CONTENTS

1. INTRODUCTION

According to Article 20 of the Constitution of the Republic of Turkey (https://www.anayasa.gov.tr/tr/mevzuat/anayasa/), everyone has the right to request the protection of their personal data. This right includes being informed about personal data concerning oneself, accessing such data, requesting their correction or deletion, and learning whether they are being used in accordance with their purposes.

Within the scope of exercising this constitutional right, the Personal Data Protection Law No. 6698 (“KVKK”) has been published and entered into force, regulating the protection of fundamental rights and freedoms of individuals in personal data processing and the obligations of real and legal persons who process personal data, as well as the procedures and principles to be followed. ENEKO HAVALANDIRMA VE ISI EKONOMİSİ SİSTEM TEKNOLOJİLERİ MAKİNE SAN. VE TİC. A.Ş (“ENEKO”) takes the necessary care regarding compliance with KVKK and establishes it as a company policy through this Personal Data Protection and Processing Policy (“Policy”).

The subject of this Policy is the protection of personal data belonging to Employee Candidates, Employees, Dealers, Suppliers, Contractors, Visitors, Employees of Institutions We Cooperate With, Customers, and Third Parties (Guarantors, Victims/Right Holders) processed by ENEKO. The activities related to the protection of personal data of our employees are managed within the scope of the Information Security Management System carried out by ENEKO, including disciplinary regulations, employee explicit consent forms, employee confidentiality procedures, and supplier confidentiality agreements.

2. PURPOSE

The purpose of this Policy is to provide explanations regarding the personal data processing activities carried out by ENEKO in accordance with KVKK and the principles adopted for the protection of personal data. It also aims to ensure transparency by informing individuals whose personal data are processed by ENEKO, including Employee Candidates, Dealers, Suppliers, Contractors, Visitors, Employees of Institutions We Cooperate With, Customers, and Third Parties.

3. SCOPE

The data subjects whose personal data are processed within the scope of this Policy are categorized as follows:

• Employee Candidates: Individuals who apply for a job at ENEKO or make their resumes and related information accessible to ENEKO in any way.
• Employees of Institutions We Cooperate With: Employees of institutions that have business relationships with ENEKO.
• Dealers: Real and legal persons who, under a contract, permanently act as intermediaries in the sale of ENEKO products within a certain place or region on behalf of and in the name of ENEKO.
• Suppliers: Legal and real persons from whom ENEKO or its dealers procure goods or services under Supplier Confidentiality Agreements.
• Contractors: Legal and real persons who undertake a trade or construction-related job on behalf of ENEKO or its dealers.
• Customers: Real persons whose personal data are obtained due to business relationships with ENEKO, regardless of the existence of a contractual relationship.
• Visitors: Real persons who enter ENEKO’s physical facilities for various purposes or visit its websites.
• Third Parties: Other real persons whose personal data are processed within the framework of this Policy but are not explicitly defined in it, including but not limited to suppliers, guarantors, victims/right holders, and family members.

4. DEFINITIONS

The definitions used in this Policy are as follows:

