POLICY ON THE PROCESSING, PROTECTION AND DESTRUCTION OF PERSONAL DATA

SECTION 1 - INTRODUCTION

1.1.INTRODUCTION

ÇALIK MAKİNA SAN. VE TİC. LTD. ŞTİ. (hereinafter referred to as “ÇALIK MAKİNA” or the “Company”) is aware that the protection of personal data, which is a constitutional right, also has an impact on conducting business relationships on a basis of trust.

Accordingly, our Company has made the Policy on the Processing, Protection and Destruction of Personal Data (the “Policy”), which serves as a guide for fulfilling its obligations regarding the protection and processing of personal data in compliance with the law, available to relevant persons.

6698 sayılı Kişisel Verilerin Korunması Kanunu (hereinafter referred to as the “KVKK”) constitutes the legal basis of this Policy. Ensuring compliance with legal regulations concerning the protection of personal data, particularly the KVKK, is among our Company’s priorities.

Within this scope, ÇALIK MAKİNA takes the necessary administrative and technical measures to protect personal data processed pursuant to the applicable legislation. This Policy provides detailed explanations of the following fundamental principles adopted by ÇALIK MAKİNA in the processing of personal data:

1.Processing personal data lawfully and fairly,

2.Keeping personal data accurate and, where necessary, up to date,

3.Processing personal data for specified, explicit and legitimate purposes,

4.Processing personal data in a manner that is relevant, limited and proportionate to the purposes for which they are processed,

5.Retaining personal data for the period stipulated in the relevant legislation or required for the purpose for which they are processed,

6.Providing clarification and information to personal data subjects,

7.Establishing the necessary system for personal data subjects to exercise their rights,

8.Taking the necessary measures for the retention of personal data,

9.Complying with the relevant legislation and the regulations of the Kişisel Verileri Koruma Kurulu when transferring personal data to third parties in line with the requirements of the processing purpose,

10.Exercising due care in the processing and protection of special categories of personal data.

1.2.PURPOSE

The primary purpose of this Policy is to provide explanations regarding the personal data processing activities carried out lawfully by ÇALIK MAKİNA and the systems adopted for the protection of personal data; to ensure that the Company establishes and implements its own standards in personal data management; to define and support organizational objectives and obligations; to fulfill the Company’s obligations arising from international conventions, Anayasa, laws and agreements in the field of personal data protection; and to protect the interests of individuals in the best possible manner.

By publishing this Policy, ÇALIK MAKİNA aims to provide the necessary information regarding its personal data processing activities and thereby ensure that such activities are carried out transparently and in compliance with the legislation.

1.3.SCOPE

In addition to determining the conditions for processing personal data, the Policy sets out the fundamental principles adopted by ÇALIK MAKİNA in the processing of personal data.

The scope of this Policy covers all personal data of employees, job applicants, relatives of employees, interns, suppliers, Company shareholders, customers, persons who are the subject of news, and third parties that are processed by automated means or by non-automated means provided that such processing forms part of a data filing system.

1.4.DEFINITIONS

Personal Data            :Any information relating to an identified or identifiable natural person.

Data Subject            :The natural person whose personal data is processed.

Data Controller   :The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system.

Kanun      :6698 sayılı Kişisel Verilerin Korunması Kanunu

Yönetmelik    :Kişisel Verilerin Silinmesi, Yok Edilmesi veya Anonim Hale Getirilmesi Hakkında Yönetmelik

Kurul                :Kişisel Verileri Koruma Kurulu.

Special Categories of Personal Data  :Data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, religious sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Processing of Personal Data    :Any operation performed on personal data, such as obtaining, recording, storing, retaining, altering, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, whether wholly or partly by automated means or by non-automated means provided that such processing forms part of a data filing system.

Explicit Consent            :Consent relating to a specific subject, based on information and expressed with free will.

Recipient Group            :The category of natural or legal persons to whom personal data is transferred by the data controller.

Data Processor            :The natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.

Personal Data Processing Inventory    :An inventory in which data controllers detail the personal data processing activities they carry out depending on their business processes by associating them with the purposes and legal grounds for processing personal data, the data category, the recipient group to which data is transferred and the group of data subjects, and by explaining the maximum retention period required for the purposes for which personal data is processed, the personal data intended to be transferred to foreign countries and the measures taken regarding data security.

Recording Medium            :Any medium containing personal data processed wholly or partly by automated means or by non-automated means provided that such processing forms part of a data filing system.

Destruction                :The deletion, destruction or anonymization of personal data.

Anonymization        :Rendering personal data impossible to associate with an identified or identifiable natural person under any circumstances, even by matching it with other data.

Deletion of Personal Data    :Rendering personal data inaccessible and unusable for the relevant users in any way.

Destruction of Personal Data    :The process of rendering personal data inaccessible, irretrievable and unusable by anyone in any way.

Periodic Destruction            :The deletion, destruction or anonymization process to be carried out ex officio at recurring intervals specified in the Policy when all conditions for processing personal data set forth in the Law cease to exist.

Policy    :ÇALIK MAKİNA SAN. VE TİC. LTD. ŞTİ.’s Policy on the Processing, Protection and Destruction of Personal Data.

