1. Identity of the Data Controller

As İnelsan İnşaat Elektrik Sanayi ve Ticaret Anonim Şirket (“İnelsan İnşaat” or the “Company”), within the scope of Law No. 6698 on the Protection of Personal Data (“Law”) and as the data controller, we present this disclosure statement regarding the personal data we obtain:

2. Processing of Personal Data and Processing Purposes

Depending on the service or commercial activity provided by İnelsan İnşaat, personal data of data subjects may be processed to ensure the best provision of services. Within this scope:

• If you are an individual trader or a real person representing a legal entity who is a supplier/subcontractor/business partner/employee/contact/partner/authorized person of our company or the group companies we belong to, personal data such as identity, contact, employment (resume), legal transaction information, physical security, risk management, finance (IBAN/bank account details), professional experience, visual and audio recordings, as well as sensitive personal data like health, criminal convictions, security measures, religion, and blood group (which may be indirectly obtained from identity/driver’s license copies) may be processed for purposes including contract execution, procurement processes, business operation and supervision, business continuity, finance and accounting, assignments, audits, access authorization, legal matters, performance evaluation, sponsorship and aid activities, occupational health and safety, work and residence permits for foreign personnel, communication activities, corporate communication including press releases, travel and event organization, logistics and cargo, risk management, internal audits, investigations, intelligence activities, and providing information to authorized persons or institutions when requested, as well as information systems continuity, storage, and archiving.

• If you are an employee/contact/partner/authorized person of our group companies or a customer employee/contact/partner/authorized person of these group companies, personal data including identity, contact, finance (IBAN/bank details), customer transaction and legal process information may be processed for contract execution, finance and accounting, customer relationship management, access authorization, legal matters, business operations and supervision, audit/ethics, internal audit/investigation/intelligence, participation in domestic/international tenders, providing information to authorized persons or institutions upon request, information system continuity, storage, and archiving.

• If you visit our workplace, your identity and physical security data will be processed for visitor registration, physical security, occupational health and safety procedures in case of work accidents, and providing information to authorized parties upon request.

• If you visit our website, your transaction security data and, if you use our wireless network, your identity, contact, and transaction security data will be processed in compliance with Law No. 5651 for log records, legal obligations, and information security.

Personal data will only be processed to the extent necessary for compliance with legislation, company policies, and procedures. Your data may be stored both physically and digitally.

3. Recipients and Purposes of Data Transfer

Your personal data may be transferred, within the purposes outlined above and in compliance with the Law and related legislation, to official institutions, banks, media organizations, consultancy and audit firms, travel agencies, business partners, suppliers, group companies, and shared databases, as well as to domestic and international service providers and technology companies, solely for compliance, operational processes, support, tender participation, and related purposes.

4. Methods and Legal Grounds for Personal Data Collection

Personal data may be collected verbally or in writing, directly from you or through your employer, via email, through software and applications used by the Company, and via surveillance camera records. The legal grounds include the data controller’s legal obligations, establishment or exercise of rights, contract execution, legitimate interests of the data controller, and compliance with the fundamental principles in Article 5 of the Law.

5. Your Rights Regarding Personal Data Protection

Under the personal data protection legislation, you have the rights to:

• Learn whether your personal data is processed,

• Request information if your data is processed,

• Learn the purpose of processing and whether data is used in accordance with these purposes,

• Know the third parties domestic or abroad to whom your data is transferred,

• Request correction of incomplete or inaccurate data and notification of this to third parties,

• Request deletion or destruction of data when processing conditions cease and notification to third parties,

• Object if data is processed exclusively by automatic systems and results in adverse consequences,

• Request compensation for damages caused by unlawful processing.

You may submit your requests in writing to the address below with identity verification or via other methods specified in the “Communiqué on Application Procedures to Data Controllers”:

İlkbahar Mah. 606. Cad. No:18 Çankaya/Ankara

Our company will finalize requests in accordance with Article 13 of the Law within 30 days at the latest. If costs are involved, the tariff set by the Personal Data Protection Board will apply. If a request is rejected, the reasons will be provided in writing or electronically.