Personal Data Policy

As KOCAER ENERJİ A.Ş. (‘’Kocaer Enerji ‘’ or ‘’Company‘’), we process all kinds of personal data belonging to all persons associated with the Company in accordance with the Personal Data Protection Law No. 6698 (‘’Law‘’). Accordingly, pursuant to Article 10 of the Law, the Company, in its capacity as ‘Data Controller’, is under the obligation to inform the personal data owners in accordance with the Law No. 6698 on the Protection of Personal Data. With this Clarification Text, data subjects are informed and enlightened in accordance with Article 10 of the Law.

Data Controller and Representative
This information is provided within the scope of the Law No. 6698 on the Protection of Personal Data in order to fulfil the obligation to inform employees, employee candidates, customers, suppliers, consultants, business partners, shareholders, company officials, company representatives, contracted persons and their employees, persons who are the addressees of all kinds of legal transactions, visitors and real or legal persons with whom it communicates for any reason whatsoever. Regarding the protection of personal data, for each personal data processing process, there is a separate disclosure text specific to that process.

Purposes of Processing Personal Data
In all data processing activities of the Company, the personal data of the data subjects are processed by the data controller in accordance with the general principles specified in Article 4 of the Law, based on one or more of the personal data processing conditions specified in Articles 5 and 6, in order to achieve the following purposes. In all personal data processing activities carried out by the Company, the obligations specified in all relevant legislation and Board Decisions, especially the Law, are complied with.

• Execution of Emergency Management Processes
• Execution of Information Security Processes
• Execution of Employee Candidate / Intern / Student Selection and Placement Processes
• Execution of Application Processes of Employee Candidates
• Execution of Employee Satisfaction and Loyalty Processes
• Fulfilment of Labour Contract and Legislative Obligations for Employees
• Execution of Fringe Benefits and Benefits Processes for Employees
• Execution of Audit / Ethical Activities
• Conducting Training Activities
• Execution of Access Authorisations
• Carrying out the activities in accordance with the legislation
• Execution of Finance and Accounting Affairs
• Execution of Commitment Processes to the Company / Products / Services
• Ensuring Physical Space Security
• Execution of Appointment Processes
• Follow-up and Execution of Legal Affairs
• Conducting Internal Audit / Investigation / Intelligence Activities
• Execution of Communication Activities
• Planning Human Resources Processes
• Execution / Supervision of Business Activities
• Execution of Occupational Health / Safety Activities
• Receiving and Evaluating Suggestions for Improvement of Business Processes
• Ensuring Business Continuity Activities
• Carrying out cargo processes
• Execution of Logistics Activities
• Execution of Goods/Service Procurement Processes
• Execution of Goods / Services After Sales Support Services
• Execution of Goods/Service Sales Processes
• Execution of Goods/Service Production and Operation Processes
• Execution of Customer Relationship Management Processes
• Execution of Activities for Customer Satisfaction
• Organisation and Event Management
• Execution of Marketing Analysis Studies
• Execution of Performance Evaluation Processes
• Execution of Advertising / Campaign / Promotion Processes
• Execution of Risk Management Processes
• Carrying out storage and archive activities
• Execution of Social Responsibility and Civil Society Activities
• Execution of Contract Processes
• Execution of Sponsorship Activities
• Execution of Strategic Planning Activities
• Follow-up of Requests / Complaints
• Ensuring the Security of Movable Property and Resources
• Execution of Supply Chain Management Processes
• Execution of Wage Policy
• Execution of Marketing Processes of Products / Services
• Ensuring the Security of Data Controller Transactions
• Execution of Investment and R&D Processes
• Conducting Talent / Career Development Activities
• Providing Information to Authorised Persons, Institutions and Organisations
• Execution of Management Activities
• Creating and Tracking Visitor Records
• In addition, with regulatory and supervisory authorities, as required or obliged by legal regulations, within the scope of the requirements and obligations determined to ensure the fulfilment of legal obligations specified in the Law

In this context, your personal data and sensitive personal data processed by the Company are securely stored in physical or electronic media for a period of time appropriate for the purpose of processing. Within the scope of the activities in question, the Company acts in accordance with the obligations stipulated in all relevant legislation, especially PDPL, regarding the protection of personal data.

