Data Protection Notice

ROTASEAL SIZDIRMAZLIK SİSTEMLERİ A.Ş. COMPANY –

Information Notice and Explicit Consent Statement on the Processing of Personal Data

Pursuant to the Personal Data Protection Law No. 6698 (“KVKK”), your personal data will be processed by our Company as the Data Controller, within the framework explained below, for business-related purposes, including but not limited to usage, recording, storage, updating, transfer, and/or classification. In this context, our Company takes all necessary technical and administrative measures to prevent unlawful processing, unauthorized access, and to ensure the security of personal data, in accordance with the laws and regulations established to protect fundamental rights and freedoms, particularly the privacy of private life.

This notice is intended for all natural persons whose personal data is processed by our Company, excluding our employees and job applicants.

Personal Data Processed as Data Controller
The personal data processed by our Company include but are not limited to:

• Name, surname, Turkish ID number, address, phone number, email address, signature, physical location/security camera recordings, call center/service quality voice recordings, bank account number, and cookie records.

Purposes and Legal Grounds for Processing Personal Data
Your personal data shared with us may be processed for the following purposes, including but not limited to:

• Enabling you and/or the institutions and organizations you represent to benefit from the products and services offered by our Company;
• Determining and implementing our Company’s commercial and business strategies, conducting marketing activities, and carrying out business development and planning activities;
• Carrying out administrative operations related to our Company’s communication activities;
• Ensuring the physical security and supervision of our Company’s operational locations;
• Establishing business partner/customer/supplier (authorized personnel or employees) relationships;
• Ensuring the fulfillment of contractual obligations and financial agreements regarding products and services offered jointly with our business partners, suppliers, or other third parties;
• Managing our Company’s human resources policies;
• Processing inquiries made through our call center or website;
• Facilitating participation in training sessions, seminars, or events organized by our Company.

Collection and Storage of Personal Data
Your personal data may be collected by our Company through automatic or non-automatic methods, verbally, in writing, or electronically, via offices, branches, call centers, websites, social media platforms, mobile applications, and similar means. Your personal data will be stored in electronic and/or physical environments.

To prevent unauthorized access, manipulation, loss, or damage of your personal data, our Company applies the necessary business process designs and develops technical security infrastructures.

Your personal data will be processed and stored in accordance with the information security measures taken, solely for the purposes notified to you and within the required retention period determined by law. If no such period is specified, data will be stored only as long as necessary for the purpose of processing and will be deleted, destroyed, or anonymized once this period ends.

Transfer of Personal Data
Your personal data may be transferred, within the scope of laws and regulations, to the following entities for the specified purposes:

• Türk Telekomünikasyon A.Ş. and Türk Telekomünikasyon group companies;
• Authorized companies and representatives acting on behalf of our Company;
• Regulatory and supervisory authorities, public institutions, or organizations legally authorized to request personal data;
• Business partners, suppliers, contractors, banks, credit risk and finance institutions, and other legal or natural persons within the specified purposes;
• Tax and legal advisors, mandatory persons and institutions related to legal proceedings, auditors, and consultants, both within and outside the country.

Your Rights Under Article 11 of KVKK
You have the right to apply to our Company to:

• Learn whether your personal data is processed;
• Request information if your data has been processed;
• Learn the purpose of processing and whether it is used in accordance with its purpose;
• Learn the third parties to whom your data has been transferred, domestically or abroad;
• Request correction if your data is incomplete or incorrectly processed;
• Request deletion or destruction of your data within the scope of Article 7 of KVKK;
• Request notification of correction, deletion, or destruction to third parties to whom your data has been transferred;
• Object to any unfavorable outcome resulting from the exclusive processing of data through automated systems;
• Request compensation if you suffer damages due to unlawful processing of your data.

Application Process
Pursuant to Article 13/1 of the KVKK, you can submit your request to exercise these rights in writing or via other methods determined by the Personal Data Protection Board.

You may personally deliver your request letter with identity verification documents, send it via a notary, or submit it electronically with a secure electronic signature to rotasealsizdirmazlik@hs03.kep.tr.