Text of Obligation to Inform on Website User Pursuant to Personal Data Protection Legislation

We, Suteks Tekstil Sanayi ve Ticaret A.Ş. (“Suteks” or “Company”), hereby inform you as data controller that we might record, store, preserve the personal data within the framework of the purposes specified in the Personal Data Protection Law numbered 6698 (“DP Law”) and detailed below, in a relevant, limited and proportionate manner and connected with these purposes while maintaining the accuracy and the up-to-date version of the personal data, and we might share it with the public institutions who authorized to request the personal data by law and transfer it to third parties and companies under the conditions stipulated by the DP Law.

1. Definitions in relation to the DP Law.

In the implementation of the DP Law;

• Anonymization: means making personal data incapable of being associated with an identified or identifiable natural person in any way, even by matching with other data;
• Data Subject: means natural person whose data is processed;
• Personal Data: means any information relating to an identified or identifiable natural person;
• Data Processing: means any operation performed on the Personal Data such as collection, recording, storage, retention, alteration, editing, disclosure, transferring, receiving, making retrievable, classification or prevention of the use thereof, totally or partially through an automatic registry system or non-automatic means provided that it is part of any data registry system;
• Board: means the Personal Data Protection Board;
• Authority: means the Personal Data Protection Authority;
• Data Processor: means natural person or legal entity authorized by the data controller to process personal data on behalf of the controller;
• Data Filling System: means the filling system in which the personal data is registered into through being structured according to certain criteria;
• Data Controller: means the natural or legal person who determines the purpose and means of processing personal data and is responsible for establishing and managing the data filling system;
• Sensitive Data: means special categories of personal data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

2. What is Personal Data? Which Personal Data is Processed?

Personal data means any information that identifies you or makes you identifiable. In this context, particularly your name and surname which is your personal identifying information, your Turkish identity number, and all kinds of information that can be associated with you such as your address and mobile phone number, bank account information, and location are referred to as “Personal Data”. In accordance with Article 6 of the DP Law, sensitive data such as race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data are referred to as “Sensitive Data”. Accordingly, your Sensitive Personal Data will not be processed.

The data processed and/or shared by Our Company are detailed as follows:

3. By Which Method Do We Collect/Process Your Personal Data?

In case you contact us through the communication channels provided on our website for you to contact us, we collect your Personal Data by various methods that are fully or partially automatic or non- automatic means as part of any data recording system, provided that it is written or electronically.

4. How is the Security of Personal Data Provided?

Suteks prioritizes protecting the privacy and security of Personal Data. Within this context, Suteks shall take all necessary technical and administrative measures for providing an adequate level of security to prevent the unlawful processing of personal data and unlawful access and to ensure the retention of personal data. Accordingly, the necessary system controls, data access controls, secure transferring controls, business continuity controls, and other necessary corporate controls are being conducted.

5. Do We Transfer Your Personal Data to Third Parties and/or Abroad?

As Suteks, we undertake that your Personal Data shall be stored securely and shall not be processed unlawfully.

In case of the existence of the above-mentioned legal reasons, we may share your Personal Data in a limited and proportionate manner and connected with the purpose of processing in accordance with the DP Law with external service providers (e.g., IT experts, database providers, backup and recovery experts, etc.) due to the fact that we receive support from them within the scope of the operation of our website, and authorized public institutions and organizations ex officio or upon request in order to ensure that our Company’s activities are carried out in accordance with the legislation.

In addition, within the scope of the above-mentioned purposes, limited to these purposes and in the presence of your explicit consent, we may transfer your personal data abroad following Article 9 of the DP Law due to our Company receiving infrastructure and information system services from a foreign- based service provider.

6. What Are Your Rights as the Data Subject and What Is the Application Procedure?

i. Your Rights Regarding Your Personal Data

We would like to state that you have the following rights regarding your data being processed by Suteks.

• To be informed whether your Personal Data is processed;
• To request further information about processing if your personal data is processed;
• To be informed of the purpose of the processing of your Personal Data and whether this data is used in line with its purpose;
• To be informed of the third parties in the country or abroad to whom personal data is transferred, if any;
• To request rectification of personal data subjected to process incompletely or inaccurately
• To request making notification to third parties whom Personal Data is transferred about the request for deletion and destruction of Personal Data;
• To request deletion or destruction of personal data when reasons which require the processing of this data cease to exist or Personal Data becomes out of date;
• To object to the occurrence of a result against you by analyzing your processed Personal Data exclusively through automated systems
• To request compensation for the damage arising from the unlawful processing of your Personal Data.

You can submit your requests regarding these mentioned rights to us through the application procedures below.

ii. Application

You may submit your requests regarding your Personal Data to our Company by filling out the application form on our website and delivering it to our address which is given at the end of this text herein, in person or via mail, courier, or notary public, to our registered electronic mail (REM) address through secure e-signature or mobile signature, or by applying to kvkk@suteks.com.tr through your email address which you have previously registered in our system.

Suteks will finalize your requests under the application as soon as possible and at the latest within 30 days depending on the nature of the request, and free of charge in this respect. However, if fulfilling your request incurs a cost, we may collect the price set out by the Board. The application form is available on the Company's common platform and you can access it at any time.

As a result of the applications made to Suteks, we may accept the application or reject them by explaining the reason and may submit this response to you in writing or via electronic media. If the application is accepted, Suteks is obliged to fulfill the demand in the application immediately.

iii. Identity Information of Data Controller

This text is prepared for the data subjects whose personal data is subjected to processing by the company as a data controller, and the term Suteks used in the text herein refers to the Suteks Tekstil Sanayi ve Ticaret A.Ş. which is established in Turkey and it has information stated below:

SUTEKS TEKSTİL SANAYİ VE TİCARET A.Ş.

MERSİS NO : 0784-0024-3870-0014

Address : Kemerburgaz Cad. No.16 Kağıthane/İstanbul

Telephone : +90 212 294 09 09

Fax : +90 212 294 04 76

REM Address : suteks@hs01.kep.tr