SİLTAŞ YAPI İNŞAAT SANAYİ ve TİCARET ANONİM ŞİRKETİ

PERSONAL DATA PROCESSING PRIVACY NOTICE

This Privacy Notice and Consent Text has been prepared by Siltaş Yapı İnşaat Sanayi ve Ticaret Anonim Şirketi (the “Company”), acting in its capacity as the Data Controller, for the purposes of obtaining the explicit consent of the Company’s customers regarding the processing of their personal data by the Company under the Personal Data Protection Law No. 6698 (the “Law”), and informing data subjects about the matters specified in Article 10 of the Law and the rights of data subjects set forth in Article 11 of the Law at the time their personal data is collected. DEFINITIONS

1. For the purposes of this Privacy Notice, the following terms shall have the meanings set out below:

Personal Data: Any information relating to an identified or identifiable natural person.

Data Controller: A natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data processing system;

Data Processor: A natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller,

KVKK: Refers to the Law on the Protection of Personal Data No. 6698.

2. METHODS OF COLLECTING PERSONAL DATA AND LEGAL BASES

In accordance with the Personal Data Protection Law No. 6698 (“KVKK”), your personal data is processed by Siltaş Yapı İnşaat Sanayi ve Ticaret A.Ş. (“the Company”), acting as the data controller, within the framework described below. Your personal data is collected through any verbal, written, or electronic means for the purposes stated above, so that the Company may provide its products and services within the established legal framework and, in this context, fully and accurately fulfill its contractual and legal obligations.

Your personal data is collected electronically or in physical form. It is collected through automated or non-automated means via forms filled out in physical form, our company’s website and contact forms, social media messages, digital application channels, and email communications, as well as documents such as contracts and proposals; Your personal data, collected for the legal grounds specified in this Privacy Notice, may be processed and shared in accordance with the conditions for personal data processing set forth in Articles 5 and 6 of the Law.

3. PURPOSES OF PROCESSING PERSONAL DATA

Your personal data is processed within the framework of the conditions for processing personal data set forth in Articles 5 and 6 of the Law, for the purpose of planning and carrying out the activities necessary to customize the products and services offered by the Company according to the preferences, usage habits, and needs of the data subjects, and to recommend and promote these products and services to the data subjects, To enable the Company’s business units to carry out the necessary work and execute the relevant business processes to ensure that data subjects benefit from the products and services offered by the Company; to enable the Company’s business units to carry out the necessary work and execute the relevant business processes to conduct the Company’s commercial activities; Processed for the purposes of planning and executing the Company’s commercial and/or business strategies and ensuring the legal, technical, and commercial-business security of the Company and the relevant individuals with whom the Company has a business relationship.

In addition, your personal data may be processed when you use our call centers or website for the Company’s purposes, when you visit our Company or website, or when you participate in training sessions, seminars, or events organized by our Company.

4. PARTIES WITH WHOM PERSONAL DATA MAY BE SHARED AND METHODS OF SHARING

Your personal data is processed within the framework of the conditions and purposes for processing personal data specified in Articles 8 and 9 of the Law, to plan and carry out the activities necessary to recommend and promote the products and services offered by the Company to data subjects by customizing them according to their preferences, usage habits, and needs, to enable the Company’s business units to carry out the necessary work and execute the relevant business processes to ensure that data subjects benefit from the products and services offered by the Company, to enable the Company’s business units to carry out the necessary work and execute the relevant business processes to conduct the Company’s commercial activities, The Company’s commercial and/or business strategies may be planned and executed, and the Company’s and relevant individuals’ legal, technical, and commercialand occupational safety of the Company and the relevant individuals with whom the Company maintains a business relationship.

5. RIGHTS OF DATA SUBJECTS

Data subjects may submit a request to the company acting as the data controller to:

obtain information regarding whether their personal data has been processed,

request documentation regarding such processing if personal data has been processed,

to examine whether their personal data has been processed in accordance with the law and established procedures,

obtain information about the natural or legal persons to whom their personal data has been transferred, request the correction of their personal data if it has been processed incompletely or incorrectly,

request the erasure of their personal data in accordance with the conditions set forth in Article 7 of the relevant Law,

to request that the individuals to whom personal data has been transferred be notified of the actions taken in accordance with subparagraphs (d) and (e) of Article 11 of the relevant Law,

the right to object to a decision made solely through the automated processing of personal data that results in adverse consequences for the individual;

the right to request compensation for damages suffered as a result of the unlawful processing of personal data.

6. EXERCISE OF RIGHTS BY THE DATA SUBJECT

Pursuant to Article 13, Paragraph 1 of the Personal Data Protection Law (KVKK), you may submit your request to exercise the rights listed above to our Company in writing or through other methods determined by the Personal Data Protection Board. Since the Personal Data Protection Board has not yet specified any other methods at this stage, you must submit your request to our Company in writing, as required by the KVKK. In this context, the channels and procedures for submitting your written requests to our Company under Article 11 of the KVKK are explained below.

Requests regarding Personal Data under the Law may be submitted to:

• may be submitted in person, with identity verification, to the address: Yenişehir Mah. Millet Cad. No:26, Pendik, ISTANBUL, or
• to our company’s email address info@siltasyapi.com, or by other procedures specified in the Law and relevant legislation, provided that identity verification is provided.

The Company responds to data subjects wishing to exercise the aforementioned rights within a maximum of thirty (30) days, as provided for by the Law. In the event of a rejection of the request, the reason(s) for the rejection will be justified in writing or electronically.