Personal Data Protection (KVKK)

DATA CONTROLLER AND THE OBLIGATION TO INFORM

ASARTECH Arge Tasarım Mühendislik Anonim Şirketi ("ASARTECH" or the "Company") respects your privacy and attaches the utmost care to the security of your data. With this awareness, it attaches great importance to the processing and storage of all personal data belonging to every person associated with ASARTECH, including those who benefit from our products and services, in accordance with the Turkish Personal Data Protection Law No. 6698 (the "KVKK").

This Information Notice has been prepared by ASARTECH, acting as data controller under the KVKK, within the framework of Article 10 of the KVKK, titled 'Data Controller's Obligation to Inform', and Article 11, titled 'Rights of the Data Subject', in order to inform you about the methods of collection, and the processing, use, transfer and destruction of your personal data.

COLLECTION OF PERSONAL DATA

Your personal data is collected by our Company's units and processes, our social media channels, and the natural or legal persons with whom our Company cooperates or whom it authorises, and their employees, by automatic or non-automatic means — verbally, in writing, electronically or through similar means — without compromising our quality, through documents and records such as our offices, the website, social media channels, media and broadcasting outlets, mobile applications, contact forms, complaint forms, invoices, telephone or face-to-face meetings, contracts, e-mails, correspondence, announcements and application forms; based on various legal or commercial grounds, in physical or electronic environments, for the purposes of providing mutual benefit, fulfilling in-company requirements and/or maintaining or developing our activities, or fulfilling obligations arising from legislation.

PURPOSES OF PROCESSING PERSONAL DATA

Your personal data is processed verbally, in writing or in electronic form, within the framework of Articles 4, 5 and 6 of the KVKK, for the purposes of:

• Conducting finance and accounting affairs,
• Contract management, and the follow-up and conduct of legal affairs,
• Conducting human resources processes and activities within the defined legal framework,
• Planning, Supervision, Execution and Emergency Management of Facility, Personnel and Information/Data Security,
• Creation and Management of Information Technology Infrastructure,
• Conducting communication/event activities and customer/supplier relationship management processes,
• Enabling our Company to perform, fully and duly, its contractual and/or statutory obligations regarding the planning and/or execution of activities ensuring administrative and operational business continuity (R&D, design, project management, service/production, supply, sales, marketing, quality, after-sales support, etc.) and the planning and/or execution of corporate sustainability activities,
• Retention and archiving arising from legislation, providing information to authorised persons, institutions and organisations, reporting, and fulfilling other obligations defined by legislation.

In addition, in the cases set out in Articles 5 and 6 of the KVKK, we may process your personal data without seeking explicit consent.

TO WHOM AND FOR WHAT PURPOSES PERSONAL DATA MAY BE TRANSFERRED

Our Company may transfer your personal data only on the basis of the data subject's explicit consent, or where transfer is expressly provided for by law (primarily the legislation to which we are subject), is necessary for the establishment or performance of a contract, is mandatory for the fulfilment of a legal obligation, or is required by a legitimate interest — provided that adequate measures are taken within the framework of the security and confidentiality principles set out in the KVKK, and for the purpose of conducting the Company's activities — to our direct/indirect, domestic/foreign affiliates; the legal and natural persons with whom we have agreements as required by our activities; suppliers; subcontractors; our business partners; our shareholders; legal, financial and tax advisers; auditors and audit firms; or public institutions and organisations authorised to request such data under a legal obligation; and to other relevant persons or institutions within the framework of the personal data processing conditions and purposes set out in Articles 8 and 9 of the KVKK.

Although our company will establish a transaction/establish a contract to take adequate measures within the framework of the security and confidentiality principles specified in the KVKK; In the country where your data will be transferred, there may be no data protection regulation equivalent to the legislation of the Republic of Turkey, your data may be accessed by the local authorities of that country for national security reasons and in this case, your right-searchy may be difficult.

SECURITY OF PERSONAL DATA

In order to prevent the unlawful processing of and access to personal data, and so that the natural and legal persons we cooperate with do not suffer any harm, our Company takes all necessary technical and administrative measures to safeguard personal data and to ensure an appropriate level of security.

In this context, it is ensured that the software we use in our activities complies with standards, that the third parties we work with are selected with care, that our employees receive training in this respect, and that the "Personal Data Retention and Destruction Policy" is observed in Company practices.

Where our website redirects to other sites or applications, our Company has no knowledge of the compliance of the redirected sites and applications with the legislation on the protection of personal data, and bears no responsibility for their privacy policies or content.

DELETION OF PERSONAL DATA

Our Company retains the personal data it processes for the periods specified in the applicable legislation or, provided that this does not conflict with the applicable legislation, in Company procedures and policies.

Where no period is separately specified in the legislation, personal data is retained, in connection with the services our Company provides while processing that data, for as long as its processing is required in line with our Company's practices and commercial custom, and thereafter only for the periods shown to be necessary in practice for the data to serve as evidence in potential legal disputes.

After the expiry of the stated periods, the personal data in question is deleted or destroyed using the methods defined in Company procedures and policies.

APPLICATION AND RIGHT TO INFORMATION

You may apply to our Company regarding your personal data if you wish to exercise any of the rights explained below under Article 11 of the KVKK:

• To learn whether your personal data is processed,
• To request information if your personal data has been processed,
• To learn the purpose of processing and whether your data is used in accordance with that purpose,
• To know the third parties to whom your personal data is transferred, in Turkey or abroad,
• To request the correction of your personal data if it is incomplete or inaccurately processed,
• To request the erasure or destruction of your personal data under the conditions set out in the KVKK legislation,
• When you request the correction of incomplete or inaccurate data or the erasure or destruction of your personal data, to request that this be notified to the third parties to whom your personal data has been transferred,
• To object to a result arising against you through the analysis of the processed data exclusively by automated systems,
• To claim compensation for damages if you suffer damage due to the unlawful processing of your personal data.

