1. Identity of the Data Controller

As Kartal Kimya Sanayi ve Ticaret Anonim Şirketi (“Kartal Kimya” or the “Company”), we show the utmost sensitivity regarding the security and confidentiality of your personal data. With this awareness, in order to ensure that we act in accordance with the Law No. 6698 on the Protection of Personal Data (“Law”) as the data controller, we present the following issues to your information within the scope of the clarification obligation regarding the personal data we obtain.

2. Purposes for Which Personal Data Will Be Processed

Although it may vary depending on the service or commercial activity offered by Kartal Kimya, personal data may be processed within the scope of determining and implementing our Company’s commercial and business strategies, executing, developing and fulfilling the requests regarding our Company’s activities and business processes, fulfilling our legal obligations, carrying out Company investigation, inquiry, reporting, internal control and audit activities, ensuring compliance with legislation and our Company’s policies and procedures, ensuring information and data security, ensuring the continuity of information systems, organizing trainings, seminars and events etc., taking camera records for the purpose of establishing security in case our Company is visited, and carrying out the necessary registration procedures for tracking visitor entrances and exits. In addition, your personal data may be kept under protection by Kartal Kimya both in digital and physical environments.

3. Transfer of Personal Data

Your personal data may be transferred, for the purposes explained in Article 2 of this Clarification Text, limited to the reason requiring the transfer and in connection with this reason; within the scope of the Law and relevant regulations; to law enforcement etc. official institutions upon request, to audit companies etc. companies with which cooperation is made.

4. Method and Legal Basis of Collecting Personal Data

Your personal data is collected for the purposes stated above, in accordance with the basic principles stipulated in the Law and based on the legal grounds of being foreseen in the laws specified in Article 5 of the Law, the legal obligation of the data controller and the legitimate interest of our Company provided that it does not harm the fundamental rights and freedoms of the data subject, in order to carry out our commercial activities and limited to these reasons; from the information conveyed by you verbally or in writing, through the identity document you submit, through the closed-circuit camera recording systems in our Company, by automatic or non-automatic methods. In this context, your personal data may be processed and transferred with explicit consent in light of the principles stipulated in Article 4(2) of the Law or, in the existence of the cases stipulated in Articles 5(2) and 6(3), without obtaining explicit consent.

5. Storage and Destruction of Data

Our Company stores the personal data it processes for the periods determined by the legislation, and in cases where no period is specified in the legislation; personal data is stored for the period required for processing in accordance with our Company’s practices and the customs of commercial life, as long as it is related to the services offered by our Company while processing such data, and after this period, only for the periods deemed necessary in practice for the purpose of serving as evidence in possible legal disputes. After the specified periods expire, the relevant personal data is deleted, destroyed or anonymized.

6. Your Rights Regarding the Protection of Personal Data

Within the scope of the Law; you have the right to learn whether your personal data is processed, to request information if your personal data has been processed, to learn the purpose of processing yourénieur personal data and whether they are used in accordance with their purpose, to know the third parties to whom your personal data is transferred domestically or abroad, to request the correction of your personal data if it is incomplete or incorrectly processed, to request the deletion or destruction of your personal data, to request that the transactions regarding the correction and/or deletion or destruction of personal data be notified to third parties to whom personal data has been transferred in case your personal data is incomplete or incorrectly processed, to object in case an unfavorable result arises as a result of the processing of the processed data exclusively through automated systems, to request the compensation of the damage in case you suffer damage due to the processing of your personal data unlawfully.

Within the scope of the Law, you can submit your applications regarding your personal data by using the application form available at www.kartal.com.tr through one of the channels specified below;

• In person at Balçık Mahallesi Pelitli Yolu Caddesi No:140 Gebze Kocaeli address by having your identity verified; or

• To our Company’s postal address Balçık Mah. Pelitli Yolu Cad. No:140 Gebze İstanbul; or

• To our Company’s kartalkimya@hs01.kep.tr address with your secure electronic or mobile signature; or

• By having your identity verified, through other procedures specified in the Law and relevant legislation.

Our Company will finalize the application requests within 30 (thirty) days at the latest, depending on the nature of the request, in accordance with Article 13 of the Law. In case the transaction requires a cost, the tariff determined by the Personal Data Protection Board will be applied. In case of rejection of the request, the reason/reasons for rejection will be justified in writing or electronically. You can find detailed information about the evaluation process of application requests in the Personal Data Protection and Processing Policy available at www.kartal.com.tr.