SAVIS PLASTIC INC.

INFORMATION NOTICE REGARDING THE PROCESSING OF PERSONAL DATA

This notice has been prepared to inform you about the processing of your personal data by the data controller in accordance with the Personal Data Protection Law No. 6698.

Our Purpose for Data Processing:

To collect, store, share with public institutions and organizations as stipulated by law, and protect your personal data lawfully, we take the highest level of security measures to ensure your privacy.

In accordance with Article 10 of the Personal Data Protection Law No. 6698 and to ensure your satisfaction, we aim to inform you transparently about the ways your personal data is collected, the purposes for which it is processed, the parties with whom it is shared, the legal reasons, and your rights.

Data Controller:

In accordance with the Personal Data Protection Law No. 6698, your personal data will be collected and processed by SAVIS PLASTIC INC. as the data controller within the scope described below.

a) Methods and Legal Reasons for Obtaining Personal Data:

Your personal data is collected in electronic or physical environments. The personal data collected based on the legal reasons specified in the law can be processed and shared within the framework of the personal data processing conditions specified in Articles 5 and 6 of the Law.

The data controller can collect personal data from our customers, employees, potential customers, job candidates, business partners, and suppliers, such as identity information, contact information, customer information, customer transaction information, transaction security information, drawings and accounts related to systems and facilities, the content of our project services, application decisions and operational data related to projects-plans and related drawings taking into account the employer's requests, legal transaction and compliance information, and marketing sales information.

b) Purposes of Processing Personal Data:

Your personal data will be processed for the purposes of planning and executing necessary activities to customize and recommend products and services offered by the data controller according to the preferences, usage habits, and needs of the relevant persons, carrying out necessary studies to make the related persons benefit from the products and services offered, conducting business processes for the execution of commercial activities carried out by the company, planning and executing commercial and/or business strategies, ensuring the legal, technical, and commercial-business security of the company and the relevant persons who are in business relations with the company, within the framework of the personal data processing conditions specified in Articles 5 and 6 of the Law.

c) Parties to Whom Personal Data May Be Transferred and Purposes of Transfer:

Your personal data may be shared within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law, for planning and executing necessary activities to customize and recommend products and services offered by the company according to the preferences, usage habits, and needs of the relevant persons, carrying out necessary studies to make the related persons benefit from the products and services offered by the company, conducting business processes for the execution of commercial activities carried out by the company, planning and executing commercial and/or business strategies, and ensuring the legal, technical, and commercial-business security of the company and the relevant persons who are in business relations with the company, with business partners, legally authorized public institutions and organizations, and legally authorized private law persons.

d) Rights of Data Subjects and Use of These Rights:

As personal data owners, if you submit your requests regarding your rights to the company by the methods set out under the title "Use of Rights by Data Subjects," your requests will be evaluated and concluded by our company as soon as possible and within 30 (thirty) days at the latest.

According to Article 11 of the Law, as a personal data owner, you have the following rights:

• To learn whether your personal data is processed,
• To request information if your personal data has been processed,
• To learn the purpose of processing your personal data and whether it is used for its intended purpose,
• To know the third parties to whom your personal data is transferred domestically or abroad,
• To request the correction of your personal data if it is incomplete or incorrectly processed and to request the notification of the transaction performed within this scope to the third parties to whom your personal data is transferred,
• To request the deletion or destruction of your personal data if the reasons for processing are no longer valid, even though it has been processed in accordance with the provisions of the Law and other relevant laws, and to request the notification of the transaction performed within this scope to the third parties to whom your personal data is transferred,
• To object to the occurrence of a result against you by analyzing the data processed exclusively through automated systems,
• To request compensation for the damage arising from the unlawful processing of your personal data.

According to Article 28, Paragraph 2 of the Law, data subjects do not have the right to claim the following:

• Personal data processing is necessary for the prevention of crime or crime investigation,
• Personal data is processed by the data subject himself/herself,
• Personal data processing is necessary for the execution of supervisory or regulatory duties and disciplinary investigations or prosecutions by the competent and authorized public institutions and organizations, and professional organizations in the nature of public institutions, based on the authority given by the law,
• Personal data processing is necessary for the protection of the economic and financial interests of the State with regard to budget, tax, and financial matters.

According to Article 28, Paragraph 1 of the Law, the following data is outside the scope of the Law, and data subjects' requests will not be processed for these data:

• Personal data processed for official statistics and anonymized for research, planning, and statistical purposes,
• Personal data processed for investigation, prosecution, trial, or execution of judicial proceedings.

Use of Rights by Data Subjects:

To use the above-mentioned rights, data subjects must submit their applications together with documents identifying their identity by one of the following methods:

• By submitting a signed copy of the application form by hand, via a notary public, or by registered mail with a return receipt to:

SAVIS PLASTIC INC. AHMET TURAN GAZI OSB MAH. 7TH STREET NO. 10 SIVAS

• By sending the application form signed with a secure electronic signature as per the Electronic Signature Law No. 5070 to the registered email address ………………………………….

The company will respond to the applications within the legal limits stipulated in the Law, within thirty (30) days at the latest. For third parties to apply on behalf of the personal data owner, a special power of attorney notarized by the data owner must be available.

Applications by personal data owners are generally processed free of charge, but a fee may be charged based on the fee schedule set by the Personal Data Protection Board.

The company may request information from the relevant person to determine whether the applicant is the personal data owner and may ask questions to the personal data owner to clarify the issues specified in the application.

Legal Reasons for Retention:

Personal data processed within the framework of commercial activities are retained for the duration stipulated in the relevant legislation. Within this scope, personal data are retained for the periods specified in:

• The Personal Data Protection Law No. 6698,
• The Turkish Code of Obligations No. 6098,
• The Civil Servants Law No. 657,
• The Social Insurance and General Health Insurance Law No. 5510,
• The Law on Regulating Broadcasts on the Internet and Fighting Against Crimes Committed Through These Broadcasts No. 5651,
• The Public Financial Management and Control Law No. 5018,
• The Occupational Health and Safety Law No. 6361,
• The Right to Information Act No. 4982,
• The Law on the Use of the Right to Petition No. 3071,
• The Labor Law No. 4857,
• The Regulation on Health and Safety Measures in Workplace Buildings and Attachments,
• Other secondary regulations in force under these laws.

Reasons for Destruction:

Personal data is deleted, destroyed, or anonymized by the institution upon the request of the relevant person if:

• The legislation which forms the basis for the processing of personal data is amended or repealed,
• The purpose of processing or retention no longer exists,
• The data processing is based solely on the condition of explicit consent, and the relevant person withdraws their explicit consent,
• The institution accepts the application for the deletion, destruction, or anonymization of personal data within the framework of the rights of the relevant person under Article 11 of the Law,
• The relevant person rejects the institution's response to their request for deletion, destruction, or anonymization of their personal data, finds the response insufficient, or the institution fails to respond within the legal period; and this request is found appropriate by the Board,
• The maximum retention period necessary for the purpose for which the personal data is processed has expired and there is no condition justifying longer retention.

In such cases, personal data is deleted, destroyed, or anonymized upon the request of the relevant person or ex officio by the institution.