KVKK DISCLOSURE TEXT

In accordance with the Personal Data Protection Law No. 6698 (“KVKK”), your personal data will be processed by our company (DURAK TEKSTIL) as a Data Controller, depending on business purposes, by using, recording, storing, updating, transferring, and/or classifying within the framework described below.

Within this scope, our company takes all technical and organizational measures to ensure the appropriate level of security, to protect the fundamental rights and freedoms of individuals regarding privacy and personal data protection, and especially in accordance with laws and regulations. This includes preventing unlawful processing of your personal data, keeping personal data securely, and preventing unlawful access.

The target audience of this text is all natural persons whose personal data is processed by our company, except employees of our company or candidates for employment who have applied for a job with our company.

The personal data processed as a Data Controller is provided below, but it is not limited to those specified here:

• Name, surname, identity number, address, phone number, email address, signature, physical location/security image recording, call center/quality of service voice recording, bank account number, cookie records.

Purposes and legal grounds for processing personal data:

1. Your personal data will be processed for the purpose of ensuring the benefit of you and/or institutions you represent from the products and services offered by our company, formulating and implementing commercial business strategies, conducting marketing activities, executing business development, and realizing planning activities.

2. Execution of administrative operations for communication carried out by our company.

3. Ensuring the physical security and control of the locations in use by our company.

4. Establishing partner/customer/supplier (authorized or employees) relationships.

5. Ensuring contractual requirements and financial agreements on products and services offered together with our business partners, suppliers, or other third parties.

6. Implementation of our company's human resources policies.

7. Calling our company's call center or using the website.

8. Participating in training, seminars, or events organized by our company.

Method of collection, storage, and transfer of personal data:

Your personal data that you share with our company may be collected orally, in writing, or electronically by automatic or non-automatic methods, through offices, branches, call centers, websites, social media, mobile applications, and similar means. Your personal data will be stored in electronic and/or physical environments. In order to ensure that your personal data provided and stored by our company is not subject to unauthorized access, manipulation, loss, or damage in the environments in which they are stored, technical security infrastructure improvements are implemented with the design of the necessary business processes.

Your personal data will be processed for the purposes reported to you and will not be used outside the scope, as well as taking all necessary information security measures. Your personal data will be stored and processed for the period of legal retention or, if no such period is provided, for the period required for the purpose of processing. When this period expires, your personal data will be removed from our company's data streams by means of deletion, destruction, or anonymization.

Your personal data, which is covered by laws and other legislation, may be transferred to the following entities for the purposes described below:

• Türk Telekomünikasyon A.Ş. and Turkish telecommunications group companies,

• Companies authorized by us, operating on our company's name and account, and our representatives,

• Regulatory and supervisory authorities, public institutions, or organizations authorized to explicitly request your personal data in the laws to which it is subject,

• Business partnerships, supplier and contractor companies, banks, credit risk and financial institutions, and other natural or legal persons within the scope of the specified purposes,

• Tax and other advisors, with mandatory legal processes, persons, institutions, and third parties, including auditors, organizations, and consultants we have received, and not limited to those, domestically and abroad business partners, third parties who receive services, and authorized persons and institutions.

Your rights under Article 11 of KVKK:

In accordance with the first paragraph of Article 13 of KVKK, you may submit your request for the exercise of your rights mentioned above to our company in writing or by other methods determined by the Personal Data Protection Board. As a personal data owner, if you submit your requests for your rights to our company, the company will conclude your request as soon as possible and free of charge within thirty days at the latest. However, if the transaction requires an additional cost, the company will charge a fee in the tariff set by the Personal Data Protection Board.

In this context, personal data owners have the following rights:

1. Learning whether personal data is processed,

2. Requesting information if personal data has been processed,

3. Learning the purpose of processing personal data and whether it is used for its purpose,

4. Knowing 3rd parties to whom it is transferred, whether at home or abroad,

5. Requesting correction of personal data if it is incomplete or incorrectly processed,

6. Requesting deletion/destruction pursuant to Article 7 of KVKK,

7. Requesting to be notified of transactions made in accordance with paragraphs (e) and (f) listed above to 3rd parties,

8. Objecting to the occurrence of a result against you because it is exclusively analyzed with automated systems,

9. If you have suffered damage due to unlawful processing, you have the right to request the compensation of the damage.

In order to use the above-mentioned rights, you can personally submit your request by handing it over with the necessary information identifying you, send it through a notary or other methods determined by the Personal Data Protection Board, or send it to durak@durak.com.tr email address with a secure electronic signature.