I. Information Notice

1. Introduction

We, ZSR PATLAYICI A.Ş. (“Company”), have drawn up this information notice for processing of personal data of our visitors and making it possible for them to effectively use their rights with respect to processing of their data in accordance with the Constitution of the Republic of Turkey, the international conventions regarding human rights to which our country is a party and Law on Protection of Personal Data (“LPPD”). All personal data shared with our company shall be processed in accordance with the respective law and in connection and to the extent of our activities and services.

2. Definitons

The concepts of personal data, sensitive personal data and data processing in this information notice are used by referring to the definitions given in LPPD. The concept of “personal data” referred to in LPPD means any information about a real person known or identifiable, and the concept of “processing of personal data” means any act such as obtaining personal data through means which are partly or completely automatic or non-automatic means provided it is part of any data recording system, recording, storing, maintaining, changing, rearranging, explaining, transferring, assuming, making obtainable, classifiying or preventing use of them.

3. Principles of Personal Data Processing

As per the article 4 of LPPD, the personal data about the data owner shall be processed by the Company, the data controller, by law and good faith, for actual, specific and legitimate purposes and in connection with, limited to and to the extent of the intention of such processing and in accordance with rules of storage as long as required for the intended use and as specified in the respective legislation.

4. Objectives of Personal Data Processing

Your personal data shall be used to:

• ensure security of the office or internet and similar electronic systems;
• settle any possible legal disputes in future;
• make necessary notices to the related organization through official means if they are legally requested by the authorized official organizations or enterprises

in accordance with the conditions of personal data processing specified in the articles 5 and 6 of LPPD.

5. Disclosure of Your Personal Data

Our company acts with respect to disclosure of personal data in accordance with the specified regulations. Provided the exceptional cases laid down in the legislation are reserved, the personal data and sensitive data are not disclosed by us to any other real or legal persons without open consent of the Data Owner. For exceptional cases specified in LPPD and other legislation, we show great care that the manners and restrictions required in the legislation are observed during disclosure of personal data to the authorized administrative or judicial organizations or private establishments.

Your personal data may be disclosed to:

• any authorized public organizations and establishments and legally authorized private persons for fulfillment of legal liability or establishment, use or protection of rights owned by the Company in accordance with the conditions and objectives of personal data disclosure laid down in the articles 8 and 9 of LPPD as per the manners and principles specified in the related legislation.

6. Method of and Legal Ground for Collection of Personal Data/Sensitive Personal Data

Your personal data are obtained by means of automatic methods; from the data owner personally by completing the related field in website owned y the Company or by sending request and forms via the system and recording of the transactions realized after entry in the system.

Legal grounds for processing your personal data by the
Company: It is based on the consent given by the data owner in the Open Consent notice as well as the consent given by him/her as per the article 5, paragraph one of LPPD and cases exempted from open consent laid down in the article 5, paragraph two, subparagraphs ç, e and fe of LPPD. Basing on the specified legal grounds, your personal data are collected by the company for the purposes specified in the articles 4 and 5 of this Information Notice an in accordance with any regulations.

7. Rights of Data Owner Specified in the Article 11

By making application to the Company which acts as data controller, the data owners are entitled to get information whether his/her personal data has been processed or not; if processed, request information about it; request information about intended purpose of processing the personal data and whether they have been used according to the intended purpose; get information about any third parties at home and abroad to which his/her personal data has been disclosed; request correction if his/her personal data has been processed deficiently or incorrectly; request deletion or destruction of his/her personal data in accordance with the conditions specified in the article 7 of LPPD No: 6698; request that the transactions made as per the article 11, paragraphs (d) and (e) of LPPD are notified to the third parties to whom his/her personal data has been disclosed; request analysis of the processed data exclusively by means of automatic system in order to avoid occurrence of any result against the data owner; and request indemnification of any loss if occurs due to illegal processing of the personal data.