1.5.APPLICATION OF THE POLICY AND RELEVANT LEGISLATION

The applicable legal regulations in force concerning the processing and protection of personal data shall primarily apply. In the event of any inconsistency between the legislation in force and the Policy, our Company accepts that the legislation in force shall prevail.

The Policy has been prepared by concretizing and regulating the rules set forth by the relevant legislation within the scope of ÇALIK MAKİNA practices. Our Company maintains the necessary systems and preparations in order to act in accordance with the effective dates stipulated in the KVKK.

1.6.EFFECTIVE DATE

This Policy issued by our Company is dated 03/06/2024. If the entire Policy or certain provisions are renewed, the effective date of the Policy will be updated.

The Policy is published on our Company’s website (www.calikmakina.com) and is made available to relevant persons upon the request of personal data subjects.

1.7.UPDATING THE POLICY

ÇALIK MAKİNA reserves the right to amend the Policy due to changes in the Law or developments in the sector or in the field of information technologies.

Amendments made to this Policy are immediately incorporated into the text, and explanations regarding the amendments are provided at the end of the Policy.

SECTION 2 - MATTERS REGARDING THE PROTECTION OF PERSONAL DATA

In accordance with Article 12 of the KVKK, our Company takes the necessary technical and administrative measures to ensure an appropriate level of security in order to prevent unlawful processing of the personal data it processes, prevent unlawful access to such data and ensure the retention of the data, and conducts the necessary audits within this scope.

2.1.ENSURING THE SECURITY OF PERSONAL DATA

2.1.1.Technical and Administrative Measures Taken to Ensure Lawful Processing of Personal Data, Prevent Unlawful Access to Personal Data and Store Personal Data in Secure Environments

• Our Company takes technical and administrative measures, according to technological capabilities and implementation costs, to ensure that personal data is processed lawfully.

• Our Company takes technical and administrative measures, according to the nature of the data to be protected, technological capabilities and implementation costs, to prevent negligent or unauthorized disclosure, access, transfer or any other form of unlawful access to personal data.

• Our Company takes the necessary technical and administrative measures, according to technological capabilities and implementation costs, to ensure that personal data is stored in secure environments and to prevent its unlawful destruction, loss or alteration.

TECHNICAL MEASURES

• Network security and application security are ensured.

• Encryption is applied.

• Security measures are taken within the scope of the procurement, development and maintenance of information technology systems.

• An authorization matrix has been established for employees.

• Up-to-date antivirus systems are used.

• Firewalls are used.

ADMINISTRATIVE MEASURES

• Key management is implemented.

• Awareness activities on data security are conducted for employees.

• Necessary security measures are taken regarding entry to and exit from physical environments containing personal data.

• Personal data is minimized as much as possible.

• Confidentiality undertakings are obtained.

• Executed agreements contain data security provisions.

• Personal data security policies and procedures have been established.

• Necessary security measures are taken regarding entry to and exit from physical environments containing personal data.

• The security of environments containing personal data is ensured.

2.1.2.Audit of Measures Taken for the Protection of Personal Data

In accordance with Article 12 of the KVKK, our Company conducts the necessary internal audits. The results of these audits are reported to the relevant department within the Company’s internal operations, and the necessary activities are carried out to improve the measures taken.

2.1.3.Measures to Be Taken in the Event of Unauthorized Disclosure of Personal Data

In accordance with Article 12 of the KVKK, our Company operates a system that ensures that, if personal data processed is obtained by others through unlawful means, this situation is notified to the relevant personal data subject and the Kişisel Verileri Koruma Kurulu as soon as possible.

If deemed necessary by the Kişisel Verileri Koruma Kurulu, this situation may be announced on the Board’s website or by another method.

2.2.OBSERVANCE OF THE RIGHTS OF DATA SUBJECTS; ESTABLISHMENT OF CHANNELS THROUGH WHICH THESE RIGHTS MAY BE SUBMITTED TO OUR COMPANY AND EVALUATION OF DATA SUBJECT REQUESTS

In accordance with Article 13 of the KVKK, our Company maintains the necessary channels, internal procedures, and administrative and technical arrangements for evaluating the rights of personal data subjects and providing them with the necessary information.

If personal data subjects submit their requests regarding the rights listed below to our Company in writing, our Company concludes the request as soon as possible and no later than thirty days, depending on the nature of the request.

Personal data subjects have the right to;

a) Learn whether personal data is processed,

b) Request information if personal data has been processed,

c) Learn the purpose of processing personal data and whether it is used in accordance with that purpose,

d) Know the third parties to whom personal data is transferred domestically or abroad,

e) Request correction of personal data if it has been processed incompletely or incorrectly,

f) Request the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the KVKK,

g) Request that the transactions carried out pursuant to items (e) and (f) above be notified to third parties to whom personal data has been transferred,

h) Object to the occurrence of a result against you due to the analysis of processed data exclusively by automated systems,

i) Request compensation for damages in the event of suffering damage due to the unlawful processing of personal data.

More detailed information on the rights of data subjects is provided in Section 10 of this Policy.