• Explicit Consent: Freely given, specific, informed consent regarding a particular subject.
• Employee: All real persons employed by ENEKO under definite or indefinite terms.
• Employee Candidate: Real persons who apply for a job at ENEKO or make their resumes and related information accessible to ENEKO.
• Employee Data Subject Application Form: The form used by ENEKO employees to exercise their rights as data subjects under Article 11 of KVKK.
• Relevant User: Persons who process personal data within the data controller organization or under the authorization and instructions of the data controller, excluding those responsible for the technical storage, protection, and backup of data.
• Personal Health Data: Any health-related information concerning an identifiable real person.
• Personal Data: Any information relating to an identified or identifiable real person.
• Processing of Personal Data: Any operation performed on personal data, whether wholly or partially automated or through non-automated means that form part of a data recording system, including collection, recording, storage, retention, alteration, reorganization, disclosure, transfer, retrieval, classification, or prevention of use.
• KVKK: The Personal Data Protection Law No. 6698.
• KVK Board: The Personal Data Protection Board.
• KVK Authority: The Personal Data Protection Authority.
• Special Categories of Personal Data: Data relating to an individual’s race, ethnic origin, political opinion, philosophical belief, religion, sect, or other beliefs, clothing, association, foundation, or union membership, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data.
• TCK: The Turkish Penal Code No. 5237.
• Data Processor: A real or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.
• Personal Data Subject: A real person whose personal data is processed and who is referred to as the “data subject” under KVKK.
• Personal Data Subject Application Form: The form used by data subjects whose personal data are processed by ENEKO to exercise their rights under Article 11 of KVKK.
• Deletion of Personal Data: The process of making personal data inaccessible and unusable for relevant users.
• Destruction of Personal Data: The process of making personal data permanently inaccessible, irretrievable, and unusable for anyone.
• Anonymization of Personal Data: The process of making personal data incapable of being associated with an identified or identifiable real person, even by matching them with other data.
• Data Controller: A real or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.
• Visitor: Real persons who enter ENEKO’s physical facilities for various purposes or visit its websites.
• Data Controllers Registry: The registry maintained by the Personal Data Protection Board.
• Data Inventory: The inventory created by ENEKO detailing its personal data processing activities based on its business processes, including the purposes of processing personal data, the recipient groups to which personal data is transferred, and the relevant personal data owner group.

5. GENERAL PRINCIPLES FOR PERSONAL DATA PROCESSING

According to Article 3 of KVKK, personal data processing includes any operation performed on personal data, such as collection, recording, storage, retention, alteration, reorganization, disclosure, transfer, retrieval, classification, or prevention of use.

The following principles must be adhered to when processing personal data:

• Compliance with the law and principles of integrity: ENEKO conducts personal data processing activities in compliance with the law, the Constitution of the Republic of Turkey, KVKK, and relevant regulations.
• Accuracy and up-to-dateness: ENEKO takes all necessary administrative and technical measures to ensure the accuracy and up-to-dateness of personal data.
• Processing for specific, explicit, and legitimate purposes: ENEKO determines its personal data processing purposes clearly and precisely before starting data processing activities.
• Relevance, limitation, and proportionality to the processing purpose: Personal data are processed only to the extent necessary for the defined purposes and not for potential future use.
• Storage for the period required by relevant legislation or processing purpose: ENEKO retains personal data for the periods specified in KVKK and relevant regulations, limited to the purpose of data processing.

6. PROCESSING OF PERSONAL DATA

ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY IND. AND TRADE INC. conducts its personal data and special category personal data processing activities in compliance with the data processing conditions set forth in Articles 5 and 6 of the KVKK (Personal Data Protection Law).

6.1. CONDITIONS FOR PROCESSING PERSONAL DATA

ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY IND. AND TRADE INC. may process personal data with the explicit consent of the data subject or without explicit consent in the cases stipulated under Article 5 of the KVKK, as listed below:

• When it is explicitly stipulated by laws.
• When it is necessary for the protection of the life or physical integrity of a person who is unable to express consent due to actual impossibility or whose consent is not legally valid.
• When processing is necessary for the establishment or execution of a contract, provided that it is directly related to the contract parties.
• When it is mandatory for the fulfillment of a legal obligation by ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY IND. AND TRADE INC.
• When the personal data has been made public by the data subject.
• When processing is necessary for the establishment, exercise, or protection of a right.
• When processing is necessary for the legitimate interests of ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY IND. AND TRADE INC., provided that it does not harm the fundamental rights and freedoms of the data subject.

6.2. PROCESSING OF SPECIAL CATEGORY PERSONAL DATA

ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY IND. AND TRADE INC. processes special category personal data, which poses a risk of discrimination if unlawfully processed, in compliance with the data processing conditions stipulated in Article 6 of the KVKK.

Processing of special category personal data without explicit consent is prohibited. However, personal data other than those related to health and sexual life may be processed without explicit consent in cases stipulated by law. Personal data concerning health and sexual life may be processed without explicit consent only for public health protection, preventive medicine, medical diagnosis, treatment, and care services, as well as for health service planning and management, by persons or authorized institutions and organizations under confidentiality obligations.

