KVKK Text of SMT Enerji Information Notice by SMT Enerji on the Protection of Personal Data,

This information notice has been prepared by SMT Enerji in its capacity as data controller within the scope of Article 10 of the Law No. 6698 on the Protection of Personal Data (“Law”) and the Communiqué on Principles and Procedures to be Followed in Fulfillment of the Obligation to Inform.

1.Data Controller

Employee, Employee Candidate, Property Owner, Intern, Supplier Employee, Supplier Representative, Individuals Receiving Products or Services, and Visitors’ personal data in the categories reported to the verbis system are processed, taking into account privacy issues related to the privacy of private life. In accordance with the Law, the scope of processing by SMT Enerji in its capacity as data controller is explained in this information notice (“Information Notice”).

2.What is the Method and Legal Basis for Collection of Personal Data?

Personal data, including sensitive personal data such as health information, is obtained either fully or partially automatically or non-automatically through completely or partially automated systems or any data recording system as part of SMT Enerji, either directly from the data subject, from systems capable of determining location, or from the authorized personnel of the company where supplier employees work. In accordance with the basic principles stipulated by the Law, personal data may be processed and transferred at home and abroad for the following purposes with the natural and legal persons specified in this Information Notice within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the Law.

3.What are the Cases in which the Data Controller Can Process Personal Data without Explicit Consent Under the Law?

Pursuant to Article 5 of the Law, SMT Enerji may process the personal data it has received in accordance with the law without seeking explicit consent in the following cases:

• Where expressly provided for by law,
• Due to actual impossibility to obtain the explicit consent of the Data Subject, or in cases where consent is not legally valid, the processing of personal data becomes necessary for the protection of the life or physical integrity of the Data Subject or another person,
• It is necessary to process the personal data of the parties to the contract, provided that it is directly related to the execution or performance of a contract concluded between SMT Enerji and the Data Subject,
• It is mandatory for SMT Enerji to fulfill a legal obligation,
• Personal data is made public by the Data Subject,
• Where data processing is mandatory for the establishment, exercise or protection of a right,
• It is necessary to process the data for the legitimate interests of SMT Enerji, provided that it will not harm fundamental rights and freedoms.

Besides, in accordance with Article 6 of the Law, SMT Enerji may process sensitive personal data it has received in accordance with the law without seeking explicit consent in the following cases;

• The data related to the race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, membership to associations, foundations or trade unions, health, sexual life, criminal convictions and security measures of the persons and the biometric and genetic data are sensitive personal data.
• Sensitive personal data other than the health and sexual life of the data subject is stipulated in the laws,
• Sensitive personal data related to the health and sexual life of the data subject are only available to persons or authorized institutions and organizations under the obligation of confidentiality for the purpose of protection of public health, execution of preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing.

4.What are the Purposes of Processing Personal Data?

Personal data can be processed for;

• Execution of Application Process for Employee Candidates and Internship
• Fulfillment of Obligations Arising from Employment Contract and Legislation for Employees
• Conducting Benefits and Interests Processes for Employees
• Execution of Training Activities
• Execution of Access Authorities
• Conducting Operations in accordance with the Legislation
• Execution of Finance and Accounting Affairs
• Ensuring Physical Space Security
• Conducting Assignment Processes
• Follow-up and Execution of Legal Affairs
• Conducting Communication Operations
• Planning Human Resources Processes
• Conducting / Auditing Business Operations
• Execution of Occupational Health & Safety Activities
• Execution of Service Procurement Processes
• Execution of After-Sales Support Services
• Execution of Service Sales Processes
• Execution of Performance Evaluation Processes
• Execution of Contract Processes
• Execution of Wage Policy
• Providing Information to Authorized Persons, Institutions and Organizations
• Creating and Tracking Visitor Records

by SMT Enerji and other natural and/or legal persons specified in Article V.

5.To Whom and for What Purpose Are Personal Data Transferred?

The personal data collected may be transferred to legally authorized public institutions and organizations, as well as natural persons or private legal entities. This includes companies and organizations that will establish employment contracts with SMT Enerji, along with their business partners, suppliers, and service providers. The transfer will be carried out in accordance with the basic principles stipulated by the law and for the purposes specified in Articles 8 and 9 of the Law, as well as for the following purposes.

• Follow-up and Execution of Legal Affairs
• Obtaining permits for personnel to work in the field and Conducting the Assignment Processes
• Subscription Initiation and Notification of Payment of Invoices
• Ensuring Security of Physical Spaces,
• Providing Information to Authorized Persons, Institutions and Organizations
• Supply of Phone line
• Provision of Access Authorizations to Software of Business Partners
• Meeting Tender Participation Requirements
• Fulfillment of Legal Obligation
• Execution of SSI Notifications
• Handling Card Printing
• Opening of Corporate User Accounts
• Personnel Salary Payments
• Execution of Contract Processes
• Record of trainee attendance
• Creating e-Prescription after diagnosis

SMT Enerji may transfer personal data to foreign countries declared to have adequate protection by the PPD Board (“Foreign Country with Adequate Protection”) or, in the absence of adequate protection, to foreign countries where the data controllers in Türkiye and the relevant foreign country undertake an adequate protection in writing and where the PPD Board has granted permission (“Foreign Country Where the Data Controller Undertakes Adequate Protection”).

6.What are the Rights of Data Subjects?

Within the framework of Article 11 of the Law, the Data Subject is entitled to the following by applying to the data controller at any time;

• Learn whether his/her personal data is processed or not,
• Request relevant information if his/her personal data has been processed,
• Learn the purpose of processing his/her personal data and whether his/her personal data is used as suitable for the purpose,
• Know the third parties to whom his/her personal data has been transferred at home or abroad,
• Request for correction of his/her personal data if incomplete or incorrectly processed,
• Request the deletion or destruction of his/her personal data if the reasons for the processing of his/her personal data are eliminated in order to be evaluated within the principles of purpose, duration and legitimacy,
• Request the deletion, destruction or anonymization of his/her personal data if the reasons for the processing are eliminated, despite the fact that they have been processed in accordance with the Law on the Protection of Personal Data No. 6698 and the provisions of other relevant laws,
• Request notification of the transactions related to the correction, deletion or destruction of the personal data to the third parties to whom the personal data are transferred,
• Object if any result occurs against him/her by analyzing the processed personal data exclusively through automated systems,
• Request the compensation of the damage if he/she suffers damage due to the unlawful processing of his/her personal data.

7.How Does the Data Subject Exercise His/Her Rights?

In accordance with Article 11 of the Law, the Data Subject must fill out the application form completely and submit it to SMT Enerji through the channels specified in the form to exercise the rights mentioned above.

SMT Enerji shall conclude the request free of charge as soon as possible and no later than thirty (30) days, depending on the nature of the request. However, if the transaction requires an additional cost, SMT Enerji reserves the right to receive the fee in the tariff determined by the Personal Data Protection Board.

8.How Long Will Personal Data Be Processed?

In accordance with the Law, personal data processed for the purposes specified in this Information Notice will be deleted, destroyed, or anonymized and continued to be used by SMT Enerji when the purpose requiring processing according to Article 7 of the Law ceases to exist, and/or when the statutory retention periods imposed for the processing of data by SMT Enerji expire.