ESCUDO GRUP JOINT STOCK COMPANY - Information Notice on the Processing of Personal Data

INFORMATION NOTICE REGARDING THE PROCESSING OF PERSONAL DATA

This Information Notice has been prepared by ESCUDO GRUP ANONİM ŞİRKETİ for the purpose of informing the Company’s customers regarding the processing of their personal data by the Company within the scope of the Law No. 6698 on the Protection of Personal Data.

You may access detailed information regarding the processing of your personal data within the scope of this Information Notice from the ESCUDO GRUP ANONİM ŞİRKETİ Personal Data Protection and Processing Policy available at [www.escudo.com.tr].

a) Methods and Legal Grounds for Collecting Personal Data

Your personal data are collected in electronic or physical environments. The personal data collected based on the legal grounds stated in this Information Notice may be processed and shared within the personal data processing conditions set forth in Articles 5 and 6 of the Law.

b) Purposes of Processing Personal Data

Your personal data are processed within the personal data processing conditions set forth in Articles 5 and 6 of the Law, for the purposes of planning and conducting activities necessary to customize and promote the products and services offered by the Company according to the preferences, usage habits and needs of the relevant persons, conducting the necessary work by business units and carrying out related business processes to enable relevant persons to benefit from the products and services offered by the Company, conducting the necessary work by business units to carry out the commercial activities carried out by the Company and managing related business processes, planning and execution of the Company’s commercial and/or business strategies, and ensuring the legal, technical and commercial/operational security of the Company and the relevant persons who are in business relations with the Company.

c) Parties to Whom Personal Data May Be Transferred and Purpose of Transfer

Your personal data may be transferred within the personal data processing conditions and purposes stated in Articles 8 and 9 of the Law, for the purposes of planning and conducting activities necessary to customize and promote the products and services offered by the Company according to the preferences, usage habits and needs of the relevant persons, conducting necessary work by business units and carrying out related business processes to enable relevant persons to benefit from the products and services offered by the Company, conducting necessary work by business units to carry out the commercial activities undertaken by the Company, planning and execution of the Company’s commercial and/or business strategies, and ensuring the legal, technical and commercial/operational security of the Company and relevant parties in business relations with the Company, to the Company’s business partners and suppliers, legally authorized public institutions and legally authorized private legal entities.

d) Rights of Data Subjects and Exercise of These Rights

If you, as personal data subjects, submit your requests regarding your rights listed below to the Company through the methods specified under the section “Exercising Rights by Data Subjects”, your requests will be evaluated and concluded by our Company as soon as possible and in any case within 30 (thirty) days.

Pursuant to Article 11 of the Law, you have the right to:

• Learn whether your personal data are being processed,

• Request information if your personal data have been processed,

• Learn the purpose of processing your personal data and whether they are used in accordance with the applicable purpose,

• Know the third parties to whom your personal data are transferred, domestically or abroad,

• Request correction if your personal data are processed incompletely or inaccurately and request that the correction be notified to third parties to whom the data were transferred,

• Request the deletion or destruction of your personal data if the reasons requiring their processing cease to exist, even if your data were processed in accordance with the law, and request that this be notified to third parties to whom the data were transferred,

• Object to any result against you that arises from the analysis of your personal data exclusively through automated systems,

• Request compensation if you suffer damage due to unlawful processing of your personal data.

Situations Where Data Subjects Cannot Exercise Their Rights

According to Article 28(2) of the Law, data subjects cannot claim rights in the following cases:

• If processing personal data is necessary for preventing crime or conducting criminal investigations,

• If personal data have been made public by the data subject,

• If personal data processing is necessary for the execution of supervisory or regulatory duties of public institutions and organizations or professional organizations with public authority, as authorized by law, or for disciplinary investigations or prosecutions,

• If personal data processing is necessary for the protection of the economic and financial interests of the State concerning budgetary, tax, or financial matters.

According to Article 28(1) of the Law, the Law shall not apply to the following cases; therefore, data subject requests regarding such data will not be processed:

• Personal data processed by natural persons for purely personal activities or activities related to family members living in the same residence, provided that they are not disclosed to third parties and data security obligations are observed.

• Personal data processed for purposes such as research, planning, and statistics by anonymizing them.

• Personal data processed for artistic, historical, literary, or scientific purposes within the framework of freedom of expression, provided that such processing does not violate national security, public order, public security, economic security, privacy of private life, or personal rights, and does not constitute a crime.

• Personal data processed by public institutions and organizations authorized by law within the scope of preventive, protective, and intelligence activities to ensure national defense, national security, public safety, public order, or economic security.

• Personal data processed by judicial authorities or execution authorities regarding the investigation, prosecution, trial or execution processes.

Exercising Rights by Data Subjects

Data subjects may use the “Application Form Regarding Requests to the Data Controller by the Personal Data Subject” available at [www.escudo.com.tr].

Applications may be submitted together with documents verifying the identity of the data subject via one of the following methods:

• Delivering a signed hard copy of the form in person, via notary, or registered mail to
  İncilipınar Mah. Gazi Muhtar Paşa Blv. 36017 Nolu Sk. Kepkepzade Park İş Merkezi Gaziantep - Türkiye

• Sending the form signed with a secure electronic signature prepared in accordance with the Electronic Signature Law No. 5070 to info@escudogroup.com via registered e-mail (KEP),

• Using a method prescribed by the Personal Data Protection Board.

As a rule, data subject applications are processed free of charge. However, if the transaction requires an additional cost, fees may be charged based on the tariff determined by the Personal Data Protection Board.

The Company may request additional information to determine whether the applicant is the data subject and may ask questions to clarify issues in the application.