Borusan Ventures Corp. (“Borusan”, “we” or “us”) respect your right to privacy. This Privacy Policy explains how we may collect, share, use and process personal information about you, and how you can exercise your privacy rights. It applies to personal information we collect by means of (i) our social media and website located at https://borusanventures.com (the “Site”); (ii) any sub-pages, portals, or investor platforms we control; (iii) integrations with Borusan Business Partners (as defined below); and (iv) direct offline communications, including telephone calls, email exchanges, video conferences, investor questionnaires, pitch decks, and other materials you provide in connection with a potential or actual investment by Borusan (together, the “Services”).

We may provide additional or supplemental privacy notices or policies for specific products or services that we offer at the time of collection. Unless otherwise noted, those supplemental notices should be read together with this Privacy Policy.

1. Information We Collect

When you use our Services, we collect personal information about your use of our Services and information that you send us.

Collected Information. We primarily collect personal information that you provide through the Contact Form on our Website, including your name, email, phone number (“Personal Information”), and company details, as well as materials you choose to submit such as pitch decks or business presentations. We also automatically collect limited technical information (such as IP address, browser type, and log data) through cookies and similar technologies (see our Cookie Policy for details).

Google reCAPTCHA. We use Google reCAPTCHA on our Website to protect against spam and abuse. reCAPTCHA analyzes interactions on the site (such as IP address, mouse movements, and device/browser information) to determine whether the user is a human or a bot. This functionality is provided by Google LLC and is subject to Google’s own Privacy Policy and Terms of Service, available at: https://policies.google.com/privacy and https://policies.google.com/terms.

Borusan Business Partners. You acknowledge and agree that the Services you receive may include services and offerings from third parties who provide technology, compliance, or investment support, among others, to Borusan (such third parties, “Borusan Business Partners”). When we receive personal information about you from third parties, including but not limited to Borusan Business Partners, and use such information, this can include: your name, email address, contact information, the company you work for, your position, business and home address, identification and background information, professional experience and qualifications, previous positions, financial information, such as payment related information and shareholdings, and other personal information. It may also include information about the organization you are affiliated with, including sensitive and confidential information.

Social Networks. If you connect to us from a social network, such as LinkedIn or Facebook, we will collect personal information from the social network in accordance with your privacy settings on that social network. The connected social network may provide us with information such as your name, profile picture, network, gender, username, user ID, age or age range, language, country, friends list, follower list, and any other information you have agreed it can share or that the social network provides to us. We will assume that such social network or other third parties are entitled to collect and share such personal information with us.

Sensitive Information. We may collect sensitive information about you when you use our Services. Any use of such information is limited to such purposes described to you at the time of collection.

2. How and Why We Use Your Information

To Evaluate Investment Opportunities. We process personal information submitted by founders and startups (e.g., pitch decks, business plans, financials, contact details) in order to assess whether to pursue an investment. Without this information, we cannot evaluate or respond to investment opportunities.

To Respond to Inquiries and Communicate. We use contact information and related data when you reach out to us with questions, proposals, or other communications. This enables us to respond, follow up, and maintain an ongoing dialogue.

For Relationship Management. We maintain records of our interactions with founders, co-investors, and advisors to ensure effective collaboration and to track our investment activities over time.

For Legal and Regulatory Compliance. We process personal information as necessary to comply with our obligations under applicable laws, including anti-money laundering (AML), know-your-customer (KYC), sanctions screening, tax, and corporate governance requirements.

To Enforce Our Agreements and Protect Rights. We may process information to investigate, prevent, or mitigate any prohibited or unlawful activities, violations of our policies, or disputes, and to enforce our agreements with third parties.

To Ensure Security and Integrity. We process technical and organizational information to maintain the security of our systems, to monitor for malicious or fraudulent activity, and to prevent unauthorized access to data we hold.

For Research and Development. We analyze how startups, partners, and visitors interact with our website and communications to improve our sourcing, diligence, and investment processes. Where possible, we use de-identified or aggregated information.

For Marketing and Events. We may use contact information to send updates about Borusan Ventures, investment-related newsletters, or invitations to events. You may opt out of receiving such communications at any time by following the unsubscribe instructions in our emails.

For Recruitment. If you apply for a position with us, we process personal information to evaluate your candidacy.

3. Information Sharing and Disclosure

We do not sell, exchange, transfer, or give your personal information to any other company or individual for any reason except as set forth in this Privacy Policy and as described below:

• Borusan Affiliated Entities. We may share your information with our affiliate entities, including colleagues and affiliates in the United States, the European Union, and Turkey in connection with evaluating investment opportunities.
  
  
• Borusan Business Partners. We share information with Borusan Business Partners, including law firms which advise and represent us, and other third parties who may be involved in the performance of the Services.
  
