Disclosure Notice on the Protection of Personal Data

This notice has been prepared under Article 10 of Turkish Law No. 6698 on the
Protection of Personal Data (the "Law") and the Communiqué on the Principles and
Procedures to be Followed in Fulfilling the Obligation to Inform.

It applies to individuals in Türkiye. For a broader explanation of how we handle
your data generally, see the Privacy Policy.

1. Identity of the data controller

BandUp is a product of UBIG Teknoloji A.Ş. The Company acts as the data
controller under the Law.

2. Categories of personal data processed

We do not process special categories of personal data. Please do not enter
special category data (health, religion, political opinion and similar) into the
Service.

3. Purposes of processing

• Creating your membership record and managing your account

• Delivering the Service: operating the band workspace, repertoire, setlists,
  stage mode, calendar, tech rider and listings features

• Running subscription, invoicing and collection processes

• Sending notifications, reminders and transactional emails

• Operating information security processes, preventing abuse and fraud

• Handling requests and complaints, running support processes

• Improving the Service, fixing faults and monitoring performance

• Distance-based sorting in Listings (subject to explicit consent)

• Sending commercial electronic messages (subject to explicit consent)

• Analytics measurement (subject to explicit consent)

• Providing information to competent authorities and meeting legal obligations

4. Legal grounds

You may withdraw your consent at any time for processing that relies on it.
Withdrawal does not affect the lawfulness of processing carried out beforehand.

5. Method of collection

Your personal data is collected electronically:

• directly from you, through the BandUp website, web application and mobile
  applications,

• from the relevant provider with your approval, when you choose social sign-in
  (Google, Facebook, Apple),

• automatically while you use the Service (session, device and log records),

• as transaction records received from our payment provider.

6. Transfer of personal data

6.1 Transfers within Türkiye

Your personal data may be transferred, in accordance with Article 8 of the Law,
to competent public institutions for the fulfilment of legal obligations and,
where necessary, to our legal and financial advisors.

In addition, when you join a band workspace, your name, profile photo,
instruments and the content you contribute become visible to the other members
of that band.

6.2 Transfers abroad

Your data is hosted within the European Union. To deliver the Service we work
with the following providers established abroad:

Under the regime that took effect on 1 June 2024, transfers abroad rely first on
an adequacy decision of the Board. As the Board has not yet issued an
adequacy decision for any country or sector, we base our transfers on the
appropriate safeguards in Article 9(3) of the Law: we sign the standard
contract published by the Board with recipients abroad and notify the Authority
within five business days of signing.

The exceptions in Article 9(6) of the Law — including explicit consent — apply
only to transfers that are incidental, irregular, non-continuous and infrequent.
We do not rely on those exceptions for the continuous transfers required to
deliver the Service.

7. Retention periods

Data whose retention period has expired is deleted, destroyed or anonymised.

8. Your rights as a data subject

Under Article 11 of the Law you have the right to:

• learn whether your personal data is being processed

• request information if it has been processed

• learn the purpose of processing and whether the data is used accordingly

• know the third parties to whom the data is transferred, in Türkiye or abroad

• request rectification if the data is incomplete or inaccurate

• request erasure or destruction under the conditions in Article 7 of the Law

• request that rectification, erasure and destruction be notified to third
  parties to whom the data was transferred

• object to a result against you arising from analysis carried out solely by
  automated systems

• claim compensation for damage suffered due to unlawful processing

9. How to apply

To exercise your rights, in line with the Communiqué on the Principles and
Procedures for Application to the Data Controller:

• In writing: by a signed petition delivered to Caferağa Mah. Moda Cad. No: 5,
  34710 Kadıköy/Istanbul (in person or through a notary),

• Electronically: from the email address registered in our system, to
  [email protected].

Your application should include your full name, signature (for written
applications), Turkish ID number (passport number for foreign nationals), address
for notification, email and telephone if applicable, and the subject of your
request.

Applications are concluded free of charge as soon as possible and within thirty
days at the latest, depending on their nature. Where the process incurs an
additional cost, the fee set out in the Board's tariff may be charged.

If your application is rejected, you find the response insufficient, or no
response is given within the period, you may file a complaint with the
Personal Data Protection Board within thirty days of learning the response
and in any case within sixty days of the application date.

10. Changes

When we update this notice we change the "Last updated" date on this page and, for
material changes, inform you.