EFG ELECTRIC ENERGY INC.
PERSONAL DATA
RETENTION AND DISPOSAL POLICY

PURPOSE

EFG Electricity Energy Inc. has established this Personal Data Retention and Destruction Policy (“Retention and Destruction Policy”) to ensure the technical and administrative protection of personal data in accordance with the Law on the Protection of Personal Data No. 6698 (“Law”) and, in the event that the conditions for processing personal data no longer exist, the provisions of the Regulation on the Erasure, Destruction, or Anonymization of Personal Data (“Regulation”), published in the Official Gazette on October 28, 2017.

STORAGE MEDIA FOR PERSONAL DATA

Personal data belonging to data subjects is securely stored by Efg Elektrik Enerji A.Ş. in the media listed below, in compliance with the provisions of the Law and other relevant legislation:

Electronic media:

CRM
MS SQL Server
Email Inbox
Microsoft Office Programs
Video Recording Devices

Physical Environments:

Unit Cabinets
Folders
Archive

EXPLANATIONS REGARDING THE REASONS FOR RETENTION

Personal data belonging to data subjects is retained by Efg Elektrik Enerji A.Ş. specifically:

To ensure the continuity of operations,
To fulfill legal obligations,
To plan and fulfill employee rights and benefits,
To manage employment relationships,

and are stored securely in the physical or electronic environments listed above, within the limits specified by the Law and other relevant legislation.

Reasons for retention:

Personal data is directly related to the conclusion and performance of contracts,
Personal data being necessary for the establishment, exercise, or protection of a right,
The existence of a legitimate interest of Efg Elektrik Enerji A.Ş., provided that such processing does not infringe upon the fundamental rights and freedoms of individuals,
Personal data is necessary for Efg Elektrik Enerji A.Ş. to fulfill any legal obligation,
The retention of personal data is expressly provided for by law,
The existence of the data subjects’ explicit consent for retention activities that require such consent.

In accordance with the Regulation, personal data belonging to data subjects shall be deleted, destroyed, or anonymized by Efg Elektrik Enerji A.Ş. either on its own initiative or upon request in the following cases:

Amendment or repeal of the relevant statutory provisions forming the basis for the processing or storage of personal data,
The purpose requiring the processing or storage of personal data ceases to exist,
The conditions requiring the processing of personal data under Articles 5 and 6 of the Law no longer exist.
In cases where the processing of personal data is based solely on the condition of explicit consent, the data subject’s withdrawal of consent,
The data controller’s acceptance of the data subject’s request for the erasure, destruction, or anonymization of their personal data within the scope of their rights under Article 11(2)(e) and (f) of the Law,
In cases where the data controller rejects a request submitted by the data subject for the erasure, destruction, or anonymization of their personal data; where the response provided is deemed insufficient; or where the data controller fails to respond within the timeframe prescribed by the Law; A complaint is filed with the Board and the Board deems the request valid,
Even though the maximum period for retaining personal data has expired, there are no circumstances that would justify retaining the personal data for a longer period.

MEASURES TAKEN REGARDING THE PROTECTION OF PERSONAL DATA

Efg Elektrik Enerji A.Ş., in accordance with Article 12 of the Law, takes the necessary technical and administrative measures to ensure an appropriate level of security to prevent the unlawful processing of personal data it processes, to prevent unlawful access to such data, and to ensure the protection of the data; within this scope, it conducts or has conducted the necessary audits. In the event that personal data being processed is obtained by third parties through unlawful means despite all technical and administrative measures having been taken, Efg Elektrik Enerji A.Ş. will notify the relevant units of this situation as soon as possible.