  
• Our Service Providers. We share information with our service providers, suppliers, subcontractors, and similar third parties who provide services to us or our affiliates, or act on our behalf so that they can assist us with the maintenance of our Services. Our contracts with these service providers prohibit them from sharing your personal information with others for other purposes than as directed by us. Use of Google reCAPTCHA means that certain technical data (such as IP address and interaction data) may be transmitted to Google for security purposes.
  
  
• Corporate Reorganization. We may transfer information to a third party in case of the reorganization, sale, merger, joint venture, assignment, transfer or other disposition of all or any portion of our business, asset or stocks, including in the event of corporate restructuring. We reserve the right, as part of this transaction, to transfer or assign personal information we have collected from you to these third parties. Except as otherwise provided by a bankruptcy or other court, the use and disclosure of all personal information will be subject to policies that are consistent with the policies described in this Privacy Policy. However, any personal information that is submitted or collected after that transfer may be subject to a new privacy policy adopted by the successor entity.
  
  
• Legal Concerns or Liabilities. We may share your information with regulators or authorities where required by law.
  
  
• Your Consent. We will disclose your information to a person you have given us your consent to disclose to or as required to complete the Services.

 

4. Security

We seek to use reasonable technical, organizational, and administrative measures to protect user information within our organization against unauthorized or unlawful access or processing, and against accidental loss, destruction, or damage. We believe that these measures are reasonably adapted to the nature of the information in our custody. In addition to the security measures detailed above, we protect personal information by taking measures: (i) to protect the ongoing confidentiality, integrity, availability, and resilience of our processing systems and services; (ii) to restore the availability of and access to personal information in a timely manner in the event of a physical or technical incident; and (iii) to regularly test, assess, and evaluate the effectiveness of our technical and organizational measures.

However, even though Borusan makes reasonable efforts to protect information in its custody, no security system or data storage or transmission over the Internet or otherwise is fully secure. Thus, we cannot guarantee the security of any information we may have collected or received from you or transmitted to you.

If you believe your information is not secure, please immediately notify us of the problem at the address provided in the “How to Contact Us” section below.

5. Retention

We retain information about you for as long as necessary to perform the activities described in this Privacy Policy, or where we have an ongoing legitimate business need to do so, such as for legal, regulatory, accounting or reporting requirements.

When our legitimate interest for retaining your personal information ceases to exist, we will either delete or anonymize your information so that it can no longer be attributed to a particular individual. To the extent residual information remains within our databases, back-ups or other records and we are unable to anonymize it we will isolate such information from further processing until deletion is possible. If you have any questions, please feel free to contact us.

Personal information submitted through our Contact Form is retained in our Outlook system for up to three years, after which it is automatically deleted.

6. Children’s Information

We do not knowingly collect any personal information from children under 16. If we become aware that an individual under the age of 16 is submitting information without consent from their parent or legal guardian or as permitted under applicable law, we will delete the information as soon as possible from our database. If you believe we are collecting information about an individual under 16, please notify us immediately so that we can take appropriate action.

7. Privacy Rights and Choices

Depending on applicable law where you reside or are located, you may be able to assert certain rights identified below with respect to your personal information. Any rights you may have in relation to your personal information are not absolute. We reserve the right to refuse to act on a request that is manifestly unfounded or excessive (for example because it is repetitive) and/or to charge a fee that takes into account the administrative costs for providing the information or taking the action requested.

• Right to Know/Access. You may have the right to obtain a copy, or a list of categories of the personal information that we hold about you, as well as other supplementary information, such as the purposes of processing, and the entities to whom we disclose your personal information.
  
  
• Right to Correct. You may have the right to correct any of your personal information in our records and systems. You may request us to rectify, correct or update any of your personal information held by us that is inaccurate.
  
  
• Right to Delete. Under certain circumstances, you may have the right to request that we delete the Personal Information that we hold about you. This right is not absolute, and we may refuse such a request if there are compelling legitimate grounds for keeping your personal information, for legitimate purposes, or as required by law. In addition, in the event your deletion request is honored, we may retain a record of your deletion request as required under applicable law.
  
  
• Right to Portability. You have the right to receive a copy of the personal information we have collected about you in a structured, commonly used and machine-readable format.
  
  
• Right to Opt-Out of Automated Decision-making or Profiling. You may have the right not to be subject to a decision which significantly impacts your rights that is based solely on automated processing (where a decision is taken about you using an electronic system without human involvement). No decision will be made by us about you solely on the basis of automated decision making which has a significant impact on you.
  
