KVKK POLICY

5.1 General Principles in the Processing of Personal Data

The Constitution provides that Personal Data may only be processed in cases stipulated by law or with the explicit consent of the person, thereby safeguarding the protection of Personal Data. In line with the rights granted to Data Subjects, our Company processes Personal Data in accordance with the principles set forth in the relevant legislation or, in cases where the explicit consent of Data Subjects is required, in accordance with the following principles:

• • Processing in Compliance with the Law and the Rules of Good Faith
• • Ensuring that Personal Data is Accurate and, Where Necessary, Kept Up to Date
• • Processing for Specific, Explicit and Legitimate Purposes
• • Being Relevant, Limited and Proportionate to the Purposes for Which They Are Processed
• • Retention for the Period Stipulated in the Relevant Legislation or Required for the Purpose for Which They Are Processed

5.2 Cases Where Explicit Consent Is Not Required for Processing Data Subjects' Personal Data

Where one of the conditions listed and exemplified below exists, Personal Data may be processed without seeking the explicit consent of the Data Subject.

• • Expressly provided for by laws: The obligation to include the name of the relevant natural person on an invoice pursuant to the Tax Procedure Law, etc.
• • Being necessary for the protection of the life or physical integrity of the person or of another person where the data subject is physically or legally incapable of giving consent: Cases where emergency medical intervention is required for the Data Subject, etc.
• • Being necessary for the processing of Personal Data belonging to the parties to a contract, provided that it is directly related to the establishment or performance of a contract: Obtaining address information for product shipment pursuant to a concluded contract, etc.
• • Being necessary for the data controller to fulfill its legal obligation: Conducting activity and audit in information systems to prevent unlawful access to Personal Data, etc.
• • Being made public by the Data Subject: The data subject sharing their Personal Data through a publicly accessible social media account, etc.
• • Being necessary for the establishment, exercise or protection of a right: Reporting the personnel information of Company employees to the Social Security Institution, etc.
• • Being necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the Data Subject are not harmed: Processing the Personal Data of employees during the organization of the Company's organizational structure, etc.

5.3 Conditions for Processing Special Categories of Personal Data

Our Company does not process Special Categories of Personal Data without the explicit consent of the data subject. However, Personal Data other than those relating to health and sexual life may be processed without seeking the explicit consent of the data subject in cases provided for by laws. Personal Data relating to health and sexual life may be processed by the Company without seeking the explicit consent of the data subject only for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and planning and management of health services and their financing, by persons under an obligation of confidentiality or by our Company.

5.4 Conditions for Transfer of Personal Data and Special Categories of Personal Data

Our Company does not transfer Personal Data without the explicit consent of Data Subjects. However, in the presence of the exceptions set forth in Articles 5.2 and, subject to adequate measures being taken, 5.3 of this Policy in accordance with the Law, such Personal Data may be transferred by our Company without seeking the explicit consent of Data Subjects.

5.5 Conditions for Transfer of Personal Data and Special Categories of Personal Data Abroad

Our Company may transfer the Personal Data and Special Categories of Personal Data of Data Subjects to third parties abroad, taking the necessary security measures and in compliance with the provisions of the legislation, in line with its Personal Data processing purposes.

In accordance with the Law, in the presence of the exceptions set forth in Articles 5.2 and, subject to adequate measures being taken, 5.3 of this Policy, our Company may transfer Personal Data abroad without seeking the explicit consent of the Data Subject, provided that adequate protection exists in the foreign country to which the Personal Data will be transferred, or where adequate protection does not exist, the data controllers in Turkey and in the relevant foreign country undertake adequate protection in writing and the consent of the Personal Data Protection Authority Board is obtained.

6.1 Classification of Personal Data

In accordance with Article 10 of the Law, our Company processes Personal Data in line with lawful personal data processing purposes;

• Based on one or more of the personal data processing conditions specified in Article 5 of the Law and limited thereto,
• In compliance with the general principles specified in Article 4 of the Law on the processing of Personal Data and other principles and obligations set forth in the legislation,
• Limited to the Data Subjects classified under this Policy,
• By indicating which of the Data Subjects classified under this Policy they relate to,
• By informing the Data Subjects.

