/2-e).
• Legitimate interests in account security, abuse prevention, service improvement, and measurement, without harming fundamental rights (Art. 5/2-f).
• Explicit consent, where required, for optional activities such as commercial electronic messages and non-essential tracking technologies (Art. 5/1).

Data is collected automatically or partly automatically from registration, login, profile, risk test, virtual trade, AI, chat, contact, and subscription forms; records created by your use; essential cookies; and browser-storage technologies.

If you choose Google sign-in, we may receive the account identifiers and basic profile information Google shares. Market and news data comes from external sources, but those sources are not used with the intention of obtaining personal data about you.

Personal data may be disclosed only to the extent necessary for the processing purpose, subject to confidentiality and security safeguards. Providers and contracts are assessed against data-protection principles.

• Hosting, database, email, security, error-monitoring, and technical-support providers.
• Google authentication and AI or text/voice processing providers where you choose the relevant feature.
• The payment provider for subscriptions, and accountants, legal advisers, or auditors where necessary.
• Courts, enforcement bodies, and public authorities legally authorized to request data.
• Other members, limited to your chosen name or nickname, score, badges, league, and virtual performance in rankings and community areas.

Passwords and full payment-card details are not disclosed to other users. Card data is processed on the payment provider's secure pages.

The risk-appetite test creates an educational score and profile from your answers. Virtual rankings are automatically calculated from virtual trades and published competition rules. These outputs do not make legally significant credit, investment-suitability, or customer-admission decisions.

Prompts, voice transcripts, and context submitted to AI features may be processed to create responses or reports. Outputs may be inaccurate, incomplete, or outdated; do not enter sensitive personal data, real payment data, or another person's confidential information.

In league, leaderboard, and community areas, your name or nickname, score, and virtual performance may be visible to others according to your profile preference. You can manage your display-name preference in account settings.

Where cloud, authentication, email, or AI infrastructure is located abroad, personal data may be transferred internationally. Transfers are conducted under the applicable mechanism in current Article 9 of the KVKK, such as an adequacy decision, appropriate safeguards, or an exceptional transfer condition.

Where safeguards are required, the Company uses standard contracts, binding corporate rules, an approved undertaking, or another statutory mechanism and makes required notifications. This notice is updated if a provider or transfer mechanism changes materially.

Data is kept for as long as needed for membership and the relevant feature, legal duties, limitation periods, security, and dispute management. At the end of that period, data is deleted, destroyed, or anonymized by an appropriate method.

An account-deletion request affects active service data; however, financial records, proof of acceptance, consent timestamps, and security records may remain under restricted access where required by law or to protect rights. Anonymous competition statistics may be retained if they no longer identify you.

The Company applies risk-appropriate measures such as access controls, one-way password hashing, secure session cookies, restricted privileges, backups, logging, and incident response. No internet service can promise absolute security, but identified risks are regularly assessed.

You should keep account details accurate, avoid sharing passwords, and report suspicious activity. Where legally required, the Company notifies the Turkish Data Protection Board and affected persons of a personal-data breach.

Under Article 11 of the KVKK, you may ask whether data is processed; request information; learn the purpose and whether data is used accordingly; learn domestic or foreign recipients; request correction, and where conditions apply deletion or destruction, with notice to recipients; object to a result against you arising solely from automated analysis; and seek compensation for damage caused by unlawful processing.

Submit your request with sufficient identity and request details from your registered email to info@ultraakil.com or in writing to Altıntepe Mahallesi, İstasyon Yolu Sokak, No: 3/1, Maltepe / Istanbul. Statutory registered electronic mail (KEP), secure electronic signature, or mobile-signature methods may also be used. Additional verification may be required for your security.

Applications are answered free of charge as soon as possible and within 30 days at the latest. A Board-approved tariff may apply where processing creates an additional cost. Your statutory right to complain to the Turkish Data Protection Board remains available.