1. INTRODUCTION TO THE POLICY

The Personal Data Protection Law no. 6698 is among top priorities of our Company. The most important pillar of this subject matter is the protection and processing of personal data of our customers, prospective customers, employee candidates, company shareholders, company officers, our visitors and the employees, shareholders and officers of the entities we cooperate with as well as third parties as managed pursuant to this Policy. Actions taken by our company for the protection of personal data of our employees are administered in line with the "Personal Data Protection and Processing Policy" for the employees of ÖZDİSAN ELEKTRONİK PAZARLAMA SAN. TİC. A.Ş. (the "COMPANY").

According to Turkish Republic Constitution, everyone has the right to demand that his personal data should be protected. With respect to the protection of personal data, which is a constitutional right, the Company pays due care and diligence to protect the personal data of our customers, prospective customers, employee candidates, company shareholders, company officers, our visitors and the employees, shareholders and officers of the entities we cooperate with as well as third parties as governed hereunder, and turns it into a corporate policy. Accordingly, the Company adopts necessary administrative and technical measures to protect personal data that are processed pursuant to the applicable legislation.

This Policy shall provide detailed explanations as to the below-listed fundamental principles adopted by the Company for processing personal data:

• processing personal data in compliance with the law and rules of integrity;
• keeping personal data correct and, whenever necessary, up-to-date;
• processing personal data for specific, clear and legitimate purposes;
• processing personal data in connection with the underlying purpose, proportionately and in a limited way;
• storing personal data for such term required by the applicable legislation or as much as necessary for the purpose underlying that process;
• providing information and disclosures to the personal data subjects;
• setting the necessary system so that personal data subjects may exercise their rights;
• adopting measures necessary to store personal data;
• acting in compliance with the applicable legislation and the PDP Committee regulations for transferring personal data to third parties in line with the requirements underlying the purpose of processing;
• paying due care and diligence for processing and protecting sensitive personal data

PURPOSE OF POLICY

The basic purpose of this Policy is to make disclosures about the systems for processing personal data in line with the laws and adopted for the protection of personal data and, accordingly, to ensure transparency by informing those whose personal data are processed by us, including our customers, prospective customers, employee candidates, company shareholders, company officers, our visitors and the employees, shareholders and officers of the entities we cooperate with as well as third parties.

SCOPE

This Policy shall be applicable to all personal data of our customers, prospective customers, employee candidates, company shareholders, company officers, our visitors and the employees, shareholders and officers of the entities we cooperate with as well as third parties whose personal data are processed automatically, or provided to be a part of any data recording system, non-automatic means.

The scope of application of this Policy in connection with personal data groups categorized above may be the entire Policy (for instance our active customers, who are our visitors) or certain provisions of them may be applicable (e.g. for only our visitors).

IMPLEMENTATION OF THE POLICY AND APPLICABLE LEGISLATION

Applicable laws and regulations shall have priority with respect to the processing and protection of personal data. In the case of a conflict between the applicable legislation and the Policy, our Company acknowledges that applicable legislation shall be implemented.

The Policy has been drafted by materializing the rules set out in the applicable legislation in connection with the corporate practices.

We would like to remind you that unless you accept this Policy, you should not disclose your personal data to us. If you choose not to disclose your personal data to us, we would like to inform you that it may be impossible for us to offer certain services to you, or fulfill your requests or provide you with our services completely.

We would like to remind you that whether or not the personal data disclosed by you to us are correct, complete and update is within your responsibility to the extent you are aware. In addition, if you disclose personal data of other individuals, it is your responsibility to collect such data in line with the local statutory requirements. In this case, if we collect third party personal data from third parties, this means that we have obtained all consents necessary to process, use and disclose them, and our Company shall not be held liable for such operations.

EFFECTIVENESS OF THE POLICY

This Policy was issued and put into force by the Company on 15.06.2019. The latest revision was made on 02.02.2026.

PROTECTION OF PERSONAL DATA

Our Company adopts technical and administrative measures in order to prevent the unlawful processing of, and unlawful access to, personal data processed by it and ensure such level of security for the storage of data in line with Article 12 of the PDPL no.6698. Controls and audits in that respect are carried out by or on behalf of our Company.

2.1. SECURITY OF PERSONAL DATA

2.1.1. Technical and Administrative Measures adopted to ensure the lawful processing of personal data

Our Company adopts such technical and administrative measures to ensure the lawful processing of personal data to the extent technological means and implementation cost allows it.

Technical Measures adopted to ensure the lawful processing of personal data

• In order to ensure that our Company will process personal data lawfully, personal data processing operations carried out
• at our Company are audited by means of installed technical systems.