The Personal Data processed by our Company in compliance with the legislation are classified below:

The types of Personal Data processed for the Data Subjects specified in Article 3 of this Policy are listed individually in the table below:

6.2 Conditions and Purposes for Processing Personal Data

As a rule, Personal Data may only be processed where the explicit consent of the Data Subject exists. The explicit consent of the Data Subject must be given on a specific subject, based on being informed, and expressed with free will. In addition, where one or more of the conditions set forth in Article 5.2 of this Policy exist, Personal Data may be processed without obtaining the explicit consent of the Data Subject.

Our Company processes Personal Data in all cases in accordance with the general principles set forth in Article 4 of the Law for the purposes and conditions specified below. Where the processing activity carried out for such purposes does not meet any of the conditions envisaged in Article 5.2 of this Policy, the explicit consent of the Data Subject will be obtained by our Company for the relevant processing process.

Personal Data is processed by our Company, limited to the following purposes:

• • Fulfillment of the statutory and contractual obligations that must be performed by our Company,
• • Establishing communication with Customers and Prospective Customers regarding products and/or services within the field of activity of our Company and group companies, conducting visits, concluding contracts;
• • Creating portfolios of Customers, Prospective Customers and Business Partners, provided that access is limited to authorized persons within our Company;
• • Enabling the provision of products and/or services within the field of activity of our Company and group companies to the relevant parties, carrying out necessary work by our Company's business units to enable Data Subjects to benefit from products and/or services, conducting marketing, procurement and all operational activities; enabling reconciliation, payment and collection transactions; establishing communication with Data Subjects for the performance of these transactions, sending/providing relevant documents and information,
• • Conducting, managing and auditing the financial and accounting processes of our Company; conducting financial audit reviews and completing financial audit forms;
• • Preparing current account cards as a basis for legal books and records kept by our Company,
• • Enabling access to records created by Data Subjects with our Company in subsequent business relationships, issuing invoices automatically;
• • Meeting the requests of credit and financial institutions providing financing to identify, analyze and verify their customers;
• • Preparing required documents (contracts, invoices, delivery notes, checks, signature circulars, powers of attorney, etc.) within the scope of activities carried out by our Company,
• • Organizing business travel to be made for business reasons within the scope of our Company's activities and arranging required documents for travel (visa, work permit, flight, vehicle and hotel reservations, etc.);
• • Adding necessary information to contracts to be signed with business partners, sharing information that must be shared with business partners under such contracts or obtaining relevant information from business partners, and carrying out required operations with business partners of our Company,
• • Participating in public and private sector tenders by our Company, submitting bids and carrying out works, and establishing communication for these purposes;
• • Preparing tender documentation in tenders in which our Company participates and/or in which it remains within the scope of its field of activity,
• • Conducting administrative and legal transactions, audits, recording incoming correspondence and distributing it to relevant departments; conducting legal correspondence and processes for the fulfillment of the legal and commercial obligations of our Company;
• • Carrying out operations relating to production, procurement, delivery, etc. regarding products and/or services offered by our Company and sharing related notifications of negotiation processes via mail, email, SMS and telephone,
• • In the sales and/or after-sales process and in new sales of products and/or services offered within the field of activity of our Company; renewing purchased products and/or services where necessary, meeting complaint or review requests relating to purchased products and/or services, and conducting information and audit in this regard,
• • In line with the purpose of determining and implementing the commercial and business strategies of our Company; conducting and managing internal system and application management operations, communication, market research and social responsibility activities, and financial operations as well as product/project/manufacturing/investment/quality processes by our Company,
• • Planning and/or implementing customer relationship management processes, including planning and/or implementing customer satisfaction activities; reaching customers, customer employees and/or consumers via mail, email and telephone in this direction; conducting service evaluation surveys;
• • Contacting Data Subjects who submit requests and complaints to our Company and ensuring the tracking and management of requests and complaints,
• • Conducting necessary information technology activities to ensure the security of data held by our Company, including obtaining external technical support services within this scope;
• • Where need arises within the scope of our Company's activities; contacting third parties, concluding contracts, obtaining services and ensuring their performance in areas such as training, transportation, information technology and similar fields;
