Privacy Notice

A. About Us

Rain Kripto Varlık Alım Satım Platformu A.Ş. (the "Rain Turkiye" or the "Company" ) is a joint-stock company incorporated in Turkey with a trade registry number 255526-5 and having a registered office at Maslak Mah. Sanatkarlar Sokak Eclipse Maslak Sitesi No:2 E Blok D: 9 Sarıyer / İstanbul / Turkey. The company is an international organization that provides services within the limits of the applicable law and exclusively under the Capital Markets Law No. 6362 and relevant legislation in the fields of cryptocurrency asset trading, initial sale or distribution, exchange, transfer, and one or more of the custody operations required by these transactions (“Services”) through the https://www.rain.com/tr-tr website and mobile applications (“Platforms”).

B. About This Legal Disclosure

This Legal Disclosure has been prepared to fulfill our legal responsibilities and obligations arising from the Personal Data Protection Law No. 6698 (“Law”), its secondary regulations, the decisions of the Personal Data Protection Board, and other relevant legislation. It is an integral part of the Institutional User Agreement concluded between Rain Türkiye and the user who registers at https://www.rain.com/tr-tr (“Website”). Pursuant to Article 10 of the Law, this Legal Disclosure aims to inform you, as the data controller, about how we collect, process, store, and share your personal data, as well as your legal rights regarding your personal data. We respect your rights concerning the privacy of your personal data and take our responsibilities regarding data processing seriously. We process the biometric data collected during account opening in accordance with the applicable legislation. Additionally, we do not collect or process personal data unnecessarily. Your personal data may be processed, recorded, stored, updated, and, where permitted by law and/or limited to the purposes for which they were collected, disclosed/transferred to third parties by our Company in compliance with the Law and relevant regulations, in a manner that is relevant, limited, and proportionate to the purposes explained below, and in accordance with legal and ethical principles. By registering on the Website, creating a user account, and reading and accepting the User Agreement and this Privacy Notice, you declare and acknowledge your prior acceptance of these terms.

This Personal Data Processing Disclosure Statement (“Disclosure Statement”) has been prepared to inform Rain Türkiye users about how and why we collect, process, store, and to whom and for what reasons we transfer your personal data.

C. Data Controller - Processing Personal Data, Security, Preservation and Deletion

Unless we have entered into a different agreement with you, as Rain Turkiye, we will act as a data controller. We process, transfer, store, and delete personal data provided by our employees, employee candidates, former employees, Company shareholders, Company officials, customers receiving services and potential customers, supplier employees and supplier executives in accordance with the Law and Rain Turkiye’'s Personal Data Protection Law Procedure and Personal Data Storage and Deletion Policy. Your personal data can be processed, stored, destroyed and updated in accordance with the Law and good faith for the following purposes and it can be disclosed/transferred to third parties limitedly by the regulation and/or for the purpose for which they are processed.

In order to prevent unauthorized access to your personal data, the incorrect processing, disclosure, or alteration/deletion of your personal data for unlawful reasons, and to ensure its protection and security, our Company takes all necessary technical and administrative measures in accordance with the data protection legislation.

Your personal data is retained for the period required for the processing purposes specified in this Disclosure Statement and, in any case, for the statutory limitation periods stipulated in legal regulations or upon the request of the data subject. Upon the expiration of such periods, your personal data will be deleted, destroyed, or anonymized in accordance with our Personal Data Retention and Deletion Policy.

Processed Personal Data

a. Data processed when you create a Rain Türkiye user account:

In order to open a membership account at Rain Türkiye, we process your identity and contact information such as name, surname, email address, password, SMS and email verification codes, etc.

b. Data processed for verification procedures on your user account:

Creating a Rain Türkiye account alone is not sufficient to carry out all transactions available on Rain Türkiye. In order to benefit from all services offered by Rain Türkiye, we process your identity and contact information such as gender, place and date of birth, nationality, type and serial number of identity document, photograph, expiration date of the identity document, mother’s name, father’s name, residential address, occupational details, phone number, etc., within the scope of Law No. 5549 on the Prevention of Laundering Proceeds of Crime and its secondary legislation (“AML Legislation”), for the purpose of verifying your identity and transactions. In particular, pursuant to Articles 6, 6/A, and 17/A of the Regulation on Measures Regarding Prevention of Laundering Proceeds of Crime and Financing of Terrorism (“Regulation”) No. 2007/13012, electronic copies of the front and back sides of your ID card, driver’s license, or passport are collected by our Company, and the photograph contained therein is compared with your facial image obtained via the camera of the device used at account opening, in order to verify your identity. These images obtained for identity verification are retained by our Company within the scope of the obligations set forth in the relevant provisions of the Regulation.

