EGE KESKIN GLASS INDUSTRY AND TRADE LIMITED COMPANY

PERSONAL DATA PROCESSING AND PROTECTION POLICY

Contents

Contents . 1

1. PURPOSE AND SCOPE . 1

2. OBJECTIVE . 2

3. DEFINITIONS AND ABBREVIATIONS . 2

4. RESPONSIBILITIES . 3

5. PROCEDURES AND PRINCIPLES FOR PERSONAL DATA PROTECTION . 3

5.1. General Principles for Processing Personal Data . 3

5.1.1. Processing in Compliance with Law and Fairness . 3

5.1.2. Ensuring Accuracy and Updating of Personal Data . 3

5.1.3. Processing with Specific, Clear, Legitimate Purposes . 4

5.1.4. Processing Relevant, Limited, and Measured to Purpose . 4

5.1.5. Retention for the Duration Required by Law or Processing Purpose . 4

5.2. Conditions for Processing Personal Data . 4

5.3. Processing of Special Categories of Personal Data . 5

5.4. Data Transfer . 5

5.4.1. Domestic Transfer of Personal Data . 6

5.4.2. International Transfer of Personal Data . 6

5.5. Company"s Disclosure Obligation . 6

5.6. Rights of Data Subjects . 7

5.7. Data Security Measures . 8

5.7.1. Administrative Measures . 9

5.7.2. Technical Measures . 9

6. IMPLEMENTATION OF POLICY AND APPLICABLE LAW . 10

7. ENFORCEMENT AND UPDATING OF THE POLICY . 10

1. PURPOSE AND SCOPE

This Personal Data Processing and Protection Policy ("Policy") outlines the principles adopted and enforced by EGE KESKIN GLASS INDUSTRY AND TRADE LIMITED COMPANY (“Company”) regarding the processing, protection, and privacy of personal data.

The Policy establishes the framework and coordination for compliance activities carried out by the Company to conform with the Law No. 6698 on the Protection of Personal Data (“PDPL”) from the outset of its organisation.

2. OBJECTIVE

The objective of this Policy is to raise awareness within the Company of lawful personal data processing and protection, to establish appropriate systems, and to ensure compliance with relevant legislation.

The Policy serves as a guide for applying the mandates set out in the PDPL and associated regulations within the Company’s processes.

3. DEFINITIONS AND ABBREVIATIONS

4. RESPONSIBILITIES

All employees, stakeholders, visitors, and relevant third parties must cooperate in preventing legal risks and imminent threats by complying with the Policy throughout the Company"s operations, processes and activities.

Every department and unit is responsible for ensuring adherence to the Policy throughout its operations.

5. PROCEDURES AND PRINCIPLES FOR PERSONAL DATA PROTECTION

5.1. General Principles for Processing Personal Data

The Company adheres to the fundamental principles stipulated in the PDPL and relevant Turkish regulations when processing personal data.

5.1.1. Processing in Compliance with Law and Fairness

The Company shall process personal data lawfully, fairly and truthfully, in compliance with Article 4 of the PDPL, ensuring proportionality and purpose limitation.

5.1.2. Ensuring Accuracy and Updating of Personal Data

The Company shall take necessary measures to ensure that processed personal data is accurate and up to date in light of the Data Subject’s rights and legitimate interests.

5.1.3. Processing with Specific, Clear, Legitimate Purposes

The Company shall determine the specific and lawful purposes for processing personal data before initiating any processing activity.

5.1.4. Processing Relevant, Limited, and Measured to Purpose

Personal data shall be processed only to the extent necessary and appropriate for achieving the defined purposes.

5.1.5. Retention for the Duration Required by Law or Processing Purpose

The Company shall retain personal data only for the legally prescribed period or otherwise for no longer than the purpose requires, after which it shall securely unlawful processing.

Applications are submitted via Data Subject Application Form on the Company’s website, and responses are delivered electronically or physically. The request is concluded in the shortest time, at most within 30 days. If extra cost is involved, statutory fees apply. Additional information or documents may be requested.

5.7. Data Security Measures

In accordance with Article 12 of the PDPL, the Company shall implement appropriate technical and organizational measures to prevent unlawful processing and unauthorized access, ensuring integrity and confidentiality of personal data.

5.7.1. Administrative Measures

• Conduct internal auditing to ensure PDPL compliance;
• Notify the relevant Data Subject and the Board of any unlawful data breach;
• Use contracts or contractual clauses to secure sharing of personal data;
• Employ qualified personnel and provide privacy training.

5.7.2. Technical Measures

• Establish internal controls within IT systems;
• Perform risk analysis, data classification, IT risk assessment and business impact analysis;
• Ensure infrastructure to prevent or monitor data leakage;
• Control and restrict access rights to personal data for employees.

6. IMPLEMENTATION OF POLICY AND APPLICABLE LAW

This Policy is subordinate to applicable legislation. In case of conflict, the legal provisions shall prevail. The Policy implements legal rules in an operational context within the Company.

7. ENFORCEMENT AND UPDATING OF THE POLICY

The Policy becomes effective upon publication on the Company website. It will be periodically reviewed and updated as necessary.