For detailed information about KOCAER ENERJİ A.Ş.'s data processing policy, you can review the “Personal Data Protection and Processing Policy” at www.kocaerenerji.com.

Transfer of Personal Data and Purposes of Transfer
Your personal data processed within the scope of the purposes described above; In line with the principles in Article 8 of the Personal Data Protection Law No. 6698, by the Company

• In this process, in order to carry out our activities, by the parties with whom we have a data processor contract, limited to the subject of the contract,
• In order to fulfill and ensure the continuity of commercial activities, our company may provide services to its business partners, dealers or affiliates,
• To our suppliers and supplier employees on a limited basis in order to provide outsourced products and services,
• In accordance with the provisions of the relevant legislation, to independent audit firms or public institutions and organizations within the scope of the relevant contracts for the audit of our commercial activities,
• Legal, financial and tax advisors and other consultants
• To our shareholders for the limited purpose of designing and implementing strategies regarding our Company's commercial activities,
• To legally authorized public institutions and organizations within the scope of their requests within the legal authority of the relevant public institutions and organizations,
• If requested, courts limited to the subject of the request
• To institutions and organizations designated to ensure the fulfillment of legal obligations specified in the law,
• To banks and insurance companies regarding the commercial activities of our company,
• Sub-employers
• Data processors from whom our company receives technical and administrative support
• Education Organizations
• Travel agencies, Hotels, Airline Companies
• Institutions and organizations providing health services to employees
• Education companies

Transfer of Data Overseas
In the light of the general principles stipulated in paragraph 2 of Article 4 of the Personal Data Protection Law No. 6698, your personal data may be processed by Kocaer Enerji primarily by obtaining explicit consent or without explicit consent in the presence of data processing conditions stipulated in paragraphs 2 of Article 5 and 3 of Article 6 of the same Law and in accordance with the rules in Article 9. Pursuant to the rules set out in Article 9, once the foreign countries with adequate protection to be determined by the Personal Data Protection Board (“Board”) are announced, the data may be transferred only to persons and organizations residing in these countries, and for the countries where it is determined and announced that there is no adequate protection, provided that the data controllers in Turkey and in the relevant foreign country undertake in writing an adequate protection and obtain permission from the Board for the relevant transfer. However, it can be transferred at any time, provided that the data subjects have their explicit consent.

Method and Legal Grounds for Collecting Personal Data
Your personal data, website, contracts made with you, information forms, order forms, surveys, job application forms, employment contracts, social media applications, call centers, your participation in trainings, seminars, fairs and similar environments organized by our company or real or legal persons who process data on behalf of our company, Your personal data is collected with your explicit consent through verbal, written or electronic channels, including, but not limited to, parties with whom we have a business relationship and / or receive services that are complementary to our activities, contracted organizations, offices and other physical environments where you can communicate and other similar channels, and, where possible, through the cameras we place in the physical environments of the company.

This information is obtained in all our business processes in order for the Company to continue its commercial life and to fulfill its obligations arising from the laws in a complete and accurate manner, and your personal data collected in this direction are processed based on the data processing conditions specified in Article 5(2) of the Law and listed below and the “General Principles” listed in Article 4 of the Law.

• Explicit consent,
• It is clearly stipulated in all relevant legislation to which our Company is subject, primarily the Tax Procedure Law, Turkish Code of Obligations, Turkish Commercial Code, Labor Law, Social Security Law,
• To comply with information retention, reporting and disclosure obligations stipulated by legislation and official authorities,
• Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract, to provide the requested products and services and to fulfill the requirements of the contracts you have concluded,
• It is mandatory for the fulfillment of the legal obligation,
• If it has been made public by the person concerned,
• Data processing is mandatory for the establishment, exercise or protection of a right,
• If data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
• Your sensitive personal data are processed in accordance with the data processing conditions specified in Article 6(3) of the Law and given below.
• Your explicit consent,
• Personal data other than health, without seeking explicit consent in cases stipulated by law,
• Personal data related to health can only be collected for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, by persons under the obligation of confidentiality (workplace physician) or authorized institutions and organizations without seeking the explicit consent of the person concerned.