2.3.PROTECTION OF SPECIAL CATEGORIES OF PERSONAL DATA

Under the KVKK, certain personal data is given special importance and sensitivity due to the risk that unlawful processing may cause victimization or discrimination.

Such data includes data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, religious sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Our Company exercises particular care in protecting special categories of personal data designated as “special categories” under the KVKK and processed lawfully. Within this scope, the technical and administrative measures taken by our Company for the protection of personal data are carefully applied to special categories of personal data, and the necessary audits are conducted within ÇALIK MAKİNA.

Detailed information regarding the processing of special categories of personal data is provided in Section 3 of this Policy.

2.4.INCREASING AND AUDITING THE AWARENESS OF BUSINESS UNITS REGARDING THE PROTECTION AND PROCESSING OF PERSONAL DATA

Our Company ensures that the necessary training is provided to business units in order to increase awareness aimed at preventing unlawful processing of personal data, preventing unlawful access to data and ensuring data retention.

2.5.INCREASING AND AUDITING THE AWARENESS OF BUSINESS PARTNERS AND SUPPLIERS REGARDING THE PROTECTION AND PROCESSING OF PERSONAL DATA

Our Company provides the necessary information to its business partners in order to increase awareness aimed at preventing unlawful processing of personal data, preventing unlawful access to data and ensuring data retention. Agreements, protocols and confidentiality agreements executed between suppliers and our Company refer to the necessary notices required under personal data protection legislation.

All users are aware that they share responsibility for the security of the information systems components they use and for personal data.

2.6.RECORDING MEDIA

Personal data belonging to data subjects is securely stored by ÇALIK MAKİNA in the environments specified below, in compliance with the relevant legislation, particularly the provisions of the KVKK, and within the framework of international data security principles.

The recording media used for storing personal data are generally listed below. However, some data may be kept in environments different from those shown here due to their special characteristics or our legal obligations. In all cases, ÇALIK MAKİNA acts as the data controller and processes and protects personal data in accordance with the Law and this Policy.

Physical environments;

• Paper

• Office

• Office cabinet

• archive room

Electronic environments;

• Physical & Virtual server

• Physical & Virtual server (Cloud)

• Database

• Software

• Portable devices (phone, notebook, iPad)

• Desktop computer

• Audio-visual recording devices

• Data Center (External)

• Data Center (Internal)

SECTION 3 - MATTERS REGARDING THE PROCESSING OF PERSONAL DATA

3.1.PROCESSING OF PERSONAL DATA IN ACCORDANCE WITH THE PRINCIPLES STIPULATED IN THE LEGISLATION

3.1.1.Processing in Accordance with Law and Good Faith

Our Company acts in accordance with the principles introduced by legal regulations and with the general rules of trust and good faith in the processing of personal data. Within this scope, our Company takes proportionality requirements into account when processing personal data and does not use personal data beyond what is required by the purpose.

3.1.2.Ensuring that Personal Data Is Accurate and Up to Date Where Necessary

Taking into account the fundamental rights of personal data subjects and its own legitimate interests, our Company ensures that the personal data it processes is accurate and up to date. It takes the necessary measures accordingly.

3.1.3.Processing for Specified, Explicit and Legitimate Purposes

Our Company clearly and precisely determines its legitimate and lawful purpose for processing personal data. Our Company processes personal data only to the extent connected with and necessary for the services it provides. The purpose for which personal data will be processed is determined by our Company before the personal data processing activity begins.

3.1.4.Being Relevant, Limited and Proportionate to the Purpose for Which They Are Processed

Our Company processes personal data in a manner suitable for achieving the specified purposes and avoids processing personal data that is unrelated to or unnecessary for achieving those purposes. For example, personal data processing activities are not carried out to meet needs that may arise in the future.

3.1.5.Retention for the Period Stipulated in the Relevant Legislation or Necessary for the Purpose for Which They Are Processed

Our Company retains personal data only for the period specified in the relevant legislation or required for the purpose for which it is processed. Within this scope, our Company first determines whether the relevant legislation stipulates a retention period for personal data; if a period is specified, it complies with that period, and if no period is specified, it retains personal data for the period necessary for the purpose for which it is processed. Upon expiry of the period or when the reasons requiring processing cease to exist, personal data is deleted, destroyed or anonymized by our Company. Personal data is not retained by our Company merely on the possibility that it may be used in the future. Detailed information on this matter is provided in Section 9 of this Policy.

3.2.PROCESSING OF PERSONAL DATA BASED ON AND LIMITED TO ONE OR MORE OF THE PERSONAL DATA PROCESSING CONDITIONS SPECIFIED IN ARTICLE 5 OF THE KVKK

The protection of personal data is a constitutional right. Fundamental rights and freedoms may be restricted, without infringing upon their essence, only by law and solely for the reasons specified in the relevant articles of Anayasa. Pursuant to the third paragraph of Article 20 of Anayasa, personal data may be processed only in cases stipulated by law or with the explicit consent of the person. Accordingly, and in compliance with Anayasa, our Company processes personal data only in cases stipulated by law or with the explicit consent of the person. Detailed information on this matter is provided in Section 7 of this Policy.