Administrative Measures adopted to ensure the lawful processing of personal data

Major administrative measures are listed below to ensure that our Company shall process personal data in line with the applicable law:

• Employees are informed and trained about the law for the protection and lawful processing of personal data.
• These technical measures are reported to whom it may concern periodically pursuant to the internal audit mechanism.
• Such staff members in command of technical matters are employed.
• All these operations undertaken by us are analyzed specifically by all business units in detail, and personal data are processed for those business operations carried out by the applicable business units as a result of this analysis.

Personal data processing operations undertaken by our business units are specifically determined for each business unit and the detailed operations undertaken by it in line with those requirements to ensure compliance with conditions for personal data processing as sought by the Law no. 6698.

An awareness is created, and implementation rules are defined, for each relevant business unit to ensure requirements for legal compliance set for that business unit. Those administrative measures necessary to audit these procedures and ensure the sustainability of the implementation are applied by in-house policies and training courses.

Reservations and provisions are incorporated into contracts and documents governing legal relation between our company and employees in order to restrict the processing, disclosure and use of the personal data, and the employee awareness is created and audits are carried out in this respect.

2.2. PROTECTION OF SENSITIVE PERSONAL DATA

PRP Law places a special emphasis on certain personal data as the unlawful processing of such data carries a risk that may cause individuals to be aggrieved or discriminated.

These data include race, ethnic origin, political though, philosophical beliefs, religion, sect or other faith, clothing and attire, membership to association, foundations or unions, healthcare data, sexual life, criminal conviction and security measures as well as biometric and genetic data.

Our Company acts diligently for the protection of sensitive personal data that are designated as "sensitive" by virtue of the PDP Law and are processed in line with the law. Accordingly, our Company diligently applies technical and administrative measures aimed to protect personal data to sensitive personal data, and required audits are carried out inside our organization.

Section 3 of this Policy details the information about the processing of sensitive personal data.

2.3. RAISING AWARENESS AND AUDITS ABOUT THE PROTECTION AND PROCESSING OF PERSONAL DATA OF DATA SUBJECTS

Our Company ensures that necessary briefing and training sessions are organized for business units to enhance awareness for preventing unlawful access to data, unlawful processing of personal data and to ensure the safe storage of the data.

Our employees are duly informed and assume basic obligations by virtue of the corporate Code of Conduct provisions necessary to raise awareness for the protection of personal data of those employees seconded to the business unit new as well as the existing employees of such business unit. and the Code of Conduct is annually reviewed and tested electronically to ensure the sustainability.

The participation in training sessions is reported to the relevant managers. In light of the foregoing, our Company assesses the participation and involvement in relevant training courses, seminars and information sessions, and necessary audits in this respect are carried out by or on behalf of the Company. Our Company updates and renews its training sessions in line with the updated legislation.

Our Company regularly provides its business partners with information to enhance awareness for preventing unlawful processing of, and unlawful access to, personal data and to ensure the storage of the data.

3. WHEN DO WE COLLECT YOUR PERSONAL DATA? / PROVISIONS ABOUT THE PROCESSING OF PERSONAL DATA

We basically collect your personal data when:

• you purchase or use our products and/ or services;
• sell goods or supply services to us;
• you subscribe to our news bulletin and choose to receive our marketing messages;
• you contact us through our web site, e-mail, social media platforms, other on-line channels or by phone;
• you apply to our Company for job;
• you attend events and activities organized by our Company;
• indirectly (for instance, when you use "cookies") and you personalize software that is used to adapt the web site in line with your personal preferences or we track the use by you of certain pages of the web site (for instance your IP address) or by using other technical methods that make it possible for us to track your use of the web site;
• you contact us as a prospective customer/ supplier/ business partner/ subcontractor for any purpose whatsoever.

We process your personal data that we collect as mentioned above only in compliance with this Policy.

Our Company processes personal data in connection with, limited to, and proportional with, the purpose in line with Article 20 of the Constitution and Article 4 of the PDPL and accurately and whenever it is required and backed by up-to-date, specific, express and legitimate purposes and motives. Our Company stores personal data for such term as required by the laws or by the purpose of personal data processing.

As per Article 20 of the Constitution and Article 5 of the PDPL, our Company processes personal data in line with one or more than one terms and conditions set out in Article 5 of the PDPL as applicable to the processing of personal data. Notwithstanding the foregoing and pursuant to Article 10 of the PDPL, we provide personal data subjects with a privacy notice and give them necessary information upon their request.

