• Purpose and Scope of the Clarification Text

As Tolkar Makina Sanayi ve Ticaret Anonim Şirketi, we take measures to protect your personal data within the scope of the Personal Data Protection Law No. 6698 (hereinafter referred to as “KVKK”). We process your personal data within the scope of KVKK and relevant legislation and in our capacity as “data controller” for the reasons and methods described below.

Tolkar Makina Sanayi ve Ticaret Anonim Şirketi Clarification Text for Employees has been prepared to inform you in the most transparent way about the identity of the data controller, the method and legal reason for collecting your personal data, the purpose for which this data will be processed, to whom and for what purpose it can be transferred, the data processing period and your rights listed in Article 11 of the KVKK in accordance with the article titled “Data Controller’s Obligation to Inform” in Article 10 of the KVKK. The explanations made for your “Personal Data” in the Clarification Text also cover your “Sensitive Personal Data”.

• Data Controller

Company Title: Tolkar Makina Sanayi ve Ticaret Anonim Şirketi

Address: AOSB 10036 Sokak No:4-6 P.K. 35620 Çiğli / İzmir

(hereinafter referred to as the “Company” within the scope of this Clarification Text)

• Method and Legal Reason for Collecting Your Personal Data

Your personal data may be collected verbally, in writing or electronically by automated or non-automated methods, our Company’s affiliated units, social media channels, software used for the execution of activities within the Company, through camera shooting and similar means. Your personal data may be processed by creating and updating as long as your relationship with our Company continues within the framework of the period specified in the legislation or stipulated by the purposes of processing, and may be kept in both digital and physical environment.

Your personal data is processed in line with the purposes set out in the heading “Your Personal Data Processed and the Purposes of Processing” and in accordance with the explicit consent requirement under paragraph 1 of Article 5 of the KVKK or specified in accordance with paragraph 2 of Article 5;

1. a) Explicitly stipulated in the law,
2. c) Directly related to the conclusion or performance of a contract,

ç) It is mandatory for the data controller to fulfill its legal obligation,

1. e) Data processing is mandatory for the establishment, exercise or protection of a right,
2. f) Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject

processed within the scope of personal data processing conditions.

Your personal data of special nature, in line with the purposes stated in the heading “Your Personal Data Processed and Purposes of Processing” and in accordance with paragraph 3 of Article 6 of the KVKK;

1. a) Explicit consent of the person concerned,
2. b) Explicitly stipulated in the law,
3. d) Necessity for the establishment, exercise or protection of a right,
4. f) It is mandatory for the fulfillment of legal obligations in the areas of employment, occupational health and safety, social security, social services and social assistance,
5. e) It is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning, management and financing of health services by persons under the obligation to keep secrets or authorized institutions and organizations

processed within the scope of special categories of personal data processing conditions.

4. Your Processed Personal Data and Purposes of Processing

Your personal data are processed securely and in accordance with KVKK in order to provide a more accurate service in accordance with legal obligations or in the business and transactions of our Company. In this context, the data in the table are collected as personal data.

Your personal data collected;

• To enable our relevant business units to carry out the necessary work so that real or legal third parties, institutions and organizations (employees, visitors, suppliers, business partners) who have a relationship with our Company can benefit from the products and services of our Company or the centers and units affiliated to our Company,
• Ensuring the security of life and property, legal, commercial and occupational health and safety of real and/or legal third party institutions and organizations where the Company’s business is carried out or in the headquarters and units of our Company,
• Storage of camera footage, ensuring discipline, security and inspections in case you are physically present at the headquarters and units where Company business is carried out or affiliated to our Company,
• Labor Law No. 4857, Turkish Code of Obligations No. 6098, Law No. 6331 on Occupational Health and Safety, Vocational Education Law No. 3308, Social Security and General Health Insurance Law No. 5510, Regulation on the Processing of Personal Health Data and Protection of Privacy, Personal Data Protection Law No. 6698, Tax Procedure Law No. 213, Turkish Commercial Code No. 6102, Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed through These Publications, the Regulation on Archival Services and the fulfillment of legal and regulatory requirements arising / may arise from all relevant laws and secondary regulations and taking the necessary measures within this scope,
• Carrying out auditing and/or regulatory duties to be carried out by the authorized and authorized public institutions and organizations and professional organizations in the nature of public institutions,
• Fulfillment of information and document requests by judicial bodies and/or administrative authorities,
• Execution of Human Resources processes and policies,
• Carrying out activities related to the training and career development of employees,
• Fulfillment of requests for participation in organizations such as training, seminars, etc,
• Fulfillment of rights and obligations offered by contracted banks, insurance companies and other institutions within the framework of agreements,
• Ensuring the safe, efficient and effective use of the tools and equipment delivered to our employees,
• Execution and planning of advertising and promotional activities,
• Compliance with other information retention, reporting and disclosure obligations stipulated by legislation, relevant regulatory bodies and other authorities,
• Fulfillment of court orders,
• To be able to operate the audit and disciplinary process in incidents that may occur within our Company,
• Preparation of various reports, studies and presentations, planning of emergency management processes,
• Taking the necessary measures for occupational health and safety within the scope of our obligations arising from the legislation, planning and execution of training processes, early intervention in health-related issues,
• Taking all necessary technical and administrative measures for systems and applications within the scope of data security

purposes within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the LPPD.

5. To Whom and For What Purpose Your Processed Personal Data Can Be Transferred

By ensuring that all necessary technical and administrative measures are taken to ensure the appropriate level of security in accordance with the KVKK and the relevant legislation, in line with the above-mentioned purposes;

• Persons/institutions and/or organizations permitted by other relevant legislation provisions,
• Lawyers or law partnerships for the follow-up of legal affairs,
• Financial advisors to carry out financial and accounting transactions,
• Our direct/indirect domestic/international shareholders,
• Private insurance companies, banks, funds, foundations,
• Our subsidiaries and/or affiliates,
• Consultants
• Business partners,
• To domestic/foreign organizations from which we contractually receive services and/or provide services, cooperate, cooperate with in order to carry out our activities

Personal data may be transferred within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the KVKK.

• Duration of Processing and Storage of Your Personal Data

Your personal data, limited to the purposes specified in this Clarification Text, will be processed by complying with the data processing and statute of limitations periods specified in all relevant laws and other legal legislation to which our Company and the centers and units affiliated to our Company are subject. In case of changes in the laws regarding data processing periods, the new periods determined will be taken as basis.

As a requirement of the principle of purpose limitation, your personal data is processed limited to the fulfillment of the purposes described in this Clarification Text and in any case for the period required to be processed in accordance with the legal periods, the practices of our Company and the customs of its commercial life, and after the expiration of the periods, it is deleted, destroyed or anonymized. If you want to get detailed information about the retention periods of your personal data, you can contact us via the addresses in the rights section of the relevant person.

• Rights of the Relevant Person

As a data subject, you may submit your requests within the scope of Article 11 of the KVKK regulating the rights of the data subject in accordance with the “Communiqué on the Procedures and Principles of Application to the Data Controller” “AOSB 10036 Sokak No:4-6 P.K. 35620 Çiğli / İzmir” in writing to or info@tolkar.com address provided that your e-mail is registered in the Company’s systems, by sending it electronically to the e-mail address of our Company tolkarmakas@hs01.kep.tr kep address via registered e-mail and exercise the above-mentioned rights. More comprehensive regulations on this subject, Tolkar Makina Sanayi ve Ticaret Anonim Şirketi Personal Data Application Form.