3.3.CLARIFICATION AND INFORMATION OF THE PERSONAL DATA SUBJECT

In accordance with Article 10 of the KVKK and the Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ, our Company informs personal data subjects at the time personal data is obtained. Within this scope, ÇALIK MAKİNA provides information regarding the identity of the data controller and, if any, its representative; the purposes for which personal data will be processed; to whom and for what purposes processed personal data may be transferred; the method and legal basis for collecting personal data; and the rights of the personal data subject. Detailed information on this matter is provided in Section 10 of this Policy.

Article 20 of Anayasa establishes that everyone has the right to be informed about personal data concerning them. Accordingly, Article 11 of the KVKK lists the “right to request information” among the rights of the personal data subject. Within this scope, our Company provides the necessary information when the personal data subject requests information, in accordance with Article 20 of Anayasa and Article 11 of the KVKK. Detailed information on this matter is provided in Section 10 of this Policy.

3.4.PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA

Our Company strictly complies with the regulations stipulated in the KVKK when processing personal data designated as “special categories” under the KVKK.

Article 6 of the KVKK designates certain personal data as “special categories” because unlawful processing may create a risk of victimization or discrimination. Such data includes race, ethnic origin, political opinions, philosophical beliefs, religion, religious sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

In accordance with the KVKK, special categories of personal data may be processed by our Company where:

a) The data subject has given explicit consent,

b) It is expressly stipulated by law,

c) Processing is necessary for the protection of the life or physical integrity of the person who is unable to express consent due to actual impossibility or whose consent is not legally valid, or of another person,

d) It relates to personal data made public by the data subject and is consistent with the intention of making it public,

e) Processing is necessary for the establishment, exercise or protection of a right,

f) Processing is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of healthcare services, by persons subject to an obligation of confidentiality or by authorized institutions and organizations,

g) Processing is necessary for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance,

h) Processing is carried out by foundations, associations and other non-profit organizations or formations established for political, philosophical, religious or trade-union purposes, provided that it is in accordance with the legislation and purposes to which they are subject, limited to their fields of activity and not disclosed to third parties, and relates to their current or former members and affiliates or persons who are in regular contact with such organizations and formations.

3.5.TRANSFER OF PERSONAL DATA

Our Company may transfer the personal data and special categories of personal data of the personal data subject to third parties (authorized public institutions and organizations, natural persons or private-law legal entities) by taking the necessary security measures in line with lawful personal data processing purposes. In this regard, our Company acts in accordance with the regulations stipulated in Article 8 of the KVKK. Detailed information on this matter is provided in Section 6 of this Policy.

3.5.1.Transfer of Personal Data

In line with its legitimate and lawful personal data processing purposes, our Company may transfer personal data to third parties based on and limited to one or more of the personal data processing conditions specified in Article 5 of the Law and listed below:

• If the personal data subject has given explicit consent;

• If there is an explicit provision in the laws regarding the transfer of personal data,

• If it is necessary to protect the life or physical integrity of the personal data subject or another person, and the personal data subject is unable to express consent due to actual impossibility or the consent is not legally valid;

• If the transfer of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract,

• If the transfer of personal data is mandatory for our Company to fulfill its legal obligation,

• If the personal data has been made public by the personal data subject,

• If the transfer of personal data is necessary for the establishment, exercise or protection of a right,

• If the transfer of personal data is necessary for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the personal data subject.

3.5.2.Transfer of Special Categories of Personal Data

Special categories of personal data may be transferred by our Company in accordance with the principles set out in this Policy, by taking all necessary administrative and technical measures, including the methods to be determined by the Board, and where the following conditions exist:

a) The data subject has given explicit consent,

b) It is expressly stipulated by law,

c) Processing is necessary for the protection of the life or physical integrity of the person who is unable to express consent due to actual impossibility or whose consent is not legally valid, or of another person,

d) It relates to personal data made public by the data subject and is consistent with the intention of making it public,

e) Processing is necessary for the establishment, exercise or protection of a right,

f) Processing is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of healthcare services, by persons subject to an obligation of confidentiality or by authorized institutions and organizations,

g) Processing is necessary for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance,

h) They may be transferred where the processing is carried out by foundations, associations and other non-profit organizations or formations established for political, philosophical, religious or trade-union purposes, provided that it is in accordance with the legislation and purposes to which they are subject, limited to their fields of activity and not disclosed to third parties, and relates to their current or former members and affiliates or persons who are in regular contact with such organizations and formations.

SECTION 4 - PERSONAL DATA PROCESSED BY OUR COMPANY, PURPOSES OF PROCESSING AND RETENTION PERIODS

In accordance with Article 10 of the KVKK, within the scope of its obligation to inform, our Company notifies the personal data subject, upon request, of which groups of personal data subjects’ data it processes, the purposes for processing the personal data subject’s personal data and the retention periods.

4.1.CLASSIFICATION OF PERSONAL DATA

Within our Company, relevant persons are informed pursuant to Article 10 of the KVKK, and personal data in the categories specified below is processed in line with our Company’s legitimate and lawful personal data processing purposes, based on and limited to one or more of the personal data processing conditions specified in Article 5 of the KVKK, in compliance with all general principles set forth in the KVKK, particularly the principles regarding the processing of personal data specified in Article 4, and all obligations regulated under the KVKK, and limited to the periods specified in this Policy. The data subjects to whom the personal data processed in these categories relate within the scope of this Policy are also specified in Section 5 of this Policy.