Our Company acts in line with the applicable legislation for the processing of sensitive personal data pursuant to Article 6 of the PDPL. Moreover, with respect to the transfer of personal data in line with Articles 8 and 9 of the PDPL, our Company acts in line with those regulations dictated by the PDP Committee and as set out in the applicable law.

3.1. PRINCIPLES APPLICABLE TO THE PROCESSING OF PERSONAL DATA

3.2. PRIVACY NOTICE FOR AND INFORMATION OF THE PERSONAL DATA SUBJECTS

Our Company gives a privacy notice to the personal data subjects in the course of the collection of the personal data in line with Article 10 of the PDPL. Accordingly, the Company gives a privacy notice about the identity of the Company, and if any, its representative, the purpose underlying the processing of personal data, and the purposes of transferring processed personal data to whom, and the legal grounds and management of collecting personal data as well as the rights held by the personal data owner.

Pursuant to Article 11 of the PDPL, our Company provides personal data subjects with such necessary information upon their request and through all channels via which their data are collected.

3.3. PROCESSING OF SENSITIVE PERSONAL DATA

Our Company diligently acts with the provisions set out in the PDPL in the case of processing personal data that are designated as "sensitive data" under the PDP Law.

Article 6 of the PDPL defines certain personal data as "sensitive data" if such data causes grief or discrimination of individuals when they are unlawfully processed. These data include race, ethnic origin, political though, philosophical beliefs, religion, sect or other faith, clothing and attire, membership to association, foundations or unions, healthcare data, sexual life, criminal conviction and security measures as well as biometric and genetic data.

Sensitive personal data are processed by our Company in the following circumstances in line with the PDPL subject to the requirement that sufficient measures to be designated by the PDP Committee are adopted.

By virtue of the new amendments adopted on 12 March 2024, provisions for the processing of Sensitive Data are amended as follows as of June 2024:

Pursuant to the Law, conditions to process sensitive personal data were re-worded in Article 6 of the PDPL:

• The data subject should give his explicit consent.
• Processing of all sensitive personal data, including healthcare and sexual life data are governed in the laws.
• Where it is mandatory to process personal data to protect the vital interests or physical integrity of the data subject or another person where the data subject who is unable to explain his/her consent due to the physical disability or whose consent is not deemed legally valid,
• Where data processing is in line with the will for publicization of the sensitive personal data made public by the data subject,
• Where it is mandatory to process sensitive personal data in order to establish, use or protect a right;
• Where processing of sensitive personal data is necessary for competent bodies and institutions or those individuals who are subject to the confidentiality obligation to protect public health, to fulfil preventive medicine, medical diagnosis, treatment and care services and to plan, manage and finance healthcare services;
• where it is mandatory to process data in order to fulfill legal obligations in the field of employment, occupational health and safety, social security, social services and social aids;
• where it is for existing or former members of foundations, associations or other non-profit organizations founded for political, philosophical, religious or union-related purposes or those persons who are in contact with them regularly, provided that this processing will be limited to the scope of business and shall not be disclosed to third parties.

3.4. TRANSFER OF PERSONAL DATA

Subject to the explicit consent of the data subject, our Company may transfer personal data and sensitive personal data of such data subject to third parties (third party companies, group companies, the Company and/ or business partners, their subsidiaries and shareholders, third party individuals, suppliers, legally authorized private and public enterprises, the Company's service providers, outsourcers or business partners) by taking security measures (see Chapter 2/ Article 1) in line with the lawful purposes of personal data processing and subject to the explicit consent of the data subject. We act in line with regulations set out in Article 8 of the PDPL in this respect.

Our Company may transfer personal data to third parties to the limited extent and based on one or several conditions for processing personal data as described in Article 5 of the Law in line with the legitimate and lawful purposes for processing personal data. Section 5.1 of this Policy details the information about these circumstances.

Our Company may transfer sensitive personal data of the data subject to third parties in circumstances described in Article 3.3 of this Policy in line with the legitimate and lawful purposes of processing personal data by paying due care and diligence, taking those necessary security measures (see Section 2/ Article 2.1) and other sufficient measures required by the PDP Committee.

Our Company acts in line with the decisions adopted by the PDP Committee as required under the PDPL and the applicable legislation, including, in particular, Article 8 of the PDPL for the transfer of personal data. Personal and sensitive data of data subjects may not be transferred by our Company to other individuals or legal persons without the explicit consent of the data subject.

Moreover, it is possible to transfer personal data without the consent of the data subject in circumstances described in Articles 5 and 6 of the PDPL. Our Company may transfer personal data to subsidiaries who are members of DMY Group and third parties based in Türkiye unless otherwise is agreed in the Law or other applicable legislation (or if there is a contract in force made with the data subject, in that contract), provided that conditions and terms set out in the PDPL and other applicable legislation are observed and security measures described in the applicable legislation are taken.