4.1 Technical Measures

Network security and application security are ensured.
A closed-system network is used for the transmission of personal data over the network.
Key management is implemented.
Security measures are implemented in the procurement, development, and maintenance of information technology systems.
The security of personal data stored in the cloud is ensured.
Disciplinary regulations containing data security provisions for employees are in place.
Training and awareness programs on data security are conducted for employees at regular intervals.
An authorization matrix has been established for employees.
Access logs are maintained regularly.
Data masking measures are implemented as needed.
Corporate policies regarding access, information security, use, storage, and disposal have been developed and implemented.
Confidentiality agreements are signed.
The access privileges of employees who change roles or leave the company are revoked.
Up-to-date antivirus systems are used.
Firewalls are in use.
Signed contracts include data security provisions.
Personal data security policies and procedures have been established.
Personal data security issues are reported promptly.
Personal data security is monitored.
The necessary security measures are taken regarding access to and from physical environments containing personal data.
The security of physical environments containing personal data against external risks (fire, flood, etc.) is ensured.
The security of environments containing personal data is ensured.
Personal data is minimized as much as possible.
Personal data is backed up, and the security of the backed-up personal data is also ensured.
A user account management and authorization control system is in place, and these are monitored.
Periodic and/or random internal audits are conducted and commissioned.
Log records are maintained without user intervention.
Current risks and threats have been identified.
Protocols and procedures regarding the security of special-category personal data have been established and are being implemented.
If special-category personal data is to be sent via email, it is always sent in encrypted form using KEP or a corporate email account.
Intrusion detection and prevention systems are in use.
Cybersecurity measures have been implemented, and their enforcement is continuously monitored.
Encryption is used.
Sensitive personal data transferred via removable storage devices, CDs, or DVDs is encrypted before transfer.
Data processors are audited at regular intervals regarding data security.
Data security awareness is promoted among data-processing service providers.
Data loss prevention software is used.

4.2 Administrative Measures

Employees are trained on the technical measures to be taken to prevent unlawful access to personal data.
Access and authorization processes for personal data within Efg Elektrik Enerji A.Ş. are designed and implemented in accordance with legal compliance requirements for the processing of personal data at the business unit level. When restricting access, consideration is given to whether the data is sensitive and its level of importance.
All documents containing personal data that govern the relationship between Efg Elektrik Enerji A.Ş. and its employees must be handled in accordance with the obligations set forth by law to ensure the lawful processing of personal data; personal data must not be disclosed, that personal data must not be used in violation of the law, and that the confidentiality obligation regarding personal data continues even after the termination of the employment contract with Efg Elektrik Enerji A.Ş.
Employees are informed that they may not disclose personal data they have learned to others in violation of the provisions of the Law, nor may they use such data for purposes other than those for which it was processed, and that this obligation continues even after they leave their positions; accordingly, the necessary commitments are obtained from them.
Contracts entered into by Efg Elektrik Enerji A.Ş. with parties to whom personal data is lawfully transferred include provisions stipulating that such parties shall take the necessary security measures to protect personal data and ensure compliance with these measures within their own organizations.
In the event that processed personal data is obtained by others through unlawful means, the company notifies the relevant parties and the Board of this situation as soon as possible.
Where necessary, the company employs knowledgeable and experienced personnel regarding the processing of personal data and provides its personnel with training on personal data protection legislation and data security.
Efg Elektrik Enerji A.Ş. conducts and commissions the necessary audits to ensure compliance with the provisions of the Law. It addresses any privacy and security vulnerabilities identified as a result of these audits.

MEASURES TAKEN REGARDING THE DESTRUCTION OF PERSONAL DATA

Efg Elektrik Enerji A.Ş. may delete or destroy personal data—even if it has been processed in accordance with the relevant provisions of the law—at its own discretion or upon the request of the data subject, should the reasons necessitating its processing no longer exist. Following the deletion of personal data, the relevant individuals will under no circumstances be able to access or use the deleted data again. Efg Elektrik Enerji A.Ş. will manage an effective data tracking process regarding the definition and monitoring of personal data destruction procedures. The process will proceed in the following order: identification of the data to be deleted, identification of the relevant individuals, determination of the individuals’ access methods, and immediate deletion of the data.

Efg Elektrik Enerji A.Ş. may use one or more of the methods listed below to destroy, delete, or anonymize personal data, depending on the medium on which the data is stored:

Methods for the Deletion, Destruction, and Anonymization of Personal Data

Deletion of Personal Data

The deletion of personal data is the process of rendering personal data inaccessible and unusable by relevant users in any way. As a method for deleting personal data, Efg Elektrik Enerji A.Ş. may use one or more of the following methods:

Personal data on paper will be processed by blacking out, painting over, cutting out, or erasing it.
For office files stored in the central file system, the user(s)’ access rights will be revoked.
Rows or columns containing personal information in databases will be deleted using the “Delete” command.

When necessary, a specialist will be consulted to ensure secure deletion.

Destruction of Personal Data

The destruction of personal data is the process of rendering personal data inaccessible, irrecoverable, and unusable by anyone in any way through the following methods.