PERSONAL DATA CLASS            DESCRIPTION OF PERSONAL DATA CLASS

Identity Information  All information contained in valid official documents bearing a photograph, such as a driver’s license, identity card or passport, which clearly belongs to an identified or identifiable natural person and is processed wholly or partly by automated means or by non-automated means as part of a data filing system.

Contact Information    Information such as telephone number, address and e-mail address, which clearly belongs to an identified or identifiable natural person and is processed wholly or partly by automated means or by non-automated means as part of a data filing system.

Personnel Information    Any personal data processed for the purpose of obtaining information that forms the basis for the personal rights of our employees or natural persons who have a working relationship with the Institution, which clearly belongs to an identified or identifiable natural person and is processed wholly or partly by automated means or by non-automated means as part of a data filing system.

Legal Transaction Information    Personal data processed within the scope of determining and pursuing our legal claims and rights, performing our obligations, fulfilling our statutory obligations and complying with the Institution’s policies, which clearly belongs to an identified or identifiable natural person and is processed wholly or partly by automated means or by non-automated means as part of a data filing system.

Financial Information    Personal data relating to information, documents and records showing any financial result generated depending on the type of legal relationship established between our Company and the personal data subject, which clearly belongs to an identified or identifiable natural person and is processed wholly or partly by automated means or by non-automated means as part of a data filing system.

Professional Experience Information    Personal data relating to a person’s professional experience, which clearly belongs to an identified or identifiable natural person and is processed wholly or partly by automated means or by non-automated means as part of a data filing system.

Visual and Audio Records    Visual and audio personal data relating to a person, which clearly belongs to an identified or identifiable natural person and is processed wholly or partly by automated means or by non-automated means as part of a data filing system.

Customer Transaction Information    Records regarding the use of our products and services and information required for the customer to use the products and services, which clearly belongs to an identified or identifiable natural person and is contained in a data filing system.

Social Life and Habit Information    Information regarding the social life and habits of relevant persons, which clearly belongs to an identified or identifiable natural person and is contained in a data filing system.

Special Categories of Personal Data Personal data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, religious sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, which clearly belongs to an identified or identifiable natural person and is processed wholly or partly by automated means or by non-automated means as part of a data filing system, constitutes special categories of personal data.

4.2.PURPOSES OF PROCESSING PERSONAL DATA

Our Company processes personal data solely for the purposes and under the conditions set out among the personal data processing conditions specified in paragraph 2 of Article 5 and paragraph 3 of Article 6 of the KVKK. These purposes and conditions are as follows;

• Where the relevant activity of the Institution concerning the processing of personal data is expressly stipulated by law and within the framework of its legal obligations arising from the relevant legislation

• Where the processing of personal data by our Company is directly related to and necessary for the establishment or performance of a contract,

• Where processing of personal data is mandatory for our Company to fulfill its legal obligations,

• Provided that your personal data has been made public by the relevant person; processing by our Company limited to the purpose for which it was made public,

• Where the processing of your personal data by our Company is mandatory for the establishment, exercise or protection of the rights of our Company, the relevant persons or third parties,

• Where personal data processing is mandatory for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the relevant person,

• Where personal data processing by our Company is mandatory for the protection of the life or physical integrity of the personal data subject or another person, and in such case the personal data subject is unable to express consent due to actual impossibility or legal invalidity,

• Where the processing of special categories of personal data other than data concerning the health and sexual life of the personal data subject is stipulated by law,

• Where special categories of personal data concerning the health and sexual life of the personal data subject are processed by persons under an obligation of confidentiality or by authorized institutions and organizations for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing.

In accordance with the personal data processing conditions explained above, your personal data and special categories of personal data may be processed by ÇALIK MAKİNA for the following purposes:

    

• providing information to authorized persons, institutions and organizations

• conducting occupational health/safety activities

• conducting training activities

• ensuring the security of movable assets and resources

• conducting audit/ethics activities

• receiving and evaluating suggestions for improving business processes

• planning human resources processes

• conducting retention and archiving activities

• conducting communication activities

• following up and conducting legal affairs

• conducting finance and accounting activities

• conducting contract processes

• conducting employee fringe benefit and benefit processes

• fulfilling obligations arising from employment contracts and legislation for employees

• conducting activities to ensure business continuity

• conducting emergency management processes

• conducting internal audit/investigation/intelligence activities

• conducting assignment processes

• conducting/monitoring business activities

• conducting activities in compliance with legislation

• conducting investigation activities

• conducting job applicant application processes

• conducting management activities

• planning and carrying out certification activities

• conducting intern selection and placement processes

4.3.RETENTION PERIODS OF PERSONAL DATA

Where stipulated in the relevant laws and legislation, our Company retains personal data for the periods specified in such legislation.

If the legislation does not prescribe a period for how long personal data must be retained, personal data is processed for the period required in connection with the services provided by our Company while processing such data, in accordance with our Company’s practices and commercial customs, and is subsequently deleted or destroyed. Detailed information on this matter is provided in Section 9 of this Policy.

