Personal Data Protection Notice (KVKK – Law No. 6698)

As Serapool Porselen Sanayi ve Ticaret A.Ş. (“Company”), we hereby present to the public and data subjects the disclosure text prepared pursuant to Article 10 of the Law on the Protection of Personal Data No. 6698 (“Law”), which provides information regarding the Company's personal data processing activities.

You can access detailed information regarding the processing of your personal data under this Disclosure Text from the Personal Data Protection and Processing Policy of Serapool Porselen Sanayi ve Ticaret A.Ş., available at www.serapool.com.

ARTICLE 1: DATA CONTROLLER

Your personal data may be processed by Serapool Porselen Sanayi ve Ticaret A.Ş. as the data controller within the scope described below. The term “data controller” refers to the natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.

You may contact the data controller through the following channels:

• Address: Ramazanoğlu Mah. Mahmut Bayram Cad. No:13 Pendik, Istanbul
• Phone: +90 (216) 222 20 30 / +90 (216) 222 20 20
• Email: [email protected]
• Website: www.serapool.com

ARTICLE 2: PURPOSES OF PERSONAL DATA PROCESSING

Your personal data is processed for the following purposes:

• To provide products and services.
• To deliver after-sales support services.
• To manage human resources processes.
• To ensure corporate communication.
• To ensure company security.
• To conduct statistical studies.
• To perform transactions resulting from signed contracts and protocols, including sales and invoicing.
• To fulfill legal obligations as required or mandated by applicable legislation.
• To establish contact with natural or legal persons engaged in business with the company.
• To generate legal reports.
• To manage events and trade fair processes.
• To customize products and services for you, and to plan and execute profiling, marketing, and promotional activities.
• To manage call center operations.
• To fulfill the burden of proof in potential future legal disputes.
• To carry out and follow up on the Company's legal affairs.

ARTICLE 3: PARTIES TO WHOM PERSONAL DATA MAY BE TRANSFERRED AND PURPOSE OF TRANSFER

Personal data may be shared in accordance with the conditions and purposes of data processing set out in Articles 8 and 9 of the Law, for the purposes of ensuring the legal, technical, and commercial-business security of our Company and related parties, customizing the products and services offered by our Company according to your preferences, usage habits, and needs, carrying out necessary operational activities by business units to benefit you from our products and services, executing business processes required for our Company's commercial activities, and planning and executing our Company's commercial and/or business strategies.

Accordingly, your data may be shared with our business partners, suppliers, companies within the Serapool Group, shareholders, legally authorized public institutions, and private law legal entities. In addition, it may be shared with banks we collaborate with, external law firms we receive support from, courts, and other official or judicial authorities.

Transfer of your personal data abroad may only occur in cases where: you have provided explicit consent, or one or more of the other data processing conditions specified under the Law are met provided that there is adequate protection in the destination country. If there is no adequate protection, the Company may transfer data provided that it and the foreign data controller undertake adequate protection in writing and obtain permission from the Personal Data Protection Board.

ARTICLE 4: METHODS AND LEGAL BASES FOR PERSONAL DATA COLLECTION

Personal data may be collected through contracts concluded with persons we are in a business relationship with, completed forms, information obtained by company representatives, and through physical interactions (e.g., face-to-face meetings), dealers, stores, and electronic means such as our website, call center, and mobile application. The collection is based on the legal ground of contract performance.

The legal bases for the collection and processing of personal data are as follows:

• Processing is necessary for the conclusion or performance of a contract.
• Processing is necessary for the establishment, exercise, or defense of legal claims.
• Processing is necessary for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the data subject.
• Processing is necessary for the fulfillment of a legal obligation.
• Data retention is explicitly provided for under applicable legislation.
• Explicit consent of the data subject has been obtained, where required.

ARTICLE 5: RIGHTS OF THE DATA SUBJECT

The natural person whose personal data is processed is defined as the “data subject” and has the right to request the following from the Company:

• To learn whether personal data is being processed.
• To request information if personal data has been processed.
• To learn the purpose of processing and whether personal data is used in accordance with its purpose.
• To know the third parties to whom personal data is transferred domestically or abroad.
• To request the correction of incomplete or inaccurate data.
• To request the deletion or destruction of personal data.*
• To request that the operations carried out pursuant to subparagraphs (e) and (f) be notified to third parties to whom the personal data has been transferred.
• To object to a decision made exclusively by automated processing that has a legal consequence or significantly affects the data subject.
• To request compensation for damages in case of unlawful processing of personal data.

Requests related to your rights will be concluded free of charge within the shortest time possible and no later than 30 days, depending on the nature of the request. However, if the process incurs an additional cost for Serapool, a fee may be charged according to the tariff determined by the Personal Data Protection Board.

(*) Please note that we have legal obligations regarding the retention of certain information acquired under applicable legislation. If you request correction, deletion, or destruction of your personal data, we can only fulfill this request after the expiration of the legally mandated retention period.

For all questions and requests under the Law and relevant legislation, you may submit a written application including your identity verification documents and a signed petition stating your request to the address:

Ramazanoğlu Mah. Mahmut Bayram Cad. No:13 Pendik, Istanbul.

Your written applications will be accepted following an identity verification process and you will be responded to within the legal timeframes.

Sincerely,

SERAPOOL PORSELEN SANAYİ VE TİCARET A.Ş.