EVELUX TRAFİK GÜVENLİK SİSTEMLERİ VE REFLEKTİF ÜRÜNLER TİC.A.Ş.

STATEMENT ON THE PROCESSING OF PERSONAL DATA

1. Data Controller Information

Data Controller: Evelux Trafik Güvenlik Sistemleri ve Reflektif Ürünler Tic. A.Ş..

MERSIS No: 0995052657500014

Address: Konya Organized Industrial Zone (KOS), Kırım Street, Sarıçiçek Street No: 3, Selçuklu / KONYA

Phone & Fax: +90 212 210 07 42

E-mail: satis@eveluxtech.com

Website: www.evelux.com.tr

Pursuant to Article 10 of the Law No. 6698 on the Protection of Personal Data (“KVKK”), as EVELUX TRAFFIC SAFETY SYSTEMS AND REFLECTIVE PRODUCTS INC., in the capacity of “Data Controller,” we would like to inform and enlighten you regarding the purposes, legal grounds, and rights concerning the processing of your personal data.

Our Company takes all necessary technical and administrative security measures at the highest possible level to ensure that your personal data is collected, stored, shared, and protected in compliance with the Law No. 6698.

2. Data Controller and Representative

Your personal data may be processed, recorded, stored, classified, updated, and disclosed/transferred to third parties where permitted by law, or limited to the purpose of processing, by EVELUX, acting as the data controller, in accordance with the principles of lawfulness and good faith, and for the purposes specified below.

3. Purpose of Processing Personal Data

Your personal data is processed in compliance with the basic principles set forth in KVKK for the following purposes:

1. Managing emergency response processes,
2. Conducting information security processes,
3. Managing job application processes for candidates,
4. Fulfilling employment and legal obligations for employees,
5. Managing employee benefits and entitlements,
6. Conducting audit and ethical compliance activities,
7. Carrying out training activities,
8. Ensuring compliance with legal regulations,
9. Managing financial and accounting transactions,
10. Ensuring physical security of company premises,
11. Following up and conducting legal affairs,
12. Managing communication activities,
13. Planning human resources processes,
14. Carrying out occupational health and safety activities,
15. Managing procurement processes for goods and services,
16. Managing sales processes for goods and services,
17. Managing customer relations processes,
18. Conducting data storage and archiving activities,
19. Managing contractual processes,
20. Following up on requests and complaints,
21. Providing information to authorized persons, institutions, and organizations,
22. Executing management activities,
23. Preparing various reports.

Your personal data is processed only for the purposes mentioned above and stored securely, physically or electronically, for a period appropriate to the purpose of processing.

In the course of these activities, our Company acts in full compliance with all obligations set forth in the KVKK and other relevant legislation regarding the protection of personal data.

For more detailed information regarding our data processing policy, you may review the EVELUX Personal Data Protection and Privacy Policy available at www.evelux.com.tr.

4. Transfer of Your Personal Data

Your personal data, processed lawfully by EVELUX, may be transferred to our business partners, authorized public institutions and organizations, internet service providers, occupational health and safety service providers, certified public accountants, legal consultants, banks, logistics companies, suppliers, subcontractors, or foreign-based websites due to international data transfers.

Additionally, for the purposes of company management, business operations, and implementation of corporate policies, your personal data may be disclosed/transferred to Microsoft Office applications or other databases located in countries with or without adequate protection, and to other third parties, due to various legal obligations.

5. Rights of the Data Subject under Article 11 of the KVKK

By applying to our Company, you have the right to:

1. Learn whether your personal data is processed,
2. Request information regarding the processing of your personal data,
3. Learn the purpose of the processing and whether your personal data is used in accordance with this purpose,
4. Learn about third parties to whom your data is transferred domestically or abroad,
5. Request correction of your personal data if it is incomplete or inaccurate,
6. Request deletion or destruction of your personal data when the reasons requiring its processing no longer exist, and request that the third parties to whom the data has been transferred be notified of such actions,
7. Request compensation for damages in case you suffer loss due to unlawful processing of your personal data.

6. Method and Legal Basis for Collecting Personal Data

Your personal data is processed for the above-mentioned purposes based on and in accordance with:

the Turkish Code of Obligations No. 6098, Turkish Commercial Code No. 6102, Tax Legislation, Social Security Legislation, Consumer Protection Law No. 6502, Labor Law No. 4857, Law on the Regulation of Electronic Commerce No. 6563, Occupational Health and Safety Law No. 6331, Customs Law No. 4458, and related regulations, communiqués, and other relevant legal provisions; or within the scope of contractual relationships, or based on your explicit consent.

The processing of personal data includes all kinds of operations performed on data, whether fully or partially by automated means or by non-automated means provided that it forms part of a data recording system—such as obtaining, collecting, recording, storing, preserving, modifying, reorganizing, disclosing, transferring, taking over, making available, classifying, or preventing the use of personal data.

In our Company, personal data is collected verbally, in writing, or electronically for the purposes stated above through, but not limited to:

1. Security camera recordings within our workplace,
2. Complaint and suggestion forms submitted by consumers on our website,
3. Preparation of personnel files,
4. Receiving orders and concluding contracts,
5. E-mails sent to the Company or our employees’ corporate e-mail addresses, faxes, or written messages sent to employees’ mobile phones.

According to Article 13(1) of the KVKK, you may submit your requests regarding your rights above in writing or by other methods determined by the Personal Data Protection Board (KVKK Board).

As no alternative method has yet been determined by the Board, applications must currently be made in writing to our Company in accordance with the KVKK.

In this context, you may deliver your written application—along with documents verifying your identity and specifying which right you wish to exercise under Article 11 of the KVKK—to the address below in person, via notary public, by other methods stipulated in the Law, or by sending it signed with a secure electronic signature to our registered e-mail (KEP) address.

EVELUX will evaluate and finalize your request as soon as possible and, in any case, within thirty (30) days, free of charge.

However, if responding to your request incurs additional costs, you may be charged a fee according to the tariff set by the Personal Data Protection Board.