If the purpose of processing personal data has ended and the retention periods determined by the relevant legislation and the Company have also expired, personal data may be retained solely for the purpose of serving as evidence in possible legal disputes, asserting the relevant right associated with the personal data, or establishing a defense. In determining these periods, the limitation periods for asserting the relevant right and examples of requests previously submitted to our Company on the same matters even after the expiry of such limitation periods are taken as the basis for determining retention periods. In this case, the retained personal data is not accessed for any other purpose and is accessed only when it needs to be used in the relevant legal dispute. Once the period referred to here expires, the personal data is deleted, destroyed or anonymized.

Personal data whose retention period has expired is destroyed, within the destruction periods, in accordance with the procedures set out in this Policy at six-monthly intervals. All transactions relating to the deletion, destruction and anonymization of personal data are recorded, and such records are retained for at least 3 (three) years, without prejudice to other legal obligations.

4.4.PERIODIC DESTRUCTION PERIOD

Pursuant to Article 11 of the Kişisel Verilerin Silinmesi, Yok Edilmesi veya Anonim Hale Getirilmesi Hakkında Yönetmelik, ÇALIK MAKİNA has determined the periodic destruction period as 6 months. Periodic destruction periods begin for the first time in June 2024 and recur every 6 (six) months.

SECTION 5 - MATTERS REGARDING THE OWNERS OF PERSONAL DATA PROCESSED BY OUR COMPANY

Although our Company processes the personal data of the categories of personal data subjects listed below, the scope of application of this Policy is limited to employees, job applicants, relatives of employees, interns, suppliers, Company shareholders, customers, persons who are the subject of news, and third parties.

Although the categories of persons whose personal data is processed by our Company are within the scope specified above, persons outside these categories may also submit requests to our Company under the KVKK, and such requests will also be evaluated within the scope of this Policy.

The table below details the categories of personal data subjects specified above and the types of personal data processed for persons within these categories.

PERSONAL DATA CATEGORY            OWNER OF THE RELEVANT PERSONAL DATA

Identity Information    employee, job applicant, employee relative, intern, shareholder, supplier, person who is the subject of news, third party, customer.

Contact Information    employee, job applicant, intern, shareholder, supplier, customer.

Personnel Information        Employee, job applicant, intern.

Legal Transaction Information        Employee, shareholder, third party.

Financial Information        Employee, job applicant, supplier, shareholder, customer.

Professional Experience Information        Employee, job applicant, employee relative, shareholder, intern.

Visual and Audio Records        Employee, job applicant, intern, shareholder.

Customer Transaction Information                Supplier, customer, employee.

Social Life and Habit Information        Employee, job applicant.

Special Categories of Personal Data        Employee, employee relative, intern, shareholder.

SECTION 6 - THIRD PARTIES TO WHOM PERSONAL DATA IS TRANSFERRED AND PURPOSES OF TRANSFER

In accordance with Article 10 of the KVKK, our Company informs the personal data subject of the groups of persons to whom personal data is transferred.

In accordance with Articles 8 and 9 of the KVKK, our Company may transfer personal data to the recipient groups listed below:

• Authorized public institutions and organizations

• Natural persons or private-law legal entities

• Suppliers

• Customers

• Company shareholders

• Publicly available

• Lawyers

• Banks

• Accountants

• Certified Public Accountant

• Workplace physician

• Occupational health and safety specialist

• Law Enforcement Authorities

SECTION 7 - CONDITIONS FOR PROCESSING PERSONAL DATA

In accordance with Article 10 of the KVKK, our Company informs the personal data subject about the personal data it processes.

7.1.PROCESSING OF PERSONAL DATA AND SPECIAL CATEGORIES OF PERSONAL DATA

7.1.1.Processing of Personal Data

The explicit consent of the personal data subject is only one of the legal grounds that makes it possible to process personal data lawfully. Apart from explicit consent, personal data may also be processed if one of the other conditions set out below exists. The basis of a personal data processing activity may be only one of the conditions specified below, or more than one of these conditions may constitute the basis of the same personal data processing activity. If the processed data is a special category of personal data, the conditions set out under heading 7.1.2 below in this section shall apply.

Although the legal grounds for the processing of personal data by our Company may vary, all personal data processing activities are carried out in accordance with the general principles specified in Article 4 of the KVKK.

7.1.2.Existence of the Explicit Consent of the Personal Data Subject

One of the conditions for processing personal data is the explicit consent of the data subject. The explicit consent of the personal data subject must relate to a specific subject, be based on information, and be expressed freely.

The purpose of processing relating to the reasons for obtaining personal data (primary processing) For personal data processing activities other than the above (secondary processing), at least one of the conditions set out in items (ii), (iii), (iv), (v), (vi), (vii) and (viii) under this heading is required; if none of these conditions exists, such personal data processing activities are carried out by our Company based on the explicit consent of the personal data subject for those processing activities.

1. Expressly Stipulated by Law

The personal data of the data subject may be processed lawfully where expressly stipulated by law.

