Clarification Text Regarding the Processing of Customer Personal Data within the Framework of the Law No. 6698 on the Protection of Personal Data

1. Identity of the Data Controller and Its Representative, if Any

In accordance with Law No. 6698 on the Protection of Personal Data ("KVKK" or "Law"), your personal data may be processed by Ata Teknik Endüstriyel Teknolojiler Sanayi Ticaret Limited Şirketi (the "Company" or "Data Controller"), which is located at Kavaklı Mahallesi, Köprülü Mehmet Paşa Sokak, No:24, Firma 2, 34520, Beylikdüzü, İstanbul, Türkiye and registered with the Istanbul Trade Registry Office under registration number 321903-0, as described below.

2. Definition of Personal Data

Personal data, as defined in Article 3 of the KVKK, constitutes any information relating to an identified or identifiable natural person, the personal data mentioned in this Information Text.

3. Purposes of Personal Data Processing

Your personal data is processed based on one or more of the personal data processing conditions specified in Article 5 of the KVKK, in accordance with the personal data processing principles specified in Article 4 of the KVKK. In all personal data processing activities carried out by the Data Controller, the obligations sought in all relevant national and international legislation, primarily the KVKK, are also complied with.

The purposes of processing your personal data by the Data Controller include performing necessary work to benefit you from the services offered within the framework of the conditions and purposes outlined in Articles 5 and 6 of KVKK; customizing and suggesting services to you according to your preferences, usage habits, and needs; ensuring the legal and commercial security of individuals involved in a business relationship with the Data Controller; and determining and implementing commercial and business strategies.

Your personal data are processed for the following purposes related to our activities within the scope of the employer-employee relationship with you:

• Updating and verifying the accuracy of information provided to us
• Ensuring the proper fulfillment of contractual obligations
• Managing sales and support processes for goods/services
• Tracking and managing legal affairs
• Managing and executing customer relations
• Managing and executing logistics activities
• Planning and implementing corporate sustainability, corporate governance, strategic planning, and information security processes
• Executing/monitoring business activities
• Ensuring compliance with regulations
• Managing financial and accounting affairs
• Recording camera footage at our premises for security reasons and/or legal obligations
• Managing marketing and sales processes

As Atateknik, as the data controller; your personal data that we obtain within the framework of the reasons for compliance with the law in Articles 5 and 6 of the Law can be obtained, recorded, stored, stored, changed, updated, periodically checked, rearranged, classified, and stored for the period necessary for the purpose for which they are processed or for the period stipulated in the relevant law, in whole or in part.

It should be noted that; Atateknik processes your personal data in accordance with the law and the rules of honesty, accurately and up-to-date when necessary, within the framework of specific, clear and legitimate purposes, in connection with the purpose for which they are processed, limited and moderate, and for the period stipulated in the relevant legislation or necessary for the purpose for which they are processed.

Unless explicitly stated in the Law, your personal data will be processed for the duration of the valid reason and purpose for storing the data, and will be deleted, destroyed or anonymized in the event that the purpose and reason for processing disappears or terminates. You can access detailed information about the purposes for which your personal data is processed by the Data Controller from the personal data protection and processing policies shared on the website "https://heikenei.com/KVKK".

4. Processed Personal Data

The Company records and processes certain personal and sensitive personal data about you as stated above. In this context, the data processed by Ata Teknik may particularly include the following:

• Personal Identification Information (Name, surname, gender, etc.)
• Contact Information (Phone, Email Address)
• Physical Security Information
• Legal Process Information (Litigation and enforcement file information)
• Financial Information (Bank account details, tax number)
• Customer Transaction Information
• Other Information (Signature circular)

5. Recipients of Processed Personal Data and Purposes of Transfer

Your personal data collected may be transferred to official authorities, judicial authorities and regulatory and supervisory institutions, primarily our subsidiaries and affiliates, business partners, investors, our assistants and suppliers, shareholders, legally authorized public institutions and private persons, consultancy firms, and within the framework of the personal data processing conditions and purposes specified in the KVKK, limited to the personal data protection and processing policies shared by the Data Controller on the Company's web address and the purposes specified in this Disclosure Text, provided that the necessary security measures are taken, for the purposes explained in Article 3 of this Disclosure Text.

6. Method and Legal Basis for Collecting Personal Data

Your personal data are collected through various channels including information sent to our Company's email address, direct verbal or written information provided to the department, website, electronic mail, mobile communication, mobile applications, application and membership forms, various contracts, and other verbal, written, or electronic means, for the legal reasons related to the purposes specified in Article 3 of this Clarification Text.

7. Rights of the Data Subject

Under Article 11 of the KVKK, data subjects whose personal data are processed can apply to our Company with requests regarding the following:

• Learning whether their personal data are processed
• Requesting information about their processed personal data
• Learning the purpose of processing their personal data and whether they are used in accordance with that purpose
• Learning the third parties to whom their personal data are transferred, domestically or internationally
• Requesting correction of their personal data if they are incomplete or inaccurate, and requesting notification of this correction to third parties to whom the personal data have been transferred
• Requesting deletion, destruction, or anonymization of their personal data when the reasons for processing no longer exist, and requesting notification of this process to third parties to whom the personal data have been transferred
• Objecting to a result that is detrimental to them solely based on automated processing of their data
• Requesting compensation for damages incurred due to unlawful processing of their personal data

Requests arising from the KVKK will be processed via the "Personal Data Subject Application Form." Our Company will respond to these requests in accordance with Article 13 of the KVKK, free of charge, and within a maximum of 30 (thirty) days. If a request is rejected, the reasons for rejection will be provided in writing or electronically.

To exercise your rights mentioned above, you may submit your request with identification details and explanations regarding the right you wish to exercise by completing the Personal Data Subject Application Form available on the company's website. You can send the signed form in person, by notary, or electronically with a secure e-signature to the address Kavaklı Mahallesi, Köprülü Mehmet Paşa Sokak, No:24, Firma 2, 34520, Beylikdüzü, İstanbul, Türkiye, or to the secure e-mail address kep, or to [email protected], or through other methods specified by the Personal Data Protection Board under Article 13 of the KVKK.

8. Choice Opportunities

We desire to benefit from your data for the purposes stated above. If you do not consent to this, you can notify us at any time; we can stop processing your information unless it is required by law and apply destruction policies according to your request.

9. Data Security

The Data Controller takes all necessary technical and administrative measures to ensure the appropriate level of security in order to prevent the unlawful processing of personal data, to prevent unlawful access to personal data, and to ensure the preservation of personal data.

It implements technical and organizational security measures to protect your managed personal data from being manipulated, lost, damaged, or used by unauthorized persons. Our security measures are constantly evolving with technological advances. It takes all necessary technical and administrative measures to ensure the appropriate level of security in order to prevent the unlawful processing of personal data, to prevent unlawful access to personal data, and to ensure the preservation of personal data.