For the processing of special category personal data, the security measures determined by the KVKK Board are effectively implemented by ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY IND. AND TRADE INC.

6.3. CATEGORIZATION OF PERSONAL DATA PROCESSED BY OUR COMPANY

Personal Data Categories Processed by ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY IND. AND TRADE INC.

7. ENSURING THE SECURITY AND CONFIDENTIALITY OF PERSONAL DATA

ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY IND. AND TRADE INC. takes all necessary technical and administrative measures to ensure the lawful processing and security of personal data per Article 12 of the KVKK.

The company’s KVKK unit is responsible for ensuring effective coordination of personal data protection and processing activities. The responsibilities of this unit include:

• Monitoring and updating this policy and presenting changes for Board approval.
• Developing other relevant policies and procedures in coordination with company departments.
• Assigning responsibilities for policy implementation and obtaining management approval.
• Monitoring and auditing the implementation of technical and administrative security measures.
• Managing personal data subject requests and ensuring necessary coordination for issue resolution.
• Identifying compliance requirements with the KVKK and ensuring their implementation.
• Managing relations with the KVKK Authority.

7.1. TECHNICAL MEASURES TO ENSURE LEGAL PROCESSING AND PREVENT UNAUTHORIZED ACCESS

• Regular access and authorization controls for systems handling personal data.
• Independent audits of risk management and internal control processes.
• Employment of personnel with sufficient expertise in data security.

7.2. ADMINISTRATIVE MEASURES TO ENSURE LEGAL PROCESSING AND PREVENT UNAUTHORIZED ACCESS

• Employee training and awareness programs on compliance with KVKK.
• Establishing and implementing agreements with third parties on data protection.
• Developing internal company procedures and policies to maintain compliance with the KVKK.
• Adding obligations in contracts and agreements to prevent unauthorized processing and disclosure of personal data.

7.3. MEASURES TO BE TAKEN IN CASE OF UNLAWFUL DISCLOSURE OF PERSONAL DATA

In the event of unlawful acquisition of personal data, the company has developed an internal procedure to notify the affected data subject and the KVKK Authority as soon as possible.

8. PURPOSES OF PERSONAL DATA PROCESSING AND STORAGE PERIODS

8.1 PURPOSES OF PERSONAL DATA PROCESSING

Personal data at ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. is processed within the framework of the following purposes:

• Managing post-sales support processes for goods/services,
• Receiving and evaluating suggestions for improving business processes,
• Managing customer relations management processes,
• Carrying out activities aimed at customer satisfaction,
• Managing product/service marketing processes,
• Running advertising/campaign/promotion processes,
• Planning and executing our company’s commercial and/or business strategies,
• Managing financial and accounting processes,
• Managing legal affairs,
• Carrying out logistics activities,
• Managing the processes of purchasing goods/services,
• Managing post-sales support services for goods/services,
• Managing sales processes of goods/services,
• Managing production and operational processes of goods/services,
• Managing customer relations management processes,
• Managing contract processes,
• Carrying out strategic planning activities,
• Conducting marketing analysis studies,
• Carrying out activities aimed at customer satisfaction,
• Managing customer relations management processes,
• Managing salary policies.

8.2. STORAGE PERIODS OF PERSONAL DATA

ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. determines whether a certain period is prescribed in the relevant legislation for the storage of personal data. In accordance with Article 138 of the Turkish Penal Code and Articles 4 and 7 of the Personal Data Protection Law (KVKK), personal data is stored only for the period prescribed in the relevant legislation, or if no period is prescribed, for as long as the purpose of processing the personal data requires.

9. DELETION, DESTRUCTION, AND ANONYMIZATION OF PERSONAL DATA

When the purpose of processing personal data has expired and the retention periods set by the relevant legislation and/or ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. have been reached, personal data will be deleted, destroyed, or anonymized either upon the request of the data subject or automatically by ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC.

The procedures regarding this are determined in accordance with the KVKK Law and the Regulation on Deletion, Destruction, or Anonymization of Personal Data.

