GENERAL INFORMATION TEXT

1. Identity of the Data Controller

As Alemdar Group, in accordance with the Personal Data Protection Law No. 6698 (‘Law’) and in our capacity as data controller, we hereby present our information notice regarding the personal data we collect:

2. Processing of Personal Data and Purposes of Processing

Although it may vary depending on the service or commercial activity offered by Alemdar Group, personal data belonging to the data subjects specified below may be processed in order to ensure that our Company can provide the best possible service. In this context;

• If you are an employee/contact person/partner/authorised representative of an individual trader or legal entity supplier/subcontractor/business partner of our company or of the group companies to which our company belongs, or of a third party whose services our company uses, identity, contact details, personal history (CV), legal transaction information, physical premises security, risk management, finance (IBAN/bank account details), professional experience, your visual and audio recordings, and, if shared by you or your employer, your special category personal data such as health and criminal conviction and security measure data, as well as your religion and blood type information contained in your identity documents (which can be obtained indirectly through your identity card/driving licence). Within the scope of our company's activities, the execution of contract processes and goods and services procurement processes, the execution and supervision of business activities, the execution of business continuity activities, the execution of finance and accounting tasks, the execution of assignment processes, the execution of audit activities, exercising access rights, following up and executing legal affairs, executing performance evaluation processes, executing sponsorship/aid activities, executing occupational health and safety activities, processing work and residence permits for foreign supplier personnel, executing communication activities, creating press releases within the scope of corporate communication processes, organising and managing events, including hotel and flight reservations, carrying out logistics and cargo activities, carrying out risk management processes, carrying out internal audit/investigation/intelligence activities, providing information to authorised persons, institutions and organisations upon request, ensuring the continuity of information systems, carrying out storage and archiving processes

• If you are an employee/contact person/partner/authorised representative of one of our affiliated group companies, or an employee/contact person/partner/authorised representative of one of our affiliated group companies' individual traders or corporate customers, Identity, communication, financial (IBAN/bank account details) customer transaction, legal transaction data for the execution of contract processes, the execution of financial and accounting tasks, the execution of customer relationship management processes, the execution of access authorisations, the execution of legal tasks, conducting and auditing business activities, conducting audit/ethics activities and internal audit/investigation/intelligence activities, participating in domestic/international tenders, providing information to authorised persons, institutions and organisations upon request, ensuring the continuity of information systems, conducting storage and archiving processes

• When you visit our workplace, your identity and physical location security data will be used to create and track visitor records, ensure physical location security, carry out occupational health and safety processes in the event of an accident at work, and provide information to authorised persons, institutions and organisations upon request,

• When you visit our website, your transaction security data, and when you use our Company's wireless network connection, your identity, contact, and transaction security data may be processed for the purposes of fulfilling obligations arising from legislation in accordance with Law No. 5651, keeping log records generated in electronic environments, carrying out information security processes, and conducting activities in accordance with legislation and Company policies and procedures. Your personal data may also be transferred to physical archives and information systems and stored in both digital and physical environments.

3. To Whom and for What Purposes Processed Personal Data May Be Transferred

Your personal data collected shall be processed in accordance with the purposes set out in Article 2 of this Clarification Text and within the scope of the Law and related legislation, and for the reasons requiring their transfer and limited to these reasons; upon request, shall be transferred to official institutions and organisations, banks, press organisations, consultancy and audit firms, travel agencies, our business partners and suppliers, including companies whose services we use and with whom we collaborate, in order to comply with the policies and procedures of the Company and the Cengiz İnşaat group of companies to which the Company belongs, to carry out and support operational processes, and to participate in domestic/international tenders, to group companies and databases shared with them, and to the systems of companies providing technology services at home and abroad.

4. Method and Legal Basis for Collecting Personal Data

Your personal data may be collected in accordance with the purposes set out in Article 2 of this Clarification Text and in accordance with the fundamental principles set out in the Law, by automated or non-automated means based on the legal grounds specified in Article 5 of the Law, namely the legal obligation of the data controller, the establishment, exercise or protection of a right, the conclusion or performance of a contract, and the legitimate interests of the data controller, and only to the extent necessary for these purposes, through verbal or written information communicated by you or your employer directly or via our email address, through applications and software used within the scope of Company activities, and through camera recordings.

5. Your Rights Regarding the Protection of Personal Data

Within the framework of personal data protection legislation, you have the right to: learn whether your personal data has been processed; if processed, request information about it; learn the purpose of processing and whether it has been used by us in accordance with these purposes; learn the third parties to whom it has been transferred within or outside the country; request the correction of any incomplete or incorrect data and, if transferred, notification to the third parties to whom it has been transferred; to request the deletion or destruction of your personal data if the conditions for processing no longer exist and, if transferred, to request that the third parties to whom it has been transferred be notified accordingly; to object to the situation if you believe that a result detrimental to you has emerged solely through the analysis of the processed data by automated systems; to request compensation for any damage suffered as a result of unlawful processing.

You may submit your requests under Article 11 of the Law, which regulates the rights of the data subject, in writing to the address of Oran Mah, Rafet Canıtez Cd. No:47, 6450 Çankaya/ANKARA, either in person or by other methods specified in the ‘Communication on the Procedures and Principles for Applying to the Data Controller’, using the form at the link and ensuring that your identity is verified.

Our company will process requests in accordance with Article 13 of the Law, based on the nature of the request and within a maximum of 30 (thirty) days. If the process incurs costs, the tariff determined by the Personal Data Protection Board will be applied. If the request is rejected, the reason(s) for rejection will be justified in writing or electronically.