Physical Destruction
Destruction Using a Paper Shredder
Demagnetization: This method involves passing magnetic media through specialized devices that expose it to high magnetic fields, thereby corrupting the data on it to the point where it becomes unreadable.

Anonymization of Personal Data

Anonymization of personal data refers to the process of rendering personal data incapable of being associated with any identified or identifiable natural person, even when combined with other data. Efg Elektrik Enerji A.Ş. may use one or more of the methods listed below to anonymize personal data:

Masking: Masking is a method of anonymizing personal data by removing its key identifying information from the dataset.
Record Removal: In the record removal method, data rows containing unique identifiers are removed from the dataset, thereby rendering the stored data anonymous.
Regional Masking: In the regional masking method, if a single piece of data has identifying characteristics due to creating a very rare combination, masking that data ensures anonymization.
Global Encoding: Using the data derivation method, a more general content is created from the content of the personal data, ensuring that the personal data can no longer be linked to any specific individual. For example, specifying ages instead of birth dates; specifying the region of residence instead of a full address.
Noise Addition: The method of adding noise to data—particularly in datasets dominated by numerical data—anonymizes the data by adding deviations in the positive or negative direction at a specified rate to the existing data. For example, in a dataset containing weight values, applying a deviation of ±3 kg prevents the actual values from being identified and anonymizes the data. The deviation is applied equally to each value.

In accordance with Article 28 of the Law, anonymized personal data may be processed for purposes such as research, planning, and statistics. Such processing falls outside the scope of the Law, and the explicit consent of the data subject will not be required.

Efg Elektrik Enerji A.Ş. may make its own decision regarding the deletion, destruction, or anonymization of personal data and may freely determine the method to be used according to the category it has selected. Furthermore, under Article 13 of the Regulation, if the data subject selects one of the categories—deletion, destruction, or anonymization—of their personal data during the application process, Efg Elektrik Enerji A.Ş. will retain discretion regarding the methods to be used within the selected category.

RETENTION AND DISPOSAL PERIODS FOR PERSONAL DATA

Efg Elektrik Enerji A.Ş. retains personal data for the purposes for which it is processed for the periods specified in Appendix 1. If legislation stipulates a specific retention period for the personal data in question, that period will be adhered to. In the absence of a period specified by law, personal data will be retained for the maximum period set forth in the table in Appendix 1. These periods are determined based on an assessment of Efg Elektrik Enerji A.Ş.’s data categories and data subject groups; and were determined to ensure compliance with legal obligations and in accordance with the maximum statute of limitations period (10 years) set forth in the Turkish Code of Obligations.

In the event that the obligation to delete, destroy, or anonymize personal data arises upon the expiration of these periods, Efg Elektrik Enerji A.Ş. will delete, destroy, or anonymize the personal data during the first periodic data destruction process following that date.

All operations related to the erasure, destruction, and anonymization of personal data are recorded, and such records are retained for at least three years, except where other legal obligations apply.

PERIODIC DISPOSAL SCHEDULES

Pursuant to Article 11 of the Regulation, the periodic destruction period has been set at 6 months. Accordingly, periodic destruction is carried out in June and December of each year. In these systems, data will be permanently deleted in such a way that it cannot be recovered from any media on which it was stored, such as documents, files, CDs, floppy disks, or hard drives.

PERSONNEL

Under the Law, Efg Elektrik Enerji A.Ş., acting as the data controller, pursuant to Article 11, Paragraph 1 of the Regulation, the titles, departments, and job descriptions of the personnel responsible for fulfilling the obligations regarding the implementation of the data retention and destruction process under the Law are specified in the table in Appendix 2 of the Retention and Destruction Policy.

These designated individuals are responsible for the transactions and actions carried out within their respective authority limits under the Turkish Commercial Code, the Turkish Code of Obligations, and the Turkish Penal Code. In particular, the Chair of the Efg Elektrik Enerji A.Ş. Personal Data Protection Committee has been appointed as the authorized representative of Efg Elektrik Enerji A.Ş. to appear and testify before law enforcement agencies, public prosecutor’s offices, public institutions, and courts. Each department head is responsible for monitoring whether the relevant users within their departments are acting in accordance with the Retention and Destruction Policy and the Personal Data Policy, which were prepared in accordance with the Law and Regulations. All department heads shall report to the Chair of the Efg Elektrik Enerji A.Ş. Personal Data Protection Committee on the actions they have taken in accordance with this Retention and Destruction Policy within the specified periodic destruction timeframes. The decisions resulting from the analysis of these reports shall be implemented.