c. Data processed when you contact us:

When you contact us, we may process your identity and contact data such as name, surname, email address, phone number, message content, and social media account information.

d. Data processed when you log into Rain Türkiye or carry out transactions:

When you log into your Rain Türkiye account through the Platforms, we process your data such as IP address, connection device and model, operating system, browser information, time zone and location information, traffic data, etc. When you deposit funds, execute cryptocurrency buy or sell transactions, or withdraw funds from Rain Türkiye, your bank and IBAN information as well as your transaction history are processed by Rain Türkiye.

e. Data processed when you participate in contests, sweepstakes, or campaigns organized by Rain Türkiye:

In the event of your participation in contests, sweepstakes, or campaigns organized by Rain Türkiye, we process your identity data such as name and surname, contact data such as phone number and email address, as well as the referral code assigned to your account.

f. Data processed when you carry out a transaction classified as suspicious:

In cases where transactions are deemed suspicious under the AML Legislation, we may process your personal data as necessary to comply with the procedures stipulated by law and, if required, to initiate legal proceedings.

D. Processing and Purpose of Personal Data

Your personal data is collected and processed by fully/partially automatic means, in connection with the Company's commercial activities, through the website, mobile or digital applications, through user interviews made via mobile/internet channels, through written and digital applications made to the Company, through electronic, verbal or physical means, in a limited and measured manner and in accordance with the principles of the Law and relevant legislation, in connection with the following purposes.

Your personal data that you share with Rain Turkiye is processed by the Company in accordance with the basic principles set out in the Law. Your personal data will be processed by the Company within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the Law, in addition, in order to fulfill our legal obligations clearly stipulated in the MASAK Legislation and other relevant laws. limited to the following purposes.

• Provision of the Services;
• Answering your questions and providing general information about the Services;
• Providing information about the Services we offer to you and informing you about other services we think may interest you;
• Planning and carrying out corporate communication activities;
• Ensuring that advertisements are presented in the most effective way for you and your computer or device; Increasing the effectiveness of advertising;
• Negotiating, establishing and executing contracts that have been concluded or are planned to be concluded;
• Ensuring and improving coordination and efficiency between departments;
• Ensuring the security of physical environments;
• Keeping and monitoring visitor records;
• Ensuring the security of information systems;
• Fulfilling administrative and legal obligations;
• Strategy, planning and business partner/supplier management;
• Notifying changes in legislation or rules and policies adopted by the Company or making other notifications concerning the data owner;
• Determining user satisfaction;
• Resolving existing and future legal disputes; Conducting customer service operations, responding to requests and questions;
• Obtaining the opinion of the data owner through various methods (surveys, voting, etc.);
• Managing, protecting and improving our systems, Internet Address and activities (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data);
• Planning and executing activities for emergencies;
• Developing and improving human resources, marketing and public relations policies;
• Providing employee needs within the framework of human resources policies and carrying out, developing and improving recruitment processes;
• Investigating, detecting, preventing and reporting non-compliance with the contract and the law to the relevant administrative or judicial authorities.

E. Transfer of Personal Data

Your personal data can be shared with third-party institutions and organizations such as business partners, suppliers, main shareholder, affiliates and subsidiaries, group companies and authorized public institutions and organizations within the scope of the aforementioned purposes, in accordance with your explicit consent or in other cases regulated in Article 5/2 of the Law and within the framework of personal data processing conditions and purposes set out in Articles 8 and 9 of the Law.

F. International Transfer of Personal Data

We may transfer your personal data to our main shareholder, worldwide affiliates, group companies, third-party partners, personnels, service providers, judicial authorities, and competent authorities, provided that you give explicit consent. This transfer is carried out for the purpose of conducting company activities, in connection with and limited to these purposes, and in accordance with the legal grounds set forth in Article 9/4-c of the Law. It is necessary due to the operation of Rain Türkiye’s infrastructure and IT systems and the requirement of cross-border data transfer for business operations. In cases where we intend to transfer personal data to third countries or international organizations outside of Türkiye, we will take appropriate technical, organizational, and contractual security measures to ensure that such transfers comply with the requirements of the Law and relevant legislation.

G. The Method and Legal Basis of Collection of Your Personal Data

Your personal data is collected and processed through the Website, our mobile application, emails, SMS, your registered phone number, cookies and similar tracking technologies, mail, cargo, and courier services, as well as other physical and electronic environments. This is done using both fully or partially automated methods and non-automated methods that form part of a data recording system. The Website uses cookies (the "Cookies" ). Cookies are small text files which are stored by your browser on your computer and are normally used to gather statistical information and to analyze trends of use or access to the Website. Cookies cannot be used to run programs or deliver viruses to your computer. We use cookies to collect such information as IP-addresses, type of operating system, browser type, browser language, the history of queries, data concerning shows of advertising messages, and user's clicks on them.