• • Managing activities aimed at ensuring the physical security and supervision of locations belonging to our Company,
• • Identifying Visitors/Employees entering workplaces belonging to our Company, creating and tracking Visitor/Employee records,
• • Enabling entry of Employees and/or Business Partner Employees to workplaces belonging to our Company's Customers;
• • Ensuring field audits at workplaces belonging to our Company and at customer workplaces where our Company provides services;
• • Presenting the activities and previous works of our Company and group companies to Prospective Customers as references;
• • Conducting advertising and promotional processes within the scope of activities of our Company and group companies, conducting interviews, preparing news, establishing communication with persons featured in the news;
• • Creating personnel information of employees in accordance with the employment contract between the employee and our Company, keeping such information up to date, preserving it and storing it for the statute of limitations period stipulated by the legislation,
• • Paying the salary earned by the employee in return for their duties and documenting and controlling the payment, tracking advance payments and expenses made;
• • Providing information to relatives, health institutions or authorized authorities regarding employees in emergency situations, primarily for health reasons but not limited thereto;
• • Implementing the human resources policies of our Company, including conducting employee orientations and assignments; conducting employee competency and performance evaluations and auditing suitability for work; conducting career planning and promotion procedures; fulfilling statutory notification obligations; conducting field audits; managing employee leave procedures; organizing social activities and events aimed at increasing solidarity and motivation, announcing such social activities and events in the work environment, preparing bulletins; conducting social responsibility projects,
• • Evaluating employees in open positions outside the units in which they work in accordance with the human resources policies of our Company and temporarily or permanently assigning employees to relevant positions within the scope of employment contracts;
• • Providing work clothing to employees where required by their duties,
• • Ensuring employee transportation and making related planning within our Company;
• • Enabling employees to enter and exit the workplace, determining employee entry and exit times and absence status;
• • Enabling employees to enter and exit the customer workplace where they will provide on-site services;
• • Providing training to employees conducted within or outside the Company and preserving records relating to training in personnel files;
• • Setting up and backing up email accounts allocated to employees by our Company for use within the scope of our Company's activities, creating user accounts and passwords required for employee access to digital environments and software, implementing authorization limitations, allocating mobile phone lines and fixed lines and tracking them, and providing technical support within or outside the Company for these purposes;
• • Allocating vehicles and equipment to employees by our Company for use within the scope of our Company's activities, conducting vehicle location tracking and completing inventory forms;
• • Making employee assignments for planning, conducting, tracking and auditing works and transactions to be carried out within the scope of our Company's activities, creating records of employees assigned to follow up on work and updating them regularly;
• • Preparing required documents, announcements, information and information technology records for identification of employees as personnel of our Company by third parties or within our Company;
• • Ensuring occupational health and safety within our Company or within works followed within the scope of our Company's activities, providing training to employees within this scope, and fulfilling the statutory obligations of our Company and taking necessary measures regarding occupational health and safety, without being limited thereto;
• • Auditing the suitability of employees for work in terms of health status, tracking employee health reports within this scope, and conducting health checks upon return to work and periodically,
• • Conducting administrative and legal transactions and disciplinary investigations for the fulfillment of the legal and commercial obligations of our Company;
• • Establishing communication with employees via mail, email and telephone;
• • Evaluating and determining whether job applicants possess the necessary qualifications considering the position for which they applied or which was offered to them;
• • Evaluating and determining whether the health status of job applicants is suitable for the position for which they applied or which was offered to them;
• • Enabling job applicants to be evaluated in the event of an open position within our Company or, if approved, our Group Companies in the future;
• • Contacting the authorized representatives of natural and/or legal persons indicated as references by job applicants to request information regarding the position previously held by the job applicant;
• • Fulfilling statutory obligations in line with possible employment contracts to be established with job applicants;
• • Establishing communication with job applicants via mail, email and telephone;
• • Contacting Data Subject job applicants who submit requests to our Company and ensuring the tracking and management of their requests

within the scope of the personal data processing conditions set forth in Articles 5 and 6 of the Law.