REVISION AND REPEAL

In the event of any amendment or repeal of this Retention and Destruction Policy, the new regulation will be announced on the Efg Elektrik Enerji A.Ş. website.

ENTRY INTO FORCE

This Retention and Destruction Policy enters into effect on the date of its publication.

APPENDICES

APPENDIX 1—Data Retention and Destruction Periods

APPENDIX 2—Table of Personnel Responsible for Personal Data Retention and Destruction

APPENDIX 1—Data Retention and Destruction Periods

Data Category	Retention Period	Destruction Period
Identity	10 years from the transaction date or the termination of the legal relationship	During the first periodic destruction period following the end of the retention period
Communication	10 years from the transaction date or the termination of the legal relationship	During the first periodic destruction period following the expiration of the retention period
Location	10 years from the transaction date or the termination of the legal relationship	During the first periodic destruction cycle following the expiration of the retention period
Personnel Records	10 years from the termination of employment	During the first periodic destruction cycle following the expiration of the retention period
Legal Proceedings	5 years from the date the court decision becomes final	During the first periodic destruction period following the expiration of the retention period
Legal Proceedings	10 years from the date of the transaction or the termination of the legal relationship	During the first periodic destruction period following the expiration of the retention period
Customer Transaction	10 years from the transaction date or the termination of the legal relationship	During the first periodic destruction cycle following the end of the retention period
Physical Premises Security	30 days	During the first periodic destruction cycle following the end of the retention period
Transaction Security	10 years from the transaction date or the termination of the legal relationship	During the first periodic destruction period following the end of the retention period
Risk Management	10 years from the transaction date or the termination of the legal relationship	During the first periodic destruction cycle following the end of the retention period
Finance	10 years from the transaction date or the termination of the legal relationship	During the first periodic destruction cycle following the end of the retention period
Professional Experience	10 years from the termination of employment	During the first periodic destruction period following the end of the retention period
Marketing	10 years from the end of employment	During the first periodic destruction period following the end of the retention period
Visual and Audio Recordings	10 years from the transaction date or the termination of the legal relationship	During the first periodic destruction period following the expiration of the retention period
Union Membership	10 years from the termination of employment	During the first periodic destruction cycle following the expiration of the retention period
Health Information	15 years	During the first periodic destruction period following the end of the retention period
Criminal Convictions and Security Measures	10 years from the termination of employment	During the first periodic destruction period following the expiration of the retention period
Family Information	10 years	During the first periodic destruction period following the end of the retention period
Work Data	10 Years	At the first periodic destruction date following the end of the retention period
Website Usage Data	2 years	At the first periodic destruction date following the expiration of the retention period
Request/Complaint Management Information	2 Years	During the first periodic destruction period following the expiration of the retention period
Reputation Management Information	10 Years	During the first periodic destruction period following the end of the retention period
Incident Management Information	2 Years	During the first periodic destruction period following the end of the retention period
Signatures	10 years	During the first periodic destruction period following the expiration of the retention period
Insurance Information	10 years from the end of employment	During the first periodic destruction period following the end of the retention period
Vehicle Information	10 years	During the first periodic destruction period following the end of the retention period
Compliance Information	10 Years	During the first periodic destruction period following the end of the retention period
Audit and Inspection	10 Years	During the first periodic destruction period following the end of the retention period
Foreign Residence Permit Information	10 years from the end of employment	During the first periodic destruction period following the expiration of the retention period

APPENDIX 2—Table of Personnel Responsible for Personal Data Retention and Destruction

Staff	Position	Responsibility
Personnel Supervisor	Implementation Officer	Ensuring that processes within their scope of responsibility comply with retention periods and managing the personal data destruction process in accordance with periodic destruction schedules
Administrative and Financial Affairs Officer	Application Officer	Ensuring that processes within the scope of their duties comply with retention periods and managing the personal data destruction process in accordance with periodic destruction schedules
	Data Protection Officer	Ensuring that processes within the scope of the role comply with retention periods and managing the personal data disposal process in accordance with periodic disposal schedules