Cookies may be used to save your personal preferences, so you do not have to re-enter them each time you access the Website.

Your personal data are processed on the basis of the following legal reasons specified in Articles 5 and 6 of the Law:

• If it is clearly regulated by regulation;
• If it is mandatory for the Company to fulfill its legal obligations;
• If the data processing is directly related and necessary with the establishment or performance of the contract;
• If it is obligatory to operate for the legitimate interest of the Company, provided that it does not harm your fundamental rights and freedom;
• If it is publicized by you;
• If processing is necessary for the establishment, use or protection of a right; or If you have explicit consent.

H. Change of Purpose

Your personal data will only be used for the purposes for which it was collected by us. However, if it needs to be used for another purpose and if this purpose is compatible with the original purpose, we may also use your personal data for these new purposes. If you wish to get an explanation as to how the processing for these new purpose is compatible with the original purpose, please contact us at kvkk@rain.com. If we need to use your personal data for an unrelated purpose, we will notify you by explaining the legal basis which allows us to do so. Please note that we may process your personal data without your knowledge or consent, in compliance with this Legal Disclosure, where this is required or permitted by law.

I. How Long We Keep Your Personal Data

We will retain your personal data for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements. This means that the retention period of your personal data may vary depending on the type of data we collect. To determine the appropriate retention period for personal data, we consider several factors, including the amount and nature of the data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and applicable legal requirements. Your data will be retained as long as necessary to comply with the Law No. 5549 on the Prevention of Laundering Proceeds of Crime and relevant regulations, to resolve legal claims, or as otherwise communicated to you, to ensure your continued use of Rain Turkiye Services.

For more information about our data retention policies, please contact us at kvkk@rain.com.

J. Your Legal Rights Under the Law as Data Subject

Regarding the processing of your personal data, by applying to the Company as a data subject, you can use your legal rights below:

• Finding out whether your personal data is processed or not;
• Requesting information on your personal data;
• Finding out the purpose of processing your personal data and whether they are being processed in accordance with their purpose;
• Finding out third parties to whom your personal data transferred domestically abroad;
• Requesting correction of your personal data if it is incomplete or incorrectly processed;
• Requesting that your personal data be deleted within the framework of the conditions regulated in Article 7 of the Law;
• Requesting that the actions made in accordance with subparagraphs (e) and (f) above are notified to third parties to whom your personal data are transferred;
• Objecting to the emergence of a negative result against you by analyzing the processed data exclusively through automated systems; and
• Requesting the compensation of the loss if you suffer a loss due to the processing of your personal data against the provisions of the Law.

You can send your requests and complaints about your personal data to the Company, via kvkk@rain.com or rain@hs01.kep.tr. In accordance with Article 13 of the Law and Article 5 of the Communiqué on Procedures and Principles of Application to Data Controller published in the Official Gazette numbered 30356 and dated 10.03.2018 together with information that identifies your identity, you can send your written applications to address Maslak Mah. Sanatkarlar Sokak Eclipse Maslak Sitesi No:2 E Blok D: 9 Sarıyer / İstanbul / Turkiye by filling out the KVKK Application Form at Website. As a personal data subject, if you submit your requests regarding your rights to the Company by the methods set out above in this Legal Disclosure the Company will conclude the request free of charge within thirty days at the latest, according to the nature of the request. However, if a fee is foreseen by the Personal Data Protection Board, it will be charged.

This Legal Disclosure is updated on 20 November 2025. In case of any change in the text, the effective date and content of this Statement will be updated.

K. Updates

This Legal Disclosure may be updated to comply with changing conditions and legal regulations. You should frequently check our Website to see the latest changes. We will announce any significant changes to this Legal Disclosure on our Website or by sending an email to the address you provided in your account. Your continued use of Rain Türkiye Services following the changes made in this Legal Disclosure will mean that you have understood and accepted these updates.

Trade Registry Number: 255526-5

Mersis No.: 0734197139800001

Legal Name: RAİN KRİPTO VARLIK ALIM SATIM PLATFORMU A.Ş.

Address: Maslak Mah. Sanatkarlar Sokak Eclipse Maslak Sitesi No:2 E Blok D: 9 Sarıyer / İstanbul / Turkiye

Web site: https://www.rain.com/tr-tr

KEP Address: rain@hs01.kep.tr

I have read and understood this Legal Disclosure on the Processing of Personal Data and accept all its provisions.

*The English version of this Legal Disclosure has been prepared for information purposes only and in case of any discrepancy between English and Turkish text of the consent, Turkish text shall prevail.