6.3 Recipients to Whom Personal Data May Be Transferred

Personal Data belonging to Data Subjects may be transferred to the person categories listed below for the purposes set forth below, in compliance with the law and the purpose of the Law:

7.1 Method and Legal Basis for Collection of Personal Data

Personal Data is collected and processed by our Company or data processors appointed by our Company through all verbal, written and electronic means, by technical and other methods, through various channels such as call centers and websites, within the framework of legal grounds based on legislation, contracts or requests, for monitoring compliance with Articles 1 and 2 of the Law regulating purpose and scope, for achieving the purposes set forth in the Policy and in Articles 5 and 6 of the Law, and in order to fulfill statutory obligations completely and accurately.

7.2 Deletion, Destruction or Anonymization of Personal Data

Without prejudice to the provisions contained in the legislation regarding the deletion, destruction or anonymization of Personal Data, our Company deletes, destroys or anonymizes Personal Data ex officio or upon request of the Data Subject where the purposes requiring processing cease to exist, despite having been processed in accordance with the Law and the provisions of the relevant legislation. Pursuant to the Regulation on Deletion, Destruction or Anonymization of Personal Data;

• • Deletion of Personal Data means making Personal Data inaccessible and unusable in any way for relevant users;
• • Destruction of Personal Data means making Personal Data inaccessible, irretrievable and unusable in any way by any person;
• • Anonymization of Personal Data means making Personal Data incapable of being associated with an identified or identifiable natural person under any circumstances, even if matched with other data

as defined.

7.3 Retention Period of Personal Data

Our Company retains Personal Data for the period stipulated in the legislation where such a period is provided. However, where no period is stipulated for the retention of Personal Data, Personal Data is retained for the period required for processing in connection with the purpose for which our Company processes such data, in accordance with our Company's practices and commercial customs, or until the time when the Data Subject may make a request; thereafter it is deleted, destroyed or anonymized.

Personal Data for which the processing purpose has ended and Personal Data for which deletion/destruction/anonymization has been requested by Data Subjects may be retained only to serve as evidence in possible legal disputes or to enable the assertion of the relevant right connected to the Personal Data or establishment of a defense, where the relevant legislation and the retention periods determined by our Company have also expired. Our Company bases retention periods on statute of limitations periods provided for in the relevant legislation when determining retention periods for Personal Data. Personal Data retained for this purpose is accessed only by limited persons when required for the relevant legal dispute and cannot be accessed for any other purpose. At the end of this period, Personal Data is deleted, destroyed or anonymized.

9.1. Disclosure to the Data Subject

In accordance with Article 10 of the Law, our Company discloses information to Data Subjects at the time Personal Data is obtained. Within this scope, where applicable, it provides disclosure regarding the title and identity of the representative of our Company, the purposes for which Personal Data will be processed, to whom and for what purposes processed Personal Data may be transferred, the method and legal basis of Personal Data collection, and the rights of the Data Subject.