KVKK

PERSONAL DATA PROTECTION AND PROCESSING POLICY

1.PURPOSE

As EFG ELEKTRİK ENERJİ A.Ş., our priority is to ensure that the personal data of natural persons associated with our Company, including our customers, subscribers and employees, are processed in compliance with the Constitution of the Republic of Türkiye, international conventions on human rights to which our country is a party, particularly the Personal Data Protection Law No. 6698 (“KVKK”), and other applicable legislation, and to ensure that the rights of the relevant persons whose data are processed can be effectively exercised. Therefore, including but not limited to our employees, subscribers, visitors, business partners, customers, dealers, users visiting our website and using our mobile applications, in short, all personal data obtained during our activities, we carry out all operations relating to the processing, storage and transfer of such data in accordance with the EFG ELEKTRİK ENERJİ A.Ş. Personal Data Protection and Processing Policy (“Policy”). The protection of personal data and safeguarding the fundamental rights and freedoms of natural persons whose personal data are collected constitute the fundamental principles of our policy regarding the processing of personal data. Therefore, we conduct all our activities involving the processing of personal data by observing the rights to privacy, confidentiality of communications, freedom of thought and belief, and effective legal remedies. In order to protect personal data, we take all administrative and technical protection measures required by the nature of the relevant data in accordance with applicable legislation and current technology. This Policy explains the methods we follow for the processing, storage, transfer, deletion or anonymization of personal data shared during our commercial, social responsibility and similar activities within the framework of the principles specified in the KVKK.

2.SCOPE

Including but not limited to the personal data of our employees, subscribers, visitors, business contacts, business partners, customers, potential customers, suppliers, dealers and users visiting our website, in short, all personal data obtained during our activities and processed by us fall within the scope of this Policy. Personal data protection applies only to natural persons, and information belonging to legal entities that does not contain information relating to a natural person is excluded from personal data protection. Therefore, this Policy does not apply to data belonging to legal entities. Our Policy applies to all personal data processing activities owned or managed by EFG ELEKTRİK ENERJİ A.Ş. and has been prepared by taking into account the KVKK, other relevant legislation relating to personal data and international standards in this field.

3.DEFINITIONS AND ABBREVIATIONS

This section briefly explains specific terms and expressions, concepts, abbreviations, etc. used in the Policy.

Company Name: EFG ELEKTRİK ENERJİ A.Ş.

Explicit Consent: Consent relating to a specific subject, based on being informed and free will, given in a clear manner that leaves no room for doubt and limited solely to the relevant processing activity.

Anonymization: Rendering personal data incapable of being associated with an identified or identifiable natural person under any circumstances, even by matching them with other data.

Employee: Refers to personnel of EFG ELEKTRİK ENERJİ A.Ş.

Personal Data Owner (Data Subject): The natural person whose personal data are processed.

Personal Data: Any information relating to an identified or identifiable natural person.

Special Categories of Personal Data: Data relating to individuals’ race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, association, foundation or trade union membership, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Processing of Personal Data: Any operation performed on personal data, such as obtaining, recording, storing, retaining, altering, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, whether wholly or partially by automated means or by non-automated means provided that they form part of a data recording system.

Data Processor: A natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.

Data Controller: A natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.

KVK Board: Personal Data Protection Board.

KVK Authority: Personal Data Protection Authority.

KVKK: Personal Data Protection Law published in the Official Gazette dated 7 April 2016 and numbered 29677.

KEP: Registered Electronic Mail address. It is a system that preserves all kinds of commercial and legal correspondence and document sharing in the form in which they were sent, definitively identifies the recipient, ensures that the content cannot be altered, and makes the content legally valid, secure and conclusive evidence.

Policy: EFG ELEKTRİK ENERJİ A.Ş. Personal Data Protection and Processing Policy.

4.DUTIES AND RESPONSIBILITIES

Company Management is responsible for the overall supervision of determining and operating notification, investigation and sanction mechanisms in cases of non-compliance with the Policy, rules and regulations. The KVKK working group is responsible for the preparation, development, implementation and updating of the Policy. This Policy is evaluated when necessary in terms of its currency and development requirements. The publication of the prepared document on the corporate portal is the responsibility of management.

5.LEGAL OBLIGATIONS

Our legal obligations as a data controller within the scope of the protection and processing of personal data pursuant to the KVKK are listed below:

A. Our obligation to inform

When collecting personal data as a data controller;

The purposes for which your personal data will be processed,

Information regarding our identity and, if applicable, the identity of our representative,

To whom and for what purposes your processed personal data may be transferred,

Our method of collecting data and its legal basis,

Rights arising from the law; we have an obligation to inform the Data Subject regarding these matters. As EFG ELEKTRİK ENERJİ A.Ş., we take care to ensure that this Policy, which is publicly available, is clear, understandable and easily accessible.