  
• Right to Appeal. In certain jurisdictions, you may have the right to appeal if we refuse to take action on your rights request. Instructions on how to appeal will be provided to you upon such a denial, but in any event, such instructions will be substantially similar to those provided below for submitting requests.
  
  
• Right Against Discrimination. You may have the right not to be discriminated against for exercising any of the rights described in this section. We will not discriminate against you for exercising your rights.

We do not sell your personal information. We do not share your personal information for targeted advertising. We do not process any information that may be considered “sensitive personal information”, under certain laws, to infer characteristics about you.

To make a privacy rights request, please contact us by email at holdingkvkk@borusan.com. To confirm your identity, we may ask you to verify personal information we already have on file for you. If we cannot verify your identity based on the information we have on file, we may request additional information from you, which we will only use to verify your identity, and for security or fraud-prevention purposes.

In your request, please make clear what information you would like to have changed, whether you would like to have your personal information correct, deleted, or other limitations you would like to put on our use of your personal information. We may only implement requests with respect to personal information that is associated with the particular email address that you use to send your request.

You may use an authorized agent to submit a rights request on your behalf. If you use an authorized agent to submit requests on your behalf, we will require you to directly verify your identity with us, or have you directly confirm with us that the authorized agent has been authorized to act on your behalf.

Depending upon the applicable law, access to your rights may be denied: (a) when denial of access is required or authorized by law; (b) when granting access would have a negative impact on another’s privacy; (c) to protect our rights and properties; or (d) where the request is frivolous or vexatious, or for other reasons.

For individuals located in the European Economic Area, Switzerland or the United Kingdom during data collection, please refer to Section 9 below for more information about your rights.

 8. International Transfers of Personal Information

This section only applies to individuals who do not reside in the United States, the European Economic Area, Switzerland or the United Kingdom. As a global organization, we may store, process and transmit personal information in locations around the world, including locations outside of the country or jurisdiction where you are located and reside, including the United States and Turkey. Such countries or jurisdictions may have data protection laws that are less protective than the laws of the jurisdiction in which you reside. If you do not want your information transferred to or processed or maintained outside of the country or jurisdiction where you are located, you should not use our Services.

9. Notice to Individuals in the European Economic Area, Switzerland and the United Kingdom

This section only applies to individuals using or accessing our Services while located in the European Economic Area (“EEA”), the United Kingdom and/or Switzerland (collectively, the “Designated Countries”) at the time of data collection.

We may ask you to identify which country you are located in when you use or access some of the Services, or we may rely on your IP address to identify which country you are located in. When we rely on your IP address, we cannot apply the terms of this section to any individual that masks or otherwise hides their location information from us so as not to appear located in the Designated Countries. If any terms in this section conflict with other terms contained in this Policy, the terms in this section shall apply to individuals in the Designated Countries.

For the purposes of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the data controller for the personal information you provide or that we collect in connection with the Services is Borusan (“Controller”). In certain cases, Borusan Ventures may share control of personal information with its affiliated entities for evaluation of investment opportunities. Where this is the case, the relevant affiliate will also be considered a Controller.
Where Google acts as an independent controller of data collected through reCAPTCHA, its processing is subject to Google’s own privacy notices. We rely on our legitimate interest in securing our Website as the lawful basis for using reCAPTCHA.

Legal Basis. Article 6(1) of the GDPR describes when processing can be done lawfully. When we process your personal information for a specified purpose, we shall apply one of the Article 6 legal bases described below, including any Article 9 conditions for processing special categories of personal information.

• Whenever we require your consent for the processing of your personal information such processing will be based on Article 6(1)(a) GDPR.
  
  
• If the processing of your personal information is necessary for the performance of a contract between you and Borusan or for taking any pre-contractual steps upon your request, such processing will be based on Article 6(1)(b) GDPR. If this data is not processed, Borusan will not be able to execute the contract with you.
  
  
• Where the processing is necessary for us to comply with a legal obligation, we will process your information on basis of Article 6(1)(c) GDPR, for example for complying with obligations under anti-money laundering laws.
  
  
• Where the processing is necessary for the purposes of Controller’s or another party’s legitimate interests, such processing will be made in accordance with Article 6(1)(f) GDPR, for example to enforce legal claims.

Below is a chart indicating the legal bases we rely on in processing personal information.

Purposes of Processing	Legal Basis for Processing
To Provide the Services and Evaluate Investment Opportunities To Respond to Your Inquiries and Communicate To Enforce our Agreements and Protect Rights For Relationship Management To Ensure the Security and Integrity of the Services. Share with Borusan Business Partners	Processing is based on our contract obligations or to take steps at the request of the individual prior to entering into a contract.
For Research and Development Sharing Due to Corporate Reorganization	Processing is based on our legitimate interest to better understand you, to maintain and improve the accuracy of the information we store about you, and to better promote or optimize our Services.
To Ensure the Security of the Services. To Share Due to Law Enforcement Requests To Enforce our Terms and Agreements	Processing is necessary for compliance with our legal obligations, the public interest, or in your vital interests.