Retention Period of Personal Data
Your personal data and sensitive personal data will be processed and stored for the periods stipulated for such data in the legislation. In the event that the conditions requiring the processing of your personal data disappear and/or upon the expiration of the two-year period, your personal data will be securely destroyed by the Company.

Rights of the Personal Data Subject
As personal data owners, if you submit your requests regarding your rights to Kocaer Enerji by the methods set out below, your applications will be finalized as soon as possible and within 30 (thirty) days at the latest. However, if answering your applications regarding the processing of personal data requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged to the relevant person (applicant).

As a data subject, you have the following rights listed in Article 11 of the Law:

• Learning whether personal data is processed,
• Requesting information if personal data has been processed,
• Learning the purpose of processing personal data and whether they are used in accordance with their purpose
• To know the third parties to whom personal data are transferred domestically or abroad
• To request correction of personal data in case of incomplete or incorrect processing,
• To request the deletion or destruction of your personal data in the event that the reasons requiring the processing of your personal data disappear,
• Request notification of your corrected or deleted information upon your request to third parties to whom personal data has been transferred, if transferred,
• Objection to the occurrence of a result to the detriment of the person himself/herself by analyzing the processed data exclusively through automated systems,
• In case of damage due to unlawful processing of personal data, to demand the compensation of the damage.

In accordance with paragraph 1 of Article 13 of the Personal Data Protection Law, you can make your request to exercise your rights mentioned above with the following information and methods based on the “Communiqué on the Procedures and Principles of Application to the Data Controller” numbered 30356 published on March 10, 2018.

Required information in the application content;

• Name, surname information of the applicant.
• If the applicant is a citizen of the Republic of Turkey, TR Identity Number, if not, Passport number or Identity number, if any, together with the nationality.
• The applicant's residential or workplace address for notification.
• Applicant's e-mail address, telephone or fax for notification.
• The subject of the applicant's request
• Information and documents related to the subject of the applicant's request.

Application Methods;

• The applicant can personally deliver to the address of KOCAER ENERJİ A.Ş.; by filling out the ‘Application Form’ with a sealed envelope with wet signature and with a note on the envelope ‘Information Request in accordance with the Law on the Protection of Personal Data’ to the information office by hand.
• The applicant may send a notification to the address of KOCAER ENERJİ A.Ş. through a Notary Public, but the note ‘Information Request as required by the Law on the Protection of Personal Data’ must be added on the notification envelope.
• With ‘Secure Electronic Signature’ defined in the Electronic Signature Law No. 5070
• With Mobile Signature
• To our Company's Registered Electronic Mail kocaerenerji@hs09.kep.tr address with the note ‘Information Request in accordance with the Law on the Protection of Personal Data’ in the subject section
• Can apply by using the e-mail address previously notified to the Company and registered in the Company's system.

In the application that you have as a personal data owner and that you will make in order to exercise your rights mentioned above and that includes your explanations regarding the right you request to exercise; the matter you request must be clear and understandable, the subject you request must be related to your person or if you are acting on behalf of someone else, you must be specifically authorised in this regard and your authorisation must be documented, the application must contain identity and address information and documents certifying your identity must be attached to the application.

It is important that the information/data you share is correct and transferred correctly, and this is necessary for you to exercise your rights on the data within the scope of the Law, and the responsibility arising from providing incorrect or incorrect information belongs to the person concerned.

Request for Updating Your Information
Your personal data that we collect and process must be accurate and, when necessary, up-to-date in accordance with Article 4 of the Law No. 6698 on the Processing of Personal Data. Therefore, in case of any change in your personal data, you can request your current and accurate personal information to be updated by coming to the company in person and notifying the company address or info@kocaerenerj,.com e-mail address.

Changes
Kocaer Enerji reserves the right to make changes in this disclosure statement due to possible changes in the Law on the Protection of Personal Data and the methods to be determined by the Personal Data Protection Board.