Our obligation to ensure data security

As a data controller, we take the administrative and technical measures prescribed by legislation to ensure the security of personal data under our responsibility. Obligations and measures relating to data security are detailed in Section 9 of this Policy.

6.CLASSIFICATION OF PERSONAL DATA

Personal data means any information relating to an identified or identifiable natural person. Personal data protection applies only to natural persons, and information belonging to legal entities that does not contain information relating to a natural person is excluded from personal data protection. Therefore, this Policy does not apply to data belonging to legal entities.

Data relating to individuals’ race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, association, foundation or trade union memberships, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, are special categories of personal data.

7.PROCESSING OF PERSONAL DATA

We process personal data in accordance with certain principles. We process personal data in accordance with the rules of good faith, transparently and within the framework of our obligation to inform. We take the necessary measures in our data processing procedures to ensure that processed data are accurate and up to date. We also provide the Personal Data Owner with the opportunity to contact us in order to update their data and correct any errors in processed data, if any. We process personal data within the scope of our legitimate purposes, the scope and content of which are clearly defined and which have been determined in order to carry out our activities within the framework of legislation and the ordinary course of commercial life. We process personal data in a manner that is relevant, limited and proportionate to the clearly and precisely defined purposes. We avoid processing personal data that are irrelevant or not required to be processed. Various regulations in the legislation require personal data to be stored for specific periods. Therefore, we retain the personal data we process for the periods prescribed by applicable legislation or required for the purposes of processing personal data and until the end of the relevant service period. Where the retention period prescribed by legislation expires or the purpose of processing ceases to exist, we delete, destroy or anonymize personal data. Our principles and procedures relating to retention periods are detailed in Section 9 of this Policy.

Your Personal Data;

Your personal data by which we may identify you, such as your name, surname, telephone number, e-mail address, customer number, contract number and user ID assigned to you in relation to your subscription,

Your voice call recordings kept by sales and customer representatives in accordance with call center standards and your personal data obtained when you contact us via e-mail,

Your credit card and debit card information, branch code, account number and other banking information,

Your data obtained through sales, such as request and transaction information through sales channels,

Your personal data containing usage details such as your usage volume of value-added services, content and personal information provided by you, and other records,

If you apply for a job, other personal data obtained in this context, including your CV, and if you are an employee of EFG ELEKTRİK ENERJİ A.Ş. or an associated employee, all personal data relating to your employment agreement and suitability for employment,

Informing you about our new products and services and providing you with the products and services most suitable for you,

Making offers to you based on the way you use our products and services and informing you about new services,

Conducting analyses for the purpose of improving our products and services,

Training and developing our employees,

Issuing invoices in return for your use of our products and services,

Verifying your identity,

Responding to any questions and complaints you may have regarding our products or services,

Analyzing your use of our products and services for the purpose of developing and improving the products and services we provide to you,

Providing the necessary information in line with requests and inspections by regulatory and supervisory institutions and official authorities,

Ensuring the consistency of your information,

Measuring customer satisfaction,

Including but not limited to the provision of services relating to our products and services, including the execution of customer services and sales operations, management of services, traffic management, analysis of products and services, marketing activities and communications such as determining and measuring campaigns, tariffs, products and strategies, customer services and satisfaction, financial reporting and analysis, legal proceedings, service optimization and similar purposes.

Special categories of personal data are processed by us by taking the administrative and technical measures prescribed by law and by the KVK Board and where explicit consent exists, or in cases where processing is required by legislation. Since special categories of personal data relating to health and sexual life may be processed for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing by persons subject to confidentiality obligations or authorized institutions and organizations, such data are not processed by us except for data relating to our employees. Such data belonging to our employees may be processed by persons prescribed by law.

In exceptional cases arising from the law where explicit consent is not required for the processing of personal data, we may process personal data without obtaining explicit consent.

TRANSFER OF PERSONAL DATA

As EFG ELEKTRİK ENERJİ A.Ş., we act in compliance with the provisions of the KVKK and the decisions and regulations adopted by the KVK Board regarding the transfer of personal data. Except for exceptional circumstances specified in the legislation, personal data and special categories of personal data are not transferred by us to other natural or legal persons without the explicit consent of the Data Subject. In exceptional circumstances stipulated by the KVKK and other legislation, data may also be transferred without the explicit consent of the Data Subject to authorized administrative or judicial institutions or organizations in the manner and within the limits prescribed by the legislation. In addition, in exceptional circumstances prescribed by the legislation, data may be transferred without requiring explicit consent. As a rule, personal data are not transferred abroad without the explicit consent of the Data Subject.

