Personal Data Protection FERRO DÖKÜM SANAYİ VE DIŞ TİCARET A.Ş. PRIVACY NOTICE IN ACCORDANCE WITH THE TURKISH DATA PROTECTION ACT FERRO DÖKÜM SANAYİ VE DIŞ TİCARET A.Ş. takes the highest possible security measures to ensure that your personal data is collected, stored and shared legally and to protect your privacy. Our aim is to inform you in the most transparent manner regarding collection forms of your personal data, purposes of processing, shared persons, legal causes and your rights pursuant to article 10 of the Turkish Data Protection Act No. 6698 and in line with your satisfaction. a) Data Controller Your personal data will be collected and may be processed by FERRO DÖKÜM SANAYİ VE DIŞ TİCARET A.Ş. (the “COMPANY”) in the scope described below in accordance with the Turkish Data Protection Act No. 6698 (the “Act No. 6698”). b) Purpose of Personal Data Processing The COMPANY may collect personal data in the categories such as identity information, contact information, customer information, customer transaction information, transaction security information, legal action and compliance information and marketing and sale information from the parties such as customers, employees, potential customers, candidate employees, business partners and suppliers. Your personal data collected will be processed within the personal data processing conditions and purposes stated in articles 5 and 6 of the Act No. 6698; – Providing/supplying the products and services which are provided/supplied by our Company or affiliates or subsidiaries with which our Company is associated directly or indirectly (Efesan Group of Companies’) and carrying out related works. – Assessment processes for customers/suppliers/business partners of our Company and Efesan Group of Companies. – Ensuring the implementation of our Company’s principles and policies, – Helping our business units carry out the works required for the utilization of the products and services provided/supplied by our Company and Efesan Group of Companies, – Offer you the products and services of the COMPANY, fulfillment of our obligations to you, issue the records and documents, comply with the information storage, reporting, disclosure, tax and other obligations stipulated by the local and international legislation, – Provide advertising, campaign, advantages and other benefits specific for you for sales and marketing activities to be performed to increase the quality of services and products, – Communicate for forwarding the required information to you in respect of the information processing requirements, system structure, the necessity of the information processing support services received, these services and products, – Carry out traffic measurement for sales and marketing activities, statistical analysis, Segmentation / profiling and CRM activities, – Measure and increase customer satisfaction, perform complaint management, receive your opinions and suggestions about new services and products, receive your problem-error notifications, provide you with information about products and services, your complaints and demands, – Receive your orders, perform your payment transactions, provide logistics cooperation with 3rd parties and provide product shipment, suggest products and services that may be of interest to you, online behavioral advertising and marketing, customer portfolio management, measurement and development of service quality, communication, optimization, audit, risk management and control, promotion, analysis, determining areas of interest, scoring, profiling, marketing, sales, advertising, communication -Comparative product and / or service offer, modeling, existing or new product activities and / or improvements, use your personal data in all kinds of products and services that will be presented to you within the scope of law and applicable legislation regulating the activities written in the articles of association of the COMPANY being subject to your disclosure to the COMPANY, – Comply with the information storage, reporting, information obligations stipulated by the governmental authorities, fulfill the requirements of the contracts and satisfy the legal obligations to which the COMPANY is subject for the utilization of these services, – For the purpose of determining and implementing the commercial and business strategies of the COMPANY; manage financial operations carried out by the COMPANY, communications, market research and social responsibility activities, purchasing operations (demand, proposal, evaluation, order, budgeting, contract), internal system and application management operations, legal operations, – Review, evaluate and reply requests from official authorities or you, c) Persons to whom the processed personal data can be transferred and for which purpose Your personal data collected; solely for achievement of the objectives stated above; may be transferred, within the framework of the personal data processing conditions and purposes stated in articles 8 and 9 of the Act No. 6698, to: – The business partners, shareholders, subsidiaries of the COMPANY, – Persons or entities permitted by the Tax Procedure Law, Social Security Institution legislation, Court of Accounts, Law on Prevention of Laundering of Proceeds of Crime, Law on Prevention of Money Laundering, Turkish Commercial Code, Code of Obligations and other legislative provisions, – Legally authorized public institutions and organizations, administrative authorities and judicial authorities, – Foreign companies and subsidiaries, – Natural or legal persons from whom we purchase service in product / service comparison, analysis, evaluation, advertising and achievement of the above-mentioned objectives, program partner institutions and organizations, organizations contracted by us for sending the messages we