Parties to the transfers made in Türkiye and abroad

We may share your personal data in line with the following purposes to the extent it is necessary. We try our best not to share your personal data other than these circumstances. Parties to whom we share personal data are as follows:

DMY Group Companies: Your personal data may be shared with, or be made available to, DMY group companies, whose subsidiary we are. This share shall be made only with the authorized employees of the relevant DMY group subsidiaries. In certain exclusive circumstances, we may share personal data with DMY group companies in lieu of anonymized data (such as sharing details of claims to open an insurance claims file).

Service providers and business partners: These are defined as those parties with whom we build a business partnership in the course of our business operations for the sales, promotion, marketing, aftermarket services for our services. Like many other enterprises, we may cooperate with reliable third parties such as information and communication technology providers, consultants, cargo companies, travel agents in order to carry out functions and services in the most efficient manner and in line with up-to-date technologies under certain data processing operations. This disclosure shall be made to a limited extent in order to build a business partnership or ensure that purpose of performance is achieved. We use cloud computing technologies in order to take maximum advantage of technological means to carry out our operations in the most efficient manners, and accordingly, we are able to process your personal data in Türkiye and abroad by means of companies offering cloud computing services. Marketing services outsourcer to which we disclose information may be based abroad, and accordingly, data may be transferred to abroad in line with those provisions of Articles 8 and 9 of the PDPL which deals with the data transfer to abroad.

Public authorities: Where necessitated by the laws or if it is necessary to defend our rights, we can disclose your personal data to relevant public, judicial and administrative authorities (for instance, tax offices, law enforcement officers, courts and enforcement offices).

Private law entities: We may disclose personal data to the extent limited by the purpose if private law entities authorized to collect data and documents from our office request in line with their jurisdiction according to the applicable law (for instance, Occupational Health and Safety Company, OHSC).

Professional advisors: We can share your personal data with banks, insurers, auditors, lawyers, certified public accountants and other consultants and professional advisors.

Other persons connected with corporate actions: We can disclose your personal data from time to time for the handling of corporate actions such as the sale of a business owned by our company, reorganization, merger, joint venture or other disposal of our business, assets or shares (including those ones connected with any bankruptcy or a similar procedure).

Our Company may transfer personal data and sensitive data of a data subject to its business partners/ suppliers (legal persons) based abroad if necessary (by taking those measures asked by the PDP Committee) as well as such security measures necessary in line with the lawful purposes of personal data processing (see Section 2/ Article 2.1). Personal data are transferred by our Company to those data controllers in a foreign jurisdiction said by the PDP Committee to afford a sufficient protection ("Foreign Jurisdictions with Sufficient Protection") or, where there is no sufficient protection, to such data controllers based in Türkiye and the applicable foreign jurisdiction which hold a permission from the PDP Committee and which submit a written letter of undertaking to afford a sufficient level of protection or to foreign jurisdictions with a sufficient permission from the PDP Committee ("Foreign Jurisdiction where Data Controller undertaking Sufficient Protection is based"). We act in line with regulations set out in Article 9 of the PDPL in this respect.

Our Company informs to the data subject such person groups to whom personal data are transferred in line with Article 10 of the PDPL.

Our Company may transfer personal data of its customers to the following individual categories in line with Articles 8 and 9 of the PDPL (see Section 3/ Article 3.5):

• Our business partners,
• our suppliers,
• our subsidiaries,
• our shareholders,
• legally authorized public agencies and bodies,
• legally authorized private law entities

The scope of those persons to whom data are transferred and the purposes of data transfer are as follows:

3.5. STORAGE TIME FOR PERSONAL DATA

Our Company stores the personal data for such duration set out in the applicable laws and legislation if it is required thereunder.

Unless there is a time period set out in the applicable legislation for the duration of the storage of the personal data, such personal data are processed for such duration that is necessary under our corporate practices and customs of the commercial life in connection with the services offered by our company while processing such data. After its expiry, such data are erased, destroyed or anonymized. A Storage Times Table has been issued in this respect.

Where the purpose for processing personal data is no longer applicable and the storage times defined in the applicable legislation and the company have expired, personal data may be only stored for asserting a right or making a defense or serving as an evidence in a potential legal dispute only. For the purposes of setting the time periods here, storage times are determined on the basis of time bars for asserting the right in question and based on those examples set out in claims asserted against our Company in the same matter even after the expiry of a time bar. In this case, there shall be no access to stored personal data for any other purpose and access to personal data is only available whenever it is to be used in a relevant legal dispute. After the term referred to herein expires, personal data are erased, destroyed or anonymized.