Personal data may be transferred, including but not limited to, our suppliers, business partners and business contacts, subsidiaries and group companies, legally authorized public institutions and organizations, legally authorized private-law entities and our shareholders, in accordance with the principles and rules explained above.

In order to protect personal data, including but not limited to, we establish an internal technical organization for the processing and storage of personal data in accordance with legislation, establish the technical infrastructure necessary to ensure the security of databases in which your personal data will be stored, monitor and audit the processes of the technical infrastructure created, determine procedures for reporting the technical measures we take and the audit processes, periodically update and renew technical measures, reassess risky situations and develop necessary technological solutions, use software or hardware security products such as antivirus systems and firewalls, and establish security systems in line with technological developments.

In order to protect your personal data, including but not limited to, we establish personal data access policies and procedures covering employees of companies and subsidiaries within our group, inform and train our employees regarding the lawful protection and processing of personal data, record the measures to be taken in cases where personal data are processed unlawfully by our Company Employees in agreements concluded with our employees and/or in the Policies we establish, and audit the personal data processing activities of the data processors with whom we work or the partners of such data processors.

9.RETENTION OF PERSONAL DATA

Personal data are retained for the period prescribed by applicable legislation or required for the purpose for which they are processed. Without prejudice to the retention periods prescribed by legislation, we retain personal data for as long as required by the purpose of processing and for the duration of the continuity of products and services. Where we process personal data for more than one purpose, the data are deleted, destroyed or retained in anonymized form where the purposes of processing cease to exist or where, upon the request of the Data Subject, there is no legal obstacle to deleting the data. The provisions of legislation and decisions of the KVK Board are complied with regarding destruction, deletion or anonymization.

The measures we take regarding the retention of personal data include establishing technical infrastructures and related audit mechanisms for the deletion, destruction and anonymization of personal data, taking the necessary measures for the secure retention of personal data, employing personnel with technical expertise, establishing business continuity and emergency plans against potential risks and developing systems for their implementation, establishing security systems in accordance with technological developments relating to personal data storage environments, informing our employees about technical and administrative risks relating to the retention of personal data and raising awareness, and, where cooperation with third parties is required for the retention of personal data, including provisions in agreements concluded with companies to which personal data are transferred requiring the persons to whom personal data are transferred to take the necessary security measures for the protection and secure retention of transferred personal data.

10.SECURITY OF PERSONAL DATA

Our obligations regarding the security of personal data are to prevent the unlawful processing of personal data, prevent unlawful access to data and ensure that personal data are retained in accordance with the law. In this context, administrative and technical measures are taken according to technological possibilities and implementation costs.

The measures we take to prevent the unlawful processing of personal data are as follows:

– Conducting and having the necessary audits conducted within the Company,

-Training and informing our employees about the lawful processing of personal data,

-Evaluating the activities carried out by our Company in detail for all business units and, as a result of such evaluation, processing personal data specifically within the commercial activities carried out by the relevant units,

-Where cooperation with third parties is undertaken for the purpose of processing personal data, including provisions in agreements concluded with companies processing personal data requiring persons processing personal data to take the necessary security measures,

-In the event of unlawful disclosure of personal data or a data breach, notifying the KVK Board of the situation and carrying out the examinations prescribed by legislation and taking the necessary measures.

The technical and administrative measures we take to prevent unlawful access to personal data are as follows:

-Periodically updating and renewing technical measures,

-Establishing access authorization procedures within our Company,

-Determining procedures for reporting the technical measures we take and audit processes,

– Establishing the data recording systems used within our Company in accordance with legislation and carrying out periodic audits thereof,

-Establishing emergency plans against potential risks and developing systems for their implementation,

-Training and informing our employees regarding access to and authorization for personal data,

-Where cooperation with third parties is undertaken for activities such as the processing and storage of personal data, including provisions in agreements concluded with companies providing access to personal data requiring persons with access to personal data to take the necessary security measures,

-Establishing security systems within the scope of technological developments in order to prevent unlawful access to personal data.

