PERSONAL DATA PROTECTION LAW NO. 6698 ("KVKK") EMPLOYEE INFORMATION NOTICE REGARDING THE PROTECTION OF PERSONAL DATA

As GÜLER GÜMRÜK MÜŞAVİRLİĞİ ANONİM ŞİRKETİ (Employer) in Turkey, we attach great importance to the security of your personal data in our capacity as data controller. Accordingly, we would like to inform you within the scope of the Personal Data Protection Law No. 6698 ("Law").

Data Controller:

Your personal data will be recorded, stored, classified, updated, and, where necessary, transferred to third parties by the company in its capacity as data controller for the purposes specified in this Information Notice. Your personal data, which we obtain in the ways specified below, will be recorded, stored, preserved, reorganized, and transferred to third parties within the scope of our commercial relations or within the framework of our employment contract with you, within the scope of the purpose requiring their processing and only in a manner that is related to this purpose, limited, and proportionate, while maintaining the accuracy and most up-to-date status of the personal data as you have reported or as reported to us, and shared with institutions authorized by law to request such personal data, and transferred, assigned, classified, or processed in other ways listed in the KVKK to third parties within or outside Turkey, in accordance with the conditions stipulated by the KVKK.

What Types of Personal Data Do We Process?

Personal data provided to us by employees may be processed. Examples of personal data that may be processed include the following:

Identity Data

Name, surname, date of birth, country of birth, city of birth, gender, marital status, nationality, Turkish ID card information (TCKN, serial number, wallet number, father's name, mother's name, place of birth, province, district, neighborhood, volume number, family sequence number, sequence number, household number, page number, registration number, place of issue, reason for issue, date of issue, previous surname), copy of identity card.

Communication Data:

Phone number, full address information, email address, internal company contact information (internal phone number, corporate email address)

Financial Data: Financial and salary details, payrolls, files and debt information related to enforcement follow-up files, bank account book, minimum living allowance information, social assistance information

Special Category Personal Data: Conviction information/criminal record, disability status/definition/percentage, religion, health data, blood type, health reports, examination forms, pregnancy status, pregnancy report, health and maternity leave information.

Education Data : Educational status, certificate and diploma information, foreign language skills, education and skills, CV, courses taken

Visual and Audio Data: Photographs, audio recordings, and video recordings belonging to a real person.

Employee Performance and Career Development Data: Education and skills, information on what training was received and when, email, performance evaluation reports, job entry tests, smoking information, activity information.

Family and Close Relatives Data: Marriage certificate; spouse and children's name, surname, Turkish ID number, gender, date of birth, phone number; relatives' name, surname, and phone number

Employment Data: Registration number, position title, department and unit, title, last date of employment, dates of employment, insurance/pension, allocation number, social security number, tax office number, flexible working hours status, travel status, pension fund, pension fund start date, pension fund registration number, social security start date, social security registration number, accounting code, number of working days, monthly total working hours information, severance pay base date, severance pay additional days.

Leave Data: Leave seniority base date, leave seniority additional days, leave group, departure/return date, days, reason for leave, address/phone number during leave

Other: Military deferment, vehicle license plate, vehicle registration copy, vehicle mileage information, vehicle location, driver's license copy, traffic violation inquiry result, shoe size, clothing size, height, weight, service used, stop data, employee internet access logs, entry/exit logs, entry/exit image recordings, employee daily activity data

How Do We Collect Your Personal Data?  

As an employer, we collect data by recording the information you have provided to us for the purpose of creating a personnel file, which we have requested from you directly to fulfill our legal obligations, to perform the employment contract between us, for reasons stipulated by law, and in the legitimate interest of the Company, or which we have requested from you in advance during your job application or which you have chosen to share with us during your job application.

We collect legal documents and notifications sent to us in order to fulfill our legal obligations.

Why Do We Process Your Personal Data?

In accordance with the law, as the Data Controller, we will record, store, classify, update, and process your personal data in accordance with Articles 5 and 6 of the KVKK within the framework described below and for the purposes specified in the following paragraph.

Within the framework described below and to fulfill the purposes specified in the following paragraph, our company, as the data controller, will collect, record, and process your Special Category Personal Data when necessary.

• •  The execution of information security processes, the execution of processes related to employee benefits and entitlements, the execution of audit/ethics activities, the execution of training activities, the execution of access rights, the execution of finance and accounting tasks, the proper planning, execution, and management of commercial partnerships and strategies, ensuring the legal, commercial, and physical security of itself and its business partners, ensuring corporate operations, planning and executing management and communication activities, communicating with personal data owners who submit requests and complaints to it and ensuring request and complaint management, event management, planning and executing employee satisfaction and/or loyalty processes, monitoring finance and/or accounting tasks, monitoring legal tasks,  fulfilling obligations arising from employment contracts and/or legislation for company employees, ensuring the security of company fixtures and/or resources, planning and executing company audit activities, planning and executing external training activities, Planning and execution of operational activities necessary to ensure that company activities are carried out in accordance with company procedures and/or relevant legislation, tracking job applications, Conducting statistical analyses to improve the services and products provided by our company and to plan and manage the company's internal operations.

On What Legal Basis Do We Collect Your Personal Data?

Your personal data, excluding special category personal data, will be processed for the purposes specified in this Information Notice;

• • Pursuant to Article 5/2(c) of the Law, the processing of personal data belonging to the parties to a contract is necessary for the establishment or performance of the contract, provided that it is directly related to the establishment or performance of the contract, and/or

• • Pursuant to Article 5/2(c) of the Law, and/or because it is necessary for the fulfillment of our legal obligations as the data controller,

• • Pursuant to Article 5/2(d) of the Law, where data processing is necessary for the establishment, exercise, or defense of a legal claim, and/or

• • Pursuant to Article 5/2 (f) of the Law, we collect, process, and transfer data to third parties within the country because it is necessary for our legitimate interests as the data controller. Since these data processing and transfer activities are carried out in accordance with the legal grounds specified above, your explicit consent is not required for them.