2. Inability to Obtain the Explicit Consent of the Data Subject Due to Actual Impossibility

The personal data of the data subject may be processed where processing is necessary to protect the life or physical integrity of the person who is unable to express consent due to actual impossibility or whose consent cannot be deemed legally valid, or of another person.

3. Direct Relation to the Establishment or Performance of a Contract

Personal data may be processed where it is necessary to process personal data belonging to the parties to a contract, provided that such processing is directly related to the establishment or performance of the contract.

4. Fulfillment of the Company’s Legal Obligation

The personal data of the data subject may be processed where processing is mandatory for our Company to fulfill its legal obligations as the data controller.

5. Making Personal Data Public by the Personal Data Subject

Where the data subject has made their personal data public, the relevant personal data may be processed.

6. Necessity of Data Processing for the Establishment or Protection of a Right

The personal data of the data subject may be processed where data processing is necessary for the establishment, exercise or protection of a right.

7. Necessity of Data Processing for the Legitimate Interests of Our Company

The personal data of the data subject may be processed where data processing is necessary for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the personal data subject.

7.1.3.Processing of Special Categories of Personal Data

Special categories of personal data are processed by our Company in the following cases, provided that adequate measures to be determined by the Kişisel Verileri Koruma Kurulu are taken:

a) The data subject has given explicit consent,

b) It is expressly stipulated by law,

c) Processing is necessary for the protection of the life or physical integrity of the person who is unable to express consent due to actual impossibility or whose consent is not legally valid, or of another person,

d) It relates to personal data made public by the data subject and is consistent with the intention of making it public,

e) Processing is necessary for the establishment, exercise or protection of a right,

f) Processing is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of healthcare services, by persons subject to an obligation of confidentiality or by authorized institutions and organizations,

g) Processing is necessary for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance,

h) Processing is carried out by foundations, associations and other non-profit organizations or formations established for political, philosophical, religious or trade-union purposes, provided that it is in accordance with the legislation and purposes to which they are subject, limited to their fields of activity and not disclosed to third parties, and relates to their current or former members and affiliates or persons who are in regular contact with such organizations and formations.

SECTION 8 - CONDITIONS FOR DELETION, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA

As regulated in Article 138 of the Turkish Penal Code and Article 7 of the KVKK, even where personal data has been processed in accordance with the relevant provisions of law, if the reasons requiring its processing cease to exist, the personal data is deleted, destroyed or anonymized based on our Company’s own decision or upon the request of the personal data subject.

8.1.ÇALIK MAKİNA’S OBLIGATION TO DELETE, DESTROY AND ANONYMIZE PERSONAL DATA

As regulated in Article 138 of the Turkish Penal Code and Article 7 of the KVKK, even where personal data has been processed in accordance with the relevant provisions of law, if the reasons requiring its processing cease to exist, the personal data is deleted, destroyed or anonymized based on our Company’s own decision or upon the request of the personal data subject. Within this scope, our Company fulfills the relevant obligation using the methods described in this section.

8.1.1.Techniques for Deletion and Destruction of Personal Data

Even where personal data has been processed in accordance with the relevant provisions of law, our Company may delete or destroy personal data based on its own decision or upon the request of the personal data subject if the reasons requiring its processing cease to exist. The deletion or destruction techniques most commonly used by our Company are listed below:

1. Physical Destruction

Personal data may also be processed by non-automated means provided that such processing forms part of a data filing system. When such data is deleted/destroyed, a system of physically destroying the personal data in a manner that prevents subsequent use is applied. The methods that may be used are as follows:

• Shredding documents;

• Burning;

• Tearing (so that they become unreadable);

• Obscuring the data.

2. Secure Deletion by an Expert

In some cases, ÇALIK MAKİNA may engage an expert to delete personal data on its behalf. In such cases, the personal data is securely deleted/destroyed by a person who is an expert in this field in a manner that prevents recovery.

SECTION 9 - RIGHTS OF PERSONAL DATA SUBJECTS AND EXERCISE OF THESE RIGHTS

In accordance with Article 10 of the KVKK, our Company informs the personal data subject of their rights and provides guidance on how these rights may be exercised. In addition, in accordance with Article 13 of the KVKK, our Company maintains the necessary channels, internal procedures, and administrative and technical arrangements for evaluating the rights of personal data subjects and providing them with the necessary information.

9.1.RIGHTS OF THE DATA SUBJECT AND EXERCISE OF THESE RIGHTS

9.1.1.Rights of the Personal Data Subject

Personal data subjects have the right to;

a) Learn whether personal data is processed,

b) Request information if personal data has been processed,

c) Learn the purpose of processing personal data and whether it is used in accordance with that purpose,

d) Know the third parties to whom personal data is transferred domestically or abroad,

e) Request correction of personal data if it has been processed incompletely or incorrectly,

f) Request the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the KVKK,

g) Request that the transactions carried out pursuant to items (e) and (f) above be notified to third parties to whom personal data has been transferred,

h) Object to the occurrence of a result against you due to the analysis of processed data exclusively by automated systems,

i) Request compensation for damages in the event of suffering damage due to the unlawful processing of personal data.