We take administrative and technical measures to prevent the unlawful disclosure of personal data and update these measures in accordance with our relevant procedures. If we determine that personal data have been disclosed without authorization, we establish systems and infrastructures to notify the Data Subject and the KVK Board of such situation. If an unlawful disclosure occurs despite all administrative and technical measures taken, where deemed necessary by the KVK Board, such situation may be announced on the KVK Board’s website or by another method.

11.RIGHTS OF THE PERSONAL DATA OWNER

Within the scope of our obligation to inform, we inform the Personal Data Owner and establish systems and infrastructures relating to such information. We make the necessary technical and administrative arrangements to enable the Personal Data Owner to exercise their rights regarding personal data.

The Personal Data Owner has the following rights regarding their personal data:

-To learn whether personal data are being processed,

-To request information if personal data have been processed,

-To learn the purpose of processing personal data and whether they are being used in accordance with their intended purpose,

-To know the third parties to whom personal data are transferred domestically or abroad,

-To request the correction of personal data if they have been processed incompletely or incorrectly,

-To request the deletion or destruction of personal data if the reasons requiring their processing cease to exist,

-To request that the correction, deletion or destruction operations mentioned above be notified to third parties to whom personal data have been transferred,

-To object to the occurrence of a result against the individual arising from the analysis of processed data exclusively through automated systems,

-To request compensation for damages in the event of suffering damage due to the unlawful processing of personal data.

The Personal Data Owner may submit your requests within the scope of the KVKK and any questions regarding your personal data by writing a petition and sending it to Mevlana Mah. 832. Sk. No:1 Gaziosmanpaşa/İstanbul address (through a Notary Public, etc.) or by sending the relevant form signed with a secure electronic signature to our registered electronic mail address [email protected]. You may also submit your request through the KVKK Information Inquiry section at www.efgelektrik.com.

In the application to be made by the Personal Data Owner in order to exercise the above-mentioned rights and containing explanations regarding the right requested to be exercised, the requested matter must be clear and understandable, the requested matter must relate to the applicant personally or, if acting on behalf of another person, the applicant must be specifically authorized in this regard and such authorization must be documented; furthermore, the application must contain identity and address information and documents verifying the applicant’s identity must be attached to the application. Such requests must be made individually, and requests made by unauthorized third parties regarding personal data will not be taken into consideration.

Requests relating to personal data shall be concluded free of charge as soon as possible depending on their nature and, in any event, within no more than 30 (thirty) days, or, where the conditions specified in the tariff to be published by the KVK Board regarding fees arise, in return for the fee specified in such tariff. Additional information and documents may be requested during the application process or while the application is being evaluated.

Applications relating to personal data shall be rejected with justification in the following written circumstances:

-Processing personal data for purposes such as research, planning and statistics by anonymizing them through official statistics,

-Processing personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that such processing does not violate privacy or personality rights or constitute a criminal offence,

-Processing personal data made public by the Personal Data Owner

-The application not being based on a justified reason

-The application containing a request contrary to applicable legislation

-Failure to comply with the application procedure shall result in rejection with justification.

In order for the response period specified in Article 11 of this Policy to commence, requests must be submitted in writing and with a wet signature or electronically signed and sent via KEP, or through other methods determined by the KVK Board, together with information and documents verifying the applicant’s identity. If the request is accepted, the relevant action shall be taken and notification shall be made in writing or electronically. If the request is rejected, the reason shall be explained and notified to the applicant in writing or electronically. In the event that the application is rejected, the response provided by us is considered insufficient, or no response is provided within the prescribed period, the applicant has the right to lodge a complaint with the KVK Board within 30 (thirty) days from the date on which the applicant learns of the response and, in any event, within 60 (sixty) days from the date of application.

12.PUBLICATION AND RETENTION OF THE DOCUMENT

This Policy is retained in two different media: printed paper and electronic format. The current version of the documents is available on the corporate portal and website.

13.UPDATE PERIOD

This Policy is reviewed at least once a year and is updated by Operations Management where necessary.

14.EFFECTIVE DATE

This Policy enters into force on the date of its adoption by the Executive Board.

Corporate

Monoblock Concrete Pavilions

Application Form

Personal Data Retention and Destruction Policy

EFG ELECTRIC ENERGY INC.
PERSONAL DATA
RETENTION AND DISPOSAL POLICY

PURPOSE

STORAGE MEDIA FOR PERSONAL DATA

EXPLANATIONS REGARDING THE REASONS FOR RETENTION