If, in the future, we use your personal information in any way that is not described in this Privacy Policy, we will disclose this to you. At that time, you can choose not to allow us to use your personal information for any purpose that is incompatible with the purposes for which we originally collected it or subsequently obtained your consent. If you choose to limit the ways we can use your personal information, some or all of the Services may not be available to you. Also, we may have legitimate reasons to still use your personal information even though you did not allow us to.

Individual Rights. We take reasonable steps to ensure that your personal information is accurate, complete, and up to date. You have the right to access, correct, or delete the personal information that we collect. You are also entitled to restrict or object, at any time, to the further processing of your personal information. You have the right to receive your personal information in a structured and standard format and, where technically and legally feasible, the right to have your personal information transmitted directly to a third party. If you would like to exercise your rights under applicable law, or if you believe we have infringed or violated your privacy rights, please contact us at holdingkvkk@borusan.com. so that we may resolve your dispute directly. You also have a right to lodge a complaint with a competent supervisory authority situated in country or state of your habitual residence or place of alleged infringement.

International Transfers of Personal Information. If we share your personal information with entities located in the United States or other non-EEA jurisdictions which, according to the European Commission, do not offer an adequate level of protection to personal information we implement specific contracts, approved by the European Commission, which ensure the same protection to personal information as granted in the EEA, or other appropriate solutions to address cross-border transfers as required or permitted by Articles 46 and 49 of the GDPR. Where required by such laws, you may request a copy of the suitable mechanisms we have in place by contacting us.

10. Notice to California Residents

The California Consumer Privacy Act of 2018, as amended by the Consumer Privacy Rights Act of 2020 (“CCPA”), requires us to explain the “Personal Information” categories, as identified and defined by the CCPA (see California Civil Code section 1798.140(o)), that we collect, the reason we collect the Personal Information, where we obtain the Personal Information, and the other entities with whom we may share the Personal Information. Under the CCPA, Personal Information is defined as any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“Personal Information”).

We generally collect the following categories of Personal Information in providing our Services:

• identifiers such as a name, address, unique personal identifier, email, phone number, your device’s IP address, software, and identification numbers associated with your devices;
  
  
• characteristics of protected classifications under California or federal law, such as gender, if voluntarily provided;
  
  
• Internet or other electronic information regarding you browsing history, search history, the webpage visited before you came to our website, length of visit and number of page views, click-stream data, locale preferences, your mobile carrier, date and time stamps associated with transactions, system configuration information, and interaction data collected via cookies and Google reCAPTCHA when visiting our Website;
  
  
• Professional and employment-related information (such as role, CV or background information submitted in connection with an investment opportunity); and
  
  
• Business and financial information (such as pitch decks, business plans, and related financials voluntarily submitted to us).

The categories of other individuals or entities with whom we may share your Personal Information are listed in Section 3 above.

California law requires us to inform California residents who have provided us with personal information that they may request of us information about our disclosures to third parties for their direct marketing purposes. To do so, contact us holdingkvkk@borusan.com and indicate in the subject line “California Privacy Rights.”
Do Not Track. Please note that we do not currently respond to web browser “do not track” signals or other mechanisms that may allow you to opt out of the collection of information across networks of websites and online services as there is no standard for how online services should respond to such signals.

11. Turkish Personal Data Protection Law

For your rights under the Turkish Personal Data Protection Law, Law No. 6698 (Kişisel Verilerin Korunması Kanunu), please see https://www.borusan.com/kvkk and https://www.borusan.com/en/kvkk.

12. Links to Third Party Services

Our Services may include links to third party services, including Borusan Business Partners, where you might be able to post comments, reviews, or view third party information, and receive services which are similar to or integrated with the Services. Please note, the inclusion of a link on our Services to a third party’s service, including but not limited to a Borusan Business Partner, does not imply endorsement of the third party’s data handling practices, and does not imply that the third party’s practices are covered by this Privacy Policy. We are not responsible for the privacy practices of these entities.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The effective date of the current Privacy Policy is noted at the top of this page.

If we make material changes to the way we collect, use, share or process the personal information that you have provided that adversely impact you, we will notify you by posting it on the Services or other appropriate means. Any modifications to this Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). In all cases, your use of the Services after the effective date of any modified Privacy Policy indicates your acknowledging that the modified content of the Privacy Policy applies to your interactions with the Services and our business.

14. How to Contact Us

You can contact us via email at holdingkvkk@borusan.com.
Updated August 28, 2025.