Privacy Notice Under the Law on the Protection of Personal Data No. 6698

Data Controller: OPAXA GROUP INDUSTRIAL ENGINEERING INDUSTRY AND TRADE INCORPORATED COMPANY
Address: Atatürk Mah. Ertuğrul Gazi Sk. Metropol İstanbul C1 Block No: 2 B, Interior Door No: 376, Ataşehir/Istanbul

This Information Notice; has been prepared by OPAXA GROUP INDUSTRIAL ENGINEERING INDUSTRY AND TRADE INCORPORATED COMPANY (“Company”) to inform data subjects regarding the processing of your personal data in the context of website processes, in accordance with the Personal Data Protection Law No. 6698 (“KVKK”) and relevant legislation.

a) Data Controller

Your personal data is processed by the Company in its capacity as the data controller under the KVKK and relevant legislation.

b) Processed Personal Data

In the processes conducted through the website, the following categories of personal data may be processed:

• Identification information: First name and last name
• Contact information: Phone number, email address
• Transaction security / traffic information: IP address, access/log records (within the scope of the website’s operation and security)
• Request/message content: Content submitted by you via the contact form or email

c) Purposes and Legal Grounds for Processing Personal Data

Your personal data is processed for the following purposes:

• To carry out the necessary work to enable you to benefit from the products and services offered by our company, and to receive and respond to your requests and applications
• To provide information regarding products/services and to manage customer relationship processes
• To plan and/or carry out sales, marketing, and market research activities (with your consent for commercial electronic communications where required by law)
• To fulfill legal obligations and to establish, exercise, or protect rights in the event of potential disputes
• Conducting information security processes and ensuring website security

Your personal data is processed based on the legal grounds set forth in Article 5 of the Personal Data Protection Law (KVKK). In this context, the primary legal grounds may include: explicit provision in laws, direct relevance to the conclusion or performance of a contract, fulfillment of a legal obligation, establishment, exercise, or protection of a right, and legitimate interest (provided it does not infringe upon fundamental rights and freedoms). In cases where explicit consent is required by law, your data is processed based on your explicit consent.

d) To Whom and for What Purpose Personal Data May Be Disclosed

Your personal data will be shared, to the extent necessary and in compliance with the Personal Data Protection Law (KVKK), for the purposes outlined above:

• With authorized public institutions and organizations (if requested or required by law),
• with our service providers/suppliers (e.g., IT infrastructure, hosting, email services, CRM, and other technical services; only to the extent necessary for the performance of the service),

may be shared or transferred.

e) Transfer Abroad

In company processes, if online software/infrastructure services with servers or databases located abroad are used, your personal data may be transferred abroad in accordance with Article 9 of the KVKK.

Transfer abroad is carried out provided that at least one of the processing conditions set forth in Articles 5 and/or 6 of the KVKK is met and the transfer conditions stipulated under Article 9 of the KVKK are fulfilled. In this context, the transfer is made to:

• To countries, sectors within a country, or international organizations for which the Board has issued a adequacy decision, or
• subject to the provision of appropriate safeguards (e.g., the conclusion of standard contracts published by the Board, binding corporate rules, etc.) and the availability of effective remedies for the data subject to exercise their rights

The Company takes care to ensure data security by implementing the necessary technical and administrative measures during transfer processes.

f) Method and Legal Basis for Collecting Personal Data

Your personal data is collected electronically through automated or non-automated methods when you fill out a contact form on the website, send an email, and/or visit the website. Collection and processing activities are limited to the purposes and legal grounds specified in section (c) above.

g) Your Rights Under Article 11 of the KVKK

As a data subject, you have the following rights under Article 11 of the KVKK:

• To learn whether your personal data is being processed,
• To request information regarding such processing if it has occurred,
• To learn the purpose of the processing and whether it is being used in accordance with that purpose,
• To know the third parties to whom your personal data has been transferred within or outside the country,
• To request the correction of any incomplete or incorrect processing,
• Requesting that it be erased or destroyed in accordance with the conditions set forth in the KVKK,
• Requesting that third parties be notified of the correction, erasure, or destruction,
• Objecting to a decision made solely through automated processing that adversely affects you,
• To request compensation for any damages incurred due to unlawful processing.

• In writing (in person, through a notary, or by certified mail) to our address,
• Via KEP address (if available),
• Signed with a secure electronic signature or mobile signature,
• Via email to the email address previously provided by you and registered in the company system (if available).

Application Address: Atatürk Mah. Ertuğrul Gazi Sk. Metropol İstanbul C1 Block No: 2 B Inner Door No: 376 Ataşehir/İstanbul

h) Retention Period for Personal Data

Your personal data will be deleted, destroyed, or anonymized in accordance with the KVKK and the Company’s data retention and destruction policy once the purpose of processing ceases to exist and the mandatory retention periods stipulated by applicable legislation have expired.

i) Changes and Updates

This Privacy Notice has been prepared in accordance with the KVKK and relevant legislation. The text may be updated in the event of changes in legislation and/or the Company’s personal data processing procedures. You can access the most up-to-date version of the Privacy Notice via our website.