9.1.2.Cases Where the Personal Data Subject Cannot Assert Their Rights

Pursuant to Article 28/1 of the KVKK, personal data subjects cannot assert the rights listed in 10.1.1 in the following matters, as the cases below are excluded from the scope of the KVKK:

1. Processing personal data for purposes such as research, planning and statistics by anonymizing it with official statistics.

2. Processing personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public security, public order, economic security, privacy or personality rights and does not constitute a crime.

3. Processing personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations that are assigned duties and powers by law for the purpose of ensuring national defense, national security, public security, public order or economic security.

4. Processing personal data by judicial authorities or enforcement authorities in relation to investigation, prosecution, trial or execution proceedings.

Pursuant to Article 28/2 of the KVKK, in the cases listed below, personal data subjects cannot assert the other rights listed in 10.1.1, except for the right to request compensation for damages:

1. Where personal data processing is necessary for the prevention of a crime or for a criminal investigation.

2. Processing personal data that has been made public by the personal data subject.

3. Where personal data processing is necessary, based on authority granted by law, for the performance of supervisory or regulatory duties or for disciplinary investigation or prosecution by authorized and competent public institutions and organizations and professional organizations having the status of public institutions.

4. Where personal data processing is necessary for the protection of the economic and financial interests of the State in relation to budgetary, tax and financial matters.

9.1.3.Exercise of the Rights of the Personal Data Subject

Personal data subjects may submit their requests regarding the rights listed under Heading 10.1.1 of this section by completing the “Data Subject Application Form” and sending it, with a wet signature or secure electronic signature, by post to ÇALIK MAKİNA SAN. VE TİC. LTD. ŞTİ. at “Kemalpaşa OSB 19. Sokak No:16 Kemalpaşa İzmir”.

It is not possible for third parties to submit requests on behalf of personal data subjects.

For a person other than the personal data subject to submit a request, there must be a special power of attorney issued by the personal data subject in the name of the person who will make the application regarding the matter.

Pursuant to the provisions of the Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ, applications must be made in Turkish. Applications must include name, surname and, if the application is in writing, signature; T.C. kimlik numarası for Turkish citizens; nationality and passport number/identity number for foreigners; residential or workplace address for notification; e-mail address for notification, if any; telephone or fax number; and the subject of the request.

The method of application is also explained in detail in the application form that personal data subjects will complete in order to exercise their rights.

9.1.4.Right of the Personal Data Subject to Lodge a Complaint with the Kişisel Verileri Koruma Kurulu

Pursuant to Article 14 of the KVKK, if the application is rejected, the response given is found insufficient, or no response is given to the application within the prescribed period, the personal data subject may lodge a complaint with the Kişisel Verileri Koruma Kurulu within thirty days from the date they learn of our Company’s response and, in any event, within sixty days from the date of application.

9.2.ÇALIK MAKİNA’S RESPONSE TO APPLICATIONS

9.2.1.Our Company’s Response to Applications and Response Period

If the personal data subject submits their request to our Company in accordance with the procedure set out under heading 10.1.3 of this section, our Company will conclude the relevant request free of charge as soon as possible and no later than thirty days, depending on the nature of the request.

However, if the transaction requires an additional cost, the fee in the tariff determined by the Kişisel Verileri Koruma Kurulu will be charged to the applicant by our Company.

9.2.2.Information Our Company May Request from the Applying Personal Data Subject

Our Company may request information from the relevant person in order to determine whether the applicant is the personal data subject.

Our Company may ask the personal data subject questions regarding their application in order to clarify the matters contained in the application.

9.2.3.Our Company’s Right to Reject the Application of the Personal Data Subject

Our Company may reject an applicant’s application in the cases listed below by explaining the reason for the rejection:

1. Processing personal data for purposes such as research, planning and statistics by anonymizing it with official statistics.

2. Processing personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public security, public order, economic security, privacy or personality rights and does not constitute a crime.

3. Processing personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations that are assigned duties and powers by law for the purpose of ensuring national defense, national security, public security, public order or economic security.

4. Processing personal data by judicial authorities or enforcement authorities in relation to investigation, prosecution, trial or execution proceedings.

5. Where personal data processing is necessary for the prevention of a crime or for a criminal investigation.

6. Processing personal data that has been made public by the personal data subject.

7. Where personal data processing is necessary, based on authority granted by law, for the performance of supervisory or regulatory duties or for disciplinary investigation or prosecution by authorized and competent public institutions and organizations and professional organizations having the status of public institutions.

8. Where personal data processing is necessary for the protection of the economic and financial interests of the State in relation to budgetary, tax and financial matters.

9. Where the request of the personal data subject is likely to interfere with the rights and freedoms of other persons

10. Where requests require disproportionate effort.

11. Where the requested information is publicly available.

SECTION 10 - RELATIONSHIP OF THE POLICY ON THE PROCESSING, PROTECTION AND DESTRUCTION OF PERSONAL DATA WITH OTHER POLICIES

Fundamental policies concerning the protection and processing of personal data have been established in relation to the principles set forth by the Company in this Policy. By linking these policies with the fundamental policies carried out by the Company in other areas, the Company aims to ensure transparency and accountability regarding the personal data processing activities it conducts.

ÇALIK MAKİNA SAN. VE TİC. LTD. ŞTİ.