Applications must be made to our Company in writing, or by the other methods determined by the Personal Data Protection Board. In the link below, there is an application form and explanations for you to apply.

Within the framework of the Law on the Protection of Personal Data No. 6698 (“KVKK”), I accept and declare that I have read and understood the “Clarification Text” within the scope of the Protection of Personal Data presented to me by ASARTECH Arge Tasarım Mühendislik Anonim Şirketi (“ASARTECH” or “Company”), and that I have been informed about the purposes for which legal reasons my personal data is processed, stored, to whom and for what purposes it may be transferred.

In this context; my personal data (name, surname, e-mail, phone, company, country and message content) that I share through the contact and offer request forms on the website and other personal data declared/to be declared by me;

➢ To be collected, recorded, preserved and processed in line with the purposes specified in the Clarification Text,
➢ To contact me in order to evaluate, respond and follow up my request,
➢ Provided that it is in accordance with the KVKK and other applicable legislation, for the purposes specified in the Clarification Text; I accept and declare that I have given my express consent of my free will, without being under any pressure or coercion, regarding the transfer of ASARTECH to business partners, suppliers, persons, institutions and organizations from which it receives and/or serves, other persons, institutions and organizations with which it cooperates and to legally authorized public institutions and organizations.

REQUESTS OF THE APPLICANT

The Turkish Personal Data Protection Law No. 6698 (the "KVKK") grants personal data subjects, defined in the KVKK as the relevant person (hereinafter referred to as the "Applicant"), the right to make certain requests regarding the processing of their personal data under Article 11 of the KVKK.

We would like to emphasise that an applicant may only apply on their own behalf; if our Company determines that an application has been made on behalf of another person, the application will be rejected. For this reason, our Company may ask the applicant various questions for identity verification.

Within this framework, you can submit your applications to our Company using the "Personal Data Information Request Application Form" at the end of this text.

APPLICATION ON BEHALF OF ANOTHER PERSON

If the application is to be made on behalf of another person, an official document evidencing the applicant's authority to represent the person concerned (a power of attorney, a court decision for custody/guardianship, etc.) must be attached to the application.

Where no authorisation document is provided, in accordance with the principle of the protection of personal data, the application will not be accepted and no information will be shared.

Obtaining another person's personal data by deliberately providing false information constitutes the offence of "Unlawful Acquisition of Personal Data" under Article 136 of the Turkish Criminal Code. A prison sentence of 2 to 4 years is prescribed for persons committing this offence.

APPLICATION CHANNELS

Pursuant to the first paragraph of Article 13 of the KVKK, applications regarding these rights must be submitted to our Company, as data controller, in writing or by the other methods determined by the Personal Data Protection Board (the "Board").

In this framework, for "written" applications to our Company, you can print out the "Personal Data Information Request Application Form" at the end of this text, fill it in completely and, bearing your wet signature, deliver it to the address "ASARTECH ARGE TASARIM MÜHENDİSLİK ANONİM ŞİRKETİ, Sanayi Mahallesi, Teknopark Bulvarı, Yeditepe Üniversitesi Arge Merkezi Blok No: 1/7/C No:306 34906 Pendik İstanbul/Türkiye":

• in person, by hand delivery, or
• via a notary public, or by registered mail with return receipt.

Alternatively, you may send it by e-mail to our registered electronic mail (KEP) address asartech@hs03.kep.tr, signed with a "secure electronic signature" as defined in the Electronic Signature Law No. 5070.

VERIFICATION OF THE APPLICATION

Since the request must belong to the applicant, and pursuant to the principle of confidentiality, identity verification is carried out for applications. If additional information or documents are needed to verify the identity of the person making the application, additional documentation may be requested from the applicant.

If the available information is not sufficient to verify identity, or if it is not possible to associate the personal data with the person making the application, the application will be rejected.

REVIEW OF THE APPLICATION

Pursuant to the second paragraph of Article 13 of the KVKK, applications submitted to us will be answered within 30 (thirty) days from the date your request reaches us, depending on the nature of the request. For written applications, the application date is deemed to be the date the application is served on our Company. For applications made by electronic means, the date the application reaches our Company is regarded as the application date.

If the information and documents submitted to our Company within the scope of the request are incomplete or unclear, the applicant may be contacted in order to clarify the application.

If the request in the application is accepted, our Company will conclude the necessary action as soon as possible and free of charge.

Our Company may accept the request, or may reject it by explaining its grounds, and its response will be communicated to the applicant. Requests may also be partially accepted or partially rejected.

Pursuant to Article 14 of the KVKK, if the application is rejected, the response given is found insufficient, or no response is given in due time, the applicant may lodge a complaint with the "Board" within thirty days from the date they learn of our Company's response and, in any event, within sixty days from the application date.

DELIVERY OF THE RESPONSE

Our response to your application will be delivered to you by the notification method you selected in the "Personal Data Information Request Application Form".

We would like to note that, if the action within the scope of the application requires an additional cost, the fee in the tariff determined by the "Board" may be charged. In addition, where the response must be provided on recording media such as CDs or flash drives, we reserve the right to request from the applicant a fee equal to the cost of the recording medium in question.

For your request under the KVKK to be fulfilled, please print out the application form below, fill it in clearly and completely (attaching the necessary information and documents, if any), and submit it to our Company using one of the delivery methods described above.