WEBSITE USER PRIVACY NOTICE UNDER LAW NO. 6698 ON THE PROTECTION OF PERSONAL DATA

Purpose and Scope of the Privacy Notice

As KLEMSAN Company, we take the necessary measures to protect your personal data within the scope of Law No. 6698 on the Protection of Personal Data (“KVKK” or the “Law”). In our capacity as the “data controller,” we process your Personal Data in accordance with the KVKK and other applicable legislation, for the purposes and through the methods explained below. This KLEMSAN Company Privacy Notice on the Processing of Personal Data has been prepared pursuant to Article 10 of the KVKK, titled “Data Controller’s Obligation to Inform,” in order to provide you with transparent information regarding the identity of the data controller, the methods and legal grounds for collecting your personal data, the purposes for which such data will be processed, the parties to whom and the purposes for which it may be transferred, the applicable data processing period, and your rights set out under Article 11 of the KVKK. The explanations provided in this Privacy Notice regarding your “Personal Data” also cover your “Special Categories of Personal Data.”

Data Controller

Company Name: KLEMSAN Company Address: Kızılüzüm Cad. No:15, Kemalpaşa – İzmir / Türkiye Hereinafter referred to as the “Company” within the scope of this Privacy Notice.

Methods and Legal Grounds for Collecting Your Personal Data

Your personal data may be collected through automated or non-automated methods, verbally, in writing or electronically, through the Company’s affiliated departments, website, social media platforms, call centre, mobile applications, software used to carry out activities within the Company, and camera recordings. Your personal data may be generated, updated and processed for as long as your relationship with the Company continues and may be stored in both digital and physical environments. Your personal data is processed in accordance with the purposes specified under the heading “Personal Data Processed and Purposes of Processing” and on the basis of obtaining explicit consent pursuant to Article 5(1) of Law No. 6698 or, pursuant to Article 5(2), where: a) Processing is expressly provided for by law, c) Processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract, ç) Processing is necessary for the data controller to fulfil its legal obligations, e) Processing is necessary for the establishment, exercise or protection of a right, f) Processing is necessary for the legitimate interests of the data controller, provided that such processing does not prejudice the fundamental rights and freedoms of the data subject.

Personal Data Processed

Your Personal Data is processed securely and in accordance with the Law on the Protection of Personal Data, either to fulfil legal obligations or to provide more appropriate services in connection with the Company’s business and operations. Within this scope, the data listed below is collected as personal data: Transaction Security: This data category refers to data such as IP address information, website login and logout information, and password and authentication information. Examples include security keys, usernames, user IDs, passwords, log records and IP addresses.

Purposes of Processing Your Personal Data

Your collected personal data will be processed for the following purposes:

• Enabling the relevant business units to carry out the necessary work so that natural and/or legal third parties, institutions and organisations associated with the Company, including employees, visitors, patients, suppliers and business partners, may benefit from the products and services provided by our Company and/or the centres and departments affiliated with our Company,
• Fulfilling current or future legal and regulatory requirements arising from Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications, as well as all other applicable laws and secondary legislation, and taking the necessary measures within this scope,
• Facilitating the performance of supervisory and/or regulatory duties by authorised and competent public institutions and organisations and professional organisations having the status of public institutions,
• Responding to requests for information and documents made by judicial bodies and/or administrative authorities,
• Conducting listing, reporting, verification and analysis studies regarding the manner in which the products and services offered by our Company and all centres and departments affiliated with the Company are used; generating statistical and scientific information in this regard; improving our products and services accordingly; increasing satisfaction with our products and services; and making user-specific customisations within this scope,
• Carrying out risk management and quality improvement activities,
• Taking all necessary technical and administrative measures for systems and applications within the scope of data security.

Parties to Whom Your Personal Data May Be Transferred and Purposes of Transfer

By ensuring that all necessary technical and administrative measures are taken to provide an appropriate level of security in accordance with the KVKK and applicable legislation, your Personal Data may be transferred for the purposes stated above to:

• Legally authorised public institutions and organisations, in line with their requests and limited to the purposes of such requests,
• Private insurance companies and banks for the purpose of providing financial services and ensuring their continuity,
• Lawyers or law firms for the purpose of following up legal matters,
• Domestic and international organisations from which we contractually receive services, to which we provide services or with which we cooperate in order to carry out our activities,
• Our shareholders and business partners.

Such transfers may be made within the framework of the personal data processing conditions set out under Articles 8 and 9 of the KVKK.

Data Processing and Retention Period

Your personal data will be processed solely for the purposes specified in this Privacy Notice and in compliance with the data processing and statutory limitation periods stipulated under all applicable laws and other legislation to which our Company and the centres and departments affiliated with our Company are subject. Where amendments are made to the data processing periods prescribed by law, the newly established periods will apply. In accordance with the principle of purpose limitation, your personal data is processed only for the period necessary to fulfil the purposes explained in this Privacy Notice and, in any event, for the period required under the Company’s practices and customary commercial practices. Once the applicable periods expire, your personal data will be deleted, destroyed or anonymised.

Exercise of the Data Subject’s Rights

By applying to our Company pursuant to Article 11 of the Law, you have the right to:

• Learn whether your personal data is being processed,
• Request information regarding the processing of your personal data if it has been processed,
• Learn the purpose for which your personal data is processed and whether it is being used in accordance with that purpose,
• Learn the identities of third parties to whom your personal data has been transferred within Türkiye or abroad,
• Request the correction of your personal data if it has been processed incompletely or inaccurately,
• Request the deletion or destruction of your personal data under the conditions prescribed by the Law,
• Request that the actions carried out in accordance with your rights regarding correction, deletion or destruction, as specified above, be communicated to third parties to whom your personal data has been transferred,
• Object to any result arising against you as a result of your processed personal data being analysed exclusively through automated systems,
• Claim compensation for damages incurred as a result of your personal data being processed unlawfully.

As the data subject, you may exercise your rights by submitting your requests under Article 11 of the Law, which regulates the rights of data subjects, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Applications may be submitted in writing to: Kızılüzüm Cad. No:15, Kemalpaşa – İzmir / Türkiye Alternatively, applications may be submitted electronically by email to: [email protected]

Explicit Consent Declaration Regarding the Sending of Commercial Electronic Communications Within the Scope of the Personal Data Protection Law I hereby acknowledge and expressly consent to the processing of my personal data, including my name, surname, contact information, and any other personal data I have shared, for the purposes of providing offers to me, informing me about products and services, conducting campaign, promotional, and marketing activities, and sending commercial electronic communications regarding opportunities that may be of interest to me. Within this scope, I consent to the use of my personal data, limited to the purposes specified above, for the purpose of contacting me. I hereby declare that I have freely given my explicit consent to the processing of my personal data within the scope of the Personal Data Protection Law No. 6698, limited to the purposes specified above, and that I am aware of my right to withdraw such explicit consent at any time.