The transfer of your non-special category personal data abroad is based on your explicit consent in accordance with Article 9/1 of the Law.

Your special category personal data is collected, processed, and transferred based on your explicit consent in accordance with Article 6/2 of the Law for the purposes specified in this Information Notice, and is transferred based on your consent in accordance with Articles 8 and 9.

To Whom and for What Purposes Do We Transfer Your Personal Data Within the Country?

We may share the personal data specified above; your personal information may be shared with the consulting firms we work with to obtain consulting services on various matters, and your health data may be shared with our workplace physician to enable treatment and health checks. We may transfer payroll information to company auditors so that they can carry out their audit activities. In particular, in order to fulfill our legal obligations, we may share your data with our lawyers so that we can exercise our right of defense, and with relevant institutions and companies within the framework of our obligation to comply with legal requests such as court orders or requests for evidence, provided that they are in accordance with the law and procedure.

For the purposes of company management, conducting business, and implementing company policies, we may transfer your personal data to companies with which we have a business relationship, particularly to ensure our internal operations.

a-To our business partners, defined as real and legal persons with whom we have established cooperation and business partnerships, to the extent necessary to ensure the fulfillment of the purposes for which the business partnership was established,

b-To our suppliers, on a limited basis, to ensure that the products and services we source externally and that are necessary for us to carry out our activities are provided to us.

c-To persons providing advisory/support services, to the extent necessary to ensure that these services are provided as required,

d-To our shareholders; within the scope of corporate processes, limited to the purposes of the activities it carries out,

To e-Company officials, for the purpose of ensuring the highest level of management and oversight regarding our activities, strategy, and planning, and to a limited extent,

f-To legally authorized public institutions and organizations, limited to the purposes requested by the relevant public institutions and organizations within the scope of their legal authority.

g-Legally authorized private legal entities may transfer data to us, provided that such transfer is limited to the purpose requested within the scope of the legal authority of the private legal entities authorized to receive information and documents from us.

The personal data you provide to our company is shared with third-party companies we engage for services/support/consulting, including third-party business partners, lawyers, financial advisors, and auditors located within the country, for the purposes of ensuring your security and enabling our company to fulfill its legal obligations, to enable the payment of employee and employer premiums and the execution of personnel and payroll operations and the updating of relevant data, to fulfill the requirements of the Labor Law, Occupational Health and Safety Law, Social Security Law and related legislation, as well as other laws and regulations, in particular; The Labor Law, the Occupational Health and Safety Law, the Social Insurance and General Health Insurance Law, the Turkish Commercial Code, the Personal Data Protection Law No. 6698, the Identity Reporting Law, and other legislation, to the extent permitted and required by the provisions of such legislation, relevant institutions or organizations; Personal Data Protection Authority, Ministry of Finance, Ministry of Customs and Trade, Ministry of Labor and Social Security, Turkish Employment Agency (İş-Kur), Information and Communication Technologies Authority, and other public legal entities.

To Whom and for What Purposes Do We Transfer Your Personal Data Abroad?

Your personal data may be shared with third parties abroad for the purposes of communication during overseas travel, marketing activities, trade show organization and training, travel arrangements, and contact management within the scope of foreign trade, provided that it is necessary for the purposes specified above and with your explicit consent in accordance with Article 9/1 of the Law. Subject to the same principles, we may need to share your personal data with third parties abroad in order to obtain services such as servers, domains, hosting, IT, storage, data security software, business development, data analysis, and security from companies based abroad, provided that there are legitimate purposes and requirements.

If your personal data is to be transferred abroad, we will always check whether there is adequate protection in the foreign country to which your personal data will be transferred and whether the institution to which your personal data will be transferred abroad will take the necessary measures to ensure that your personal data is adequately protected, even if there is no adequate protection in that country. If there is any doubt that your personal data will not be adequately protected, your personal data will not be transferred abroad.

How long do we store your personal data?

Your personal data will be stored for the purposes outlined above for as long as your employment contract remains in effect. Personal data that must be retained by law will be stored for 10 (ten) years following the termination of your employment contract, in accordance with social security legislation. If an employment contract is not established with a job applicant, their personal data will be stored for 1 (one) year for the purpose of evaluating them for similar positions. After this period, your personal data will be deleted, destroyed, and/or anonymized by our company or at your request, in accordance with the Personal Data Protection Law and relevant regulations. You may withdraw your consent for the processing of your personal data, except for data that must be processed by law, at any time.

What are your rights under the KVKK?

As data subjects, pursuant to Article 11 of Law No. 6698, you have the right to: you have the right to learn about the processing status of your personal data, its purpose, and whether it is being used for its intended purpose; to know the third parties to whom your personal data has been transferred; to request the correction of any deficiencies; to request the deletion or destruction of your personal data if the reasons for its processing no longer exist; to object; and to request compensation for damages.   If you submit your requests to our Company using the methods outlined below, our Company will respond to your request as soon as possible and within thirty days at the latest, in accordance with the second paragraph of Article 13 of the same Law, depending on the nature of the request. To exercise the rights mentioned above, you may send your request, clearly stating that it relates to the KVKK and including the necessary information to identify yourself and explanations regarding the right you wish to exercise as specified in Article 11 of Law No. 6698, to the email address [email protected] with a secure electronic signature.

I acknowledge that I have read and understood the matters stated in the disclosure statement.