9.2. Rights of the Data Subject Under the Law

In accordance with Article 10 of the Law, our Company informs Data Subjects of their rights, guides them on how to exercise such rights, and implements the necessary internal procedures, administrative, legal and technical arrangements for all of these. In accordance with Article 11 of the Law, our Company informs Data Subjects whose Personal Data is processed by our Company that they have the right to:

• • Learn whether their Personal Data is being processed,
• • Request information if their Personal Data has been processed,
• • Learn the purpose of processing of their Personal Data and whether they are used in accordance with their purpose,
• • Know the third parties to whom their Personal Data is transferred domestically or abroad,
• • Request correction of their Personal Data if it is incomplete or inaccurate,
• • Request deletion or destruction of Personal Data if the reasons requiring processing cease to exist despite being processed in accordance with the provisions of the relevant legislation,
• • Request notification to third parties to whom Personal Data has been transferred of operations carried out pursuant to the right to request correction if Personal Data is incomplete or inaccurate, and pursuant to the right to request deletion or destruction if the purposes requiring processing cease to exist despite being processed in accordance with the provisions of the relevant legislation,
• • Object to the emergence of a result against themselves by analyzing processed Personal Data exclusively through automated systems,
• • Request compensation for damage if they suffer damage due to unlawful processing of their Personal Data

as explained.

9.3. Cases Where the Data Subject Cannot Exercise Their Rights

Pursuant to Article 28 of the Law, the following cases are excluded from the scope of the Law, and Data Subjects cannot exercise the rights listed in Article 9.2 of this Policy in such cases:

• • Processing of Personal Data within the scope of activities of natural persons relating entirely to themselves or family members living in the same household, provided that the data is not given to third parties and obligations relating to data security are complied with,
• • Processing of Personal Data for purposes such as research, planning and statistics by anonymizing them for official statistics,
• • Processing of Personal Data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public security, public order, economic security, privacy of private life or personality rights or constitute a crime,
• • Processing of Personal Data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public security, public order or economic security,
• • Processing of Personal Data by judicial authorities or execution authorities in relation to investigation, prosecution, trial or execution proceedings.

Again, pursuant to paragraph 2 of Article 28 of the Law; in the cases listed below, Data Subjects cannot exercise the rights listed in Article 9.2 of this Policy, except for the right to request compensation for damage:

• • Processing of Personal Data being necessary for the prevention of crime or criminal investigation;
• • Processing of Personal Data made public by the Data Subject;
• • Processing of Personal Data being necessary for authorized public institutions and organizations and professional organizations with public institution status to carry out supervisory or regulatory duties and disciplinary investigation or prosecution;
• • Processing of Personal Data being necessary to protect the economic and financial interests of the State regarding budget, tax and financial matters.

9.4. Exercise of Rights by the Data Subject

Information requests made by Data Subjects in line with their right to obtain information, among the rights specified above, regarding Personal Data relating to themselves in accordance with Article 20 of the Constitution are fulfilled by our Company in compliance with the legislation.

Our Company conducts the necessary channels, internal procedures, administrative and technical arrangements in accordance with Article 13 of the Law for the purpose of making necessary disclosures to Data Subjects. In this direction, where Data Subjects communicate their requests relating to the rights specified in Article 9.2 of this Policy to our Company, our Company provides an acceptance or reasoned rejection response to the request free of charge within 30 (thirty) days at the latest, depending on the nature of the request. However, where the transaction requires a separate cost, our Company may charge the fee in the tariff determined by the Personal Data Protection Authority Board. Data Subjects may communicate their requests to our Company through the "Application Form" set forth in the ANNEX.

Applications to be made by Data Subjects will be carried out through one of the following methods together with documents identifying the identity of the Data Subject:

• • Delivery of the completed form with wet signature in person, through a notary or by registered mail with return receipt to Ömerli Mah. Adnan Kahveci Cad. N.24 Arnavutköy/İstanbul,
• • Sending the form signed with secure electronic signature within the scope of the Electronic Signature Law No. 5070 to the registered email address at [],
• • Following a method envisaged or to be envisaged by the Personal Data Protection Authority Board.

For third parties to submit an application request on behalf of Data Subjects, a special power of attorney issued through a notary for the person who will apply on behalf of the Data Subject must be available.

Where the application is rejected, the response given is found insufficient, or no response is given to the application within 30 (thirty) days from the application, the Data Subject may apply to the Personal Data Protection Authority Board within 30 (thirty) days from learning our Company's response and in any case within 60 (sixty) days from the application date, pursuant to Article 14 of the Law.