9.1. TECHNIQUES FOR DELETING AND DESTROYING PERSONAL DATA

Personal data will be deleted and destroyed using appropriate methods for the storage medium. The likely deletion or destruction techniques used by ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. are as follows:

• Physical Destruction: Personal data processed manually and not as part of any automated system can be physically destroyed in a way that prevents its further use.
• Secure Deletion/Destruction from Software: For personal data stored in digital environments processed fully or partially automatically, methods will be used to delete the data in such a way that it cannot be recovered by any party.
• Secure Deletion/Destruction by an Expert: In certain cases, ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. may contract an expert to securely delete/destroy personal data, ensuring it cannot be recovered.

9.2. TECHNIQUES FOR ANONYMIZING PERSONAL DATA

Anonymizing personal data means transforming the data in such a way that it can no longer be associated with any specific or identifiable individual. As per Article 28 of the KVKK Law, anonymized personal data can be processed for purposes such as research, planning, and statistics. Such processing falls outside the scope of the KVKK Law and will not require the explicit consent of the data subject.

The techniques most likely to be used by ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. for anonymization are:

• Masking: The key identifying information in the data set is removed to make the personal data anonymous.
• Aggregation: Data is aggregated so that it cannot be associated with any individual.
• Data Derivation: A more general form of the data is created, ensuring it cannot be linked to any individual.
• Data Shuffling: The values within the data set are mixed to break the link between the data and the individuals.

10. THIRD PARTIES TO WHOM PERSONAL DATA IS TRANSFERRED AND THE PURPOSE OF TRANSFER

The procedures for transferring personal data are governed by Articles 8 and 9 of the KVKK Law. For the provision of services by ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC., personal data may be transferred to real persons or private legal entities, business partners, affiliates, subsidiaries, service providers, or relevant public institutions and authorities in accordance with relevant laws, regulations, and mandatory requirements.

Personal data cannot be transferred to third parties without the explicit consent of the data subject, except for the exceptions provided in the KVKK Law.

10.1. TRANSFER OF PERSONAL DATA WITHIN TURKEY

In accordance with Article 8 of the KVKK Law, the transfer of personal data within Turkey is only possible if one of the conditions specified in the “Conditions for Processing Personal Data” section (6.1) of this Policy is met.

10.2. TRANSFER OF PERSONAL DATA ABROAD

According to Article 9 of the KVKK Law, personal data can only be transferred abroad if one of the following conditions is met, in addition to the conditions for transfer within Turkey:

• The country to which the data is transferred is listed among the countries that provide adequate protection by the KVKK Board.
• If the country does not provide adequate protection, the data controllers in Turkey and the foreign country provide written assurance of adequate protection and obtain permission from the KVKK Board.

10.3. CATEGORIES OF PERSONS TO WHOM PERSONAL DATA IS TRANSFERRED BY OUR COMPANY

ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC., in accordance with Articles 8 and 9 of the KVKK Law and within the scope of this Policy, can transfer personal data of data subjects to the following categories of people for the purposes listed below:

• Public Institutions and Authorities: Public institutions and authorities that request information and documents from ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. based on relevant legal provisions. The transfer will be limited to the purpose requested by these public institutions and authorities.
• Private Legal Entities: Private legal entities with which ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. shares information and documents in accordance with the relevant legal provisions. This transfer is limited to ensuring the continuation of the activities of ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. within the areas it operates.

11. COMPANY’S OBLIGATION TO INFORM

ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. fulfills its obligation to inform the data subjects in accordance with Article 10 of the KVKK Law when personal data is collected. In this context, ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. informs the data subjects of the following:

• The name of ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. as the data controller,
• The purpose of processing personal data,
• To whom and for what purpose personal data will be transferred,
• The method and legal basis for collecting personal data,
• The rights of the data subject.

12. RIGHTS OF PERSONAL DATA OWNERS AND EXERCISE OF THESE RIGHTS

Personal data owners, in accordance with Article 13 of the KVKK Law, can submit their requests related to the rights listed under section 12.1 below by filling out and signing the Application Form and sending it to ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. using the methods specified below or any other method determined by the KVKK Board. The request will be processed free of charge, depending on the nature of the request.