4. PERSONAL DATA CATEGORIES

While personal data of personal data subject categories listed below are processed by our company, the implementation scope of this policy is limited to our customers, prospective customers, employee candidates, company shareholders, company officers, our visitors and the employees, shareholders and officers of the entities we cooperate with as well as third parties.

Protection and processing of personal data of our employees shall be addressed under the Policy for the Protection and Processing of Personal data of Company Employees.

While categories of those persons whose personal data are processed by our Company fall within the scope mentioned above, persons that do fall outside these categories may send their requests to us pursuant to the PDPL, and such requests shall be processed in line with this Policy.

Following paragraphs clarify concepts of our customers, prospective customers, employee candidates, company shareholders, company officers, our visitors and the employees, shareholders and officers of the entities we cooperate with as well as third parties as referred to hereunder.

WHAT KIND OF YOUR PERSONAL DATA DO WE PROCESS?

Your personal data that we process vary depending on the type of business relation between you and us (for instance customers, suppliers, business partners etc.) and the method by which you choose to contact us (for instance phone, e-mail, over web site or printed documents. etc.).

Our basic methods to process personal data are via our web site, phone or e-mail, electronic applications exclusive to our customers, your visits to our business events, your participation in our promotions and surveys or any other interaction with us. Accordingly, your personal data that we process may be described under the following categories:

5. PROCESSING OF PERSONAL DATA BASED ON, AND LIMITED TO, THE CONDITIONS FOR PROCESSING AS SET OUT IN THE LAW

Our Company gives a privacy notice to the personal data subject about the personal data that we process in line with Article 10 of the PDPL.

The explicit consent by the data subject is only one of the legal grounds that make it possible to process personal data in line with the law. Other than explicit consent, personal data may be processed in case either of the following circumstances occurs. The grounds for processing your personal data may be only one of those conditions set below or there may be several reasons to serve as the basis for this data processing operations. Where processed data are sensitive personal data, those conditions listed in Article 7.1.2 hereunder below shall be applied.

Where legal grounds may differ for processing of personal data by our Company, we act in line with general principles set out in Article 4 of the Law no. 6698 (please see Section 3.1) in all kinds of data processing operations.

6. PERSONAL DATA PROCESSING AT THE ENTRANCE OF, AND INSIDE THE BUILDING AND FACILITY AND WEBSITE VISITORS

Personal data processing at the entrance of, and inside, the building and facility is carried out by our Company in accordance with the Constitution, the Personal Data Protection Law, and other relevant legislation.

For security purposes, our Company processes personal data by monitoring guest entries and exits using security cameras in our Company buildings and facilities.

Our Company processes personal data by using security cameras and recording guest entries and exits.

7. ERASURE, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA

8. RIGHTS OF DATA SUBJECTS

Our Company informs the data subject of his/ her rights in accordance with Article 10 of the PDP Law, guides the data subject on how to exercise these rights, and implements the necessary channels, internal procedures, administrative and technical arrangements in accordance with Article 13 of the PDP Law to evaluate the rights of data subjects and provide them with the necessary information.

9. RELATIONSHIP BETWEEN THE COMPANY'S PERSONAL DATA PROTECTION AND PROCESSING POLICY AND OTHER CORPORATE DOCUMENTS

The fundamental policies, procedures, and instructions that have been or will be drafted for the protection and processing of personal data, which are related to the principles set forth by the Company in this Policy, are linked to and associated with this Policy. Those policies, procedures, and instructions are also linked to the Company's fundamental processes in other areas to ensure consistency between processes operated by the Company under different policy principles for similar purposes.

10. ANNEXES

ANNEX-1 ABBREVIATIONS

ANNEX-2 DATES OF SIGNIFICANCE FOR THE ENFORCEMENT OF THE PDP LAW

ANNEX-3 PROCESSING OF PERSONAL DATA OF JOB APPLICANTS AND BUSINESS PARTNER EMPLOYEES

ANNEX 4. CATEGORISATION OF PERSONAL DATA

Our Company processes personal data in line with those legitimate and lawful purposes underlying the processing of such data and limited to one or several personal data processing conditions as described in Article 5 of the PDP Law in compliance with those general principles set out in the PDP Law, including in particular, to those ones set out in Article 4 of the personal data processing and in compliance with all obligations defined in the PDP Law and for such durations limited to those ones set out under our Policies, provided that data subjects shall be informed pursuant to Article 10 of the PDP Law.

DATA CONTROLLER IDENTITY