send to our customers, cargo companies delivering you the placed orders. ç) Method and Legal Reason for Collecting Personal Data Your personal data is collected by the COMPANY for the purposes stated above within the framework of the legislation and for the purpose of performance of the contract in particular through the Head Office/brunch office/factory of the COMPANY, applications on the contracted websites, other institutions that we provide / purchase support services and any real and / or legal persons that are traded under all kinds of legislation or contract, our website and mobile application, call centers, social media accounts, on the verbal, written or electronic media and other channels to be formed/likely to be created in the future; Your personal data are processed in line with the following legal reasons stated in articles 5 and 6 of the Act No. 6698; – It is explicitly provided for by the laws, – It is mandatory fort he Company to be able to perform their legal obligations, – Processing personal data belonging to the parties to a contract is necessary, provided that it is directly related to the conclusion or execution of that contract. – Data processing is mandatory for the legitimate interests of the data controller, provided that this processing shall not violate the fundamental rights and freedoms of the data subject. – The data concerned have been made available to the public by the data subjects themselves. – Data processing is mandatory for the establishment, exercise, or protection of any right. – In case of explicit consent of the data subjects themselves. d) Rights of Personal Data Subject listed in article 11 of the Act No. 6698 As personal data subjects, if you submit your requests for your rights through the methods outlined below, the COMPANY will finalize the request as soon as possible and within thirty days at the latest according to nature of the request. No charge will be applied up to ten pages in the reply to be given. For each page above ten pages, processing fee will be charged as 1 Turkish Lira. If the response to the application is given in a recording medium such as a CD or flash memory, the fee that may be requested by our company will not exceed the cost of the recording medium. In this context, personal data subjects are entitled to; Learn whether personal data is processed, Request for information regarding their personal data if it has been processed, Learn the purpose of personal data processing and whether it is used for intended purpose, Know the third parties to whom the personal data is transferred at home or abroad, Request for rectification of the personal data in case it is processed incompletely or inaccurately and request for communication of the transaction performed in this scope to the third parties to whom the personal data is transferred, Request for erasure or destruction of personal data if the reasons for processing have eliminated although it has been processed in accordance with the Act No. 6698 and other applicable law provisions and request for communication of the transaction performed in this scope to the third parties to whom the personal data is transferred, Object any consequence arising to the detriment of the person by analyzing the processed data exclusively through automatic means, Request for compensation of any damages arising from the unlawful processing of the personal data. In accordance with paragraph 1 of article 13 of the Act No. 6698 and the Communique Regarding the Procedures and Principles for Application to the Data Controller No. 30356, dated 10.03.2018, you may submit your request for exercise of your rights mentioned above, in Turkish and in writing or by registered electronic mail (KEP) address, secure electronic signature, mobile signature or the electronic mail address previously notified to the COMPANY and registered in our system. Only information about the applicant will be given in the applications and it will not be possible to obtain information about other family members and third parties. The COMPANY reserves the right to verify your identity before responding. Your application must include: Your name, surname and, if the application is written, your signature, Your Turkish ID number for citizens of the Republic of Turkey, if you are a foreigner, your nationality, passport number or your identity number, if any, Address of your place of residence or your place of business for the purposes of notices, Your electronic mail address, telephone and fax number, if any, for the purposes of notices, Subject of your request, and information and documents related to the subject, if any, should be attached to the application. You may make your applications that you want to make in writing by attaching the required documents as the data controller and sending them to the address of our Company at Cumhuriyet Mahallesi 2253 Sk. No:13 41400 Gebze / Kocaeli. You can access the application form from here. You may make your applications that you desire to make by e-mail by sending them to the e-mail address kvkk.ferrodokum@efesan.com.tr. You can submit your applications via the KEP to our KEP address ferrodokum@hs03.kep.tr. According to the nature of your request, the information and documents required for identification must be submitted to us completely and accurately. In cases where the requested information and documents are not provided properly, there may be problems in complete and qualified conduct of investigations to be performed by the COMPANY upon your request. In this case, the COMPANY declares that it reserves its statutory rights. For this reason, your request for application should be dispatched completely and in a manner that shall include the requested information and documents based on nature of your request. Bilgi Toplumu Hizmetleri