To submit a request, the personal data owner should fill out the form found under the “……………………. Page” section of the ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. corporate website (http://eneko.com.tr/tr). After completing the form:

A signed physical copy must be delivered in person or via notary to the address: 10049 STREET NO: 4 A.O.S.B 35620 ÇİĞLİ/IZMIR, or after signing it with a “secure electronic signature” under the Electronic Signature Law No. 5070, the form must be sent via registered e-mail to:

enekohavalandirma@hs03.kep.tr.

ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. may request information from the applicant to determine whether they are the personal data owner and may ask questions related to the applicant’s request to clarify the matters in the request.

12.1. RIGHT TO APPLY

Under Article 11 of the KVKK Law, personal data owners have the right to request the following from ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC.:

• To learn whether their personal data is processed,
• To request information about whether their personal data has been processed,
• To learn the purpose of processing their personal data and whether it is used in accordance with its purpose,
• To learn the third parties to whom their personal data has been transferred, both domestically and abroad,
• To request correction of their personal data if it is incomplete or inaccurate, and to request that the correction be communicated to third parties to whom the personal data has been transferred,
• To request the deletion, destruction, or anonymization of their personal data when the reasons for processing no longer exist, and to request that this action be communicated to third parties to whom the personal data has been transferred,
• To object to a decision based solely on the automated processing of their personal data, which results in unfavorable consequences for the data subject,
• To request compensation for the damage caused by unlawful processing of their personal data.

12.2. SITUATIONS EXCLUDED FROM THE SCOPE OF THE RIGHT TO APPLY

According to Article 28 of the KVKK Law, personal data owners cannot exercise their rights in the following cases:

• When personal data is processed for research, planning, or statistics in an anonymized manner,
• When personal data is processed for national defense, public safety, or scientific purposes in accordance with freedom of expression, as long as it does not violate public order, security, or personal rights,
• Processing personal data necessary for preventing crimes or investigating crimes,
• The processing of personal data made public by the data subject

12.3. METHOD OF RESPONSE

In accordance with Article 13 of the KVKK Law, ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. processes the personal data owner’s application requests and resolves them as quickly as possible and at the latest within 30 (thirty) days free of charge, depending on the nature of the request. However, if the process requires an additional cost, the fee specified in the tariff determined by the KVKK Board may be charged.

ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. may either accept the personal data owner’s application request or, by explaining the reason, reject it for the following reasons and notify the individual of the response in writing or electronically:

• If it hinders the rights and freedoms of other persons,
• If it requires disproportionate effort,
• If the information is publicly available,
• If it jeopardizes the privacy of others,
• If one of the situations excluded from the scope of the KVKK Law is applicable.

If the personal data owner’s application is rejected, the response is deemed insufficient, or no response is given within the stipulated period, the data subject has the right to file a complaint with the KVKK Board within thirty days from the date they learn of the response, and in any case, within sixty days from the application date.

13. PERSONAL DATA PROCESSING ACTIVITIES WITHIN THE COMPANY AND ONLINE DATA PROCESSING ACTIVITIES

13.1 CAMERA MONITORING

ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. conducts camera monitoring in the buildings where its headquarters and dealerships are located.

In accordance with the regulations in the KVKK Law, ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. places notification signs regarding camera monitoring at the entrances of the monitored areas, and the necessary information is provided on our website through this Policy.

Monitoring is not conducted in areas that would result in an intrusion into the individual’s privacy. Only a limited number of company employees and, if needed, employees of the security company acting as a supplier can access the security camera recordings. These individuals declare that they will protect the confidentiality of the data accessed through the confidentiality agreement they have signed.

13.2. VISITOR ENTRANCE-EXIT TRACKING

ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. processes personal data related to the entrance and exit of visitors who come to visit the company. The identification information of the individuals visiting ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. is processed only for the purpose of tracking their entry and exit and is recorded in the electronic system.

13.3. WEBSITE VISITORS

The internet activities of individuals visiting the website of ENEKO VENTILATION AND HEAT ECONOMY SYSTEM TECHNOLOGIES MACHINERY INDUSTRY AND TRADE INC. are recorded using technical means (such as cookies) for the purpose of providing personalized content and conducting online advertising activities.