WITHIN THE SCOPE OF LAW NO. 6698 ON THE PROTECTION OF PERSONAL DATA

INFORMATION NOTICE FOR INDIVIDUALS WHO REGISTER AS MEMBERS AND FOR COMPANY REPRESENTATIVES OR EMPLOYEES

Purpose and Scope of the Information Notice

As EFCO, we take precautions to protect your personal data within the scope of Law No. 6698 on the Protection of Personal Data (hereinafter referred to as KVKK or the Law). We process your personal data as a “data controller” for the reasons and methods outlined below, in compliance with KVKK and the relevant legal regulations.

The EFCO Information Notice on the Processing of Personal Data has been prepared pursuant to Article 10 of KVKK titled “Data Controller’s Obligation to Inform,” to provide the most transparent information about the identity of the data controller, the method and legal basis for collecting your personal data, the purposes of processing this data, to whom it may be transferred and for what purposes, the data processing period, and your rights outlined in Article 11 of KVKK. This Information Notice concerns third parties using our company’s website.

Data Controller

Company Name: EFCO Industrial International Marketing and Trade Limited Company (“EFCO”)

(In this Information Notice, it will be referred to as the “Company.”)

Method of Collecting Your Personal Data and Legal Basis

Your personal data may be collected verbally, in writing, or electronically through automatic or non-automatic means, via the Company’s affiliated units, website, social media platforms, call center, mobile applications, or similar channels. Your personal data can be processed and updated as long as your relationship with the Company continues and will be stored both digitally and physically.

In line with the purposes listed under the “Processed Personal Data and Purposes of Processing” section and pursuant to paragraph 1 of Article 5 of KVKK, where explicit consent is obtained, or under paragraph 2 of Article 5 (subsections a, c, ç, e, and f), your personal data may be processed and transferred under the specified personal data processing conditions and purposes.

Processed Personal Data and Purposes of Processing

Your personal data is processed securely in compliance with the Law on the Protection of Personal Data to fulfill legal obligations or to provide better services in company operations.

The following personal data categories are collected:

• Contact Information: Data used to contact the individual (phone number, residential address, email).
• Identity Information: Data related to personal identity (name, surname, gender).
• Legal Process Data: Data included in communications with judicial authorities or consumer arbitration committees, such as case file information.
• Transaction Security Data: Digital traces resulting from the processing of personal data (IP address, website entry-exit logs, cookie information).
• Marketing Data: Digital traces for marketing and sales purposes (IP address, website browsing logs, marketing-related cookie data).

Collected personal data may be processed for the following purposes:

• To enable real or legal third parties, institutions, or organizations related to the Company to benefit from the products and services offered by our Company and/or affiliated units,
• To ensure the safety of real or legal third parties located in the Company’s offices or affiliated units, including protection of life and property, and to maintain legal and commercial security,
• To fulfill legal and regulatory requirements arising from applicable laws, such as the Turkish Commercial Code No. 6102, Code of Obligations No. 6098, Consumer Protection Law No. 6502, and other applicable laws and secondary regulations,
• To comply with inspection or regulatory tasks conducted by public institutions, public professional organizations, or judicial authorities,
• To comply with requests for information or documents from judicial bodies, consumer arbitration boards, or administrative authorities,
• To perform analysis, reporting, verification, and statistical and scientific studies for the improvement of our products and services and to customize offerings based on user preferences,
• To carry out market research, promotional activities, and necessary notifications related to our products and services,
• To handle complaints and suggestions and to contact you through communication channels shared with the Company,
• To plan and manage the financing of all services provided and to issue invoices,
• To ensure the security of systems and applications by taking all necessary technical and administrative measures.

To Whom and For What Purposes Your Processed Personal Data May Be Transferred

By taking all necessary technical and administrative measures to ensure the appropriate level of security as required under KVKK and relevant legislation, your personal data may be transferred, when necessary, to the following:

• Other individuals, institutions, or organizations permitted under applicable laws,
• Private insurance companies and banks,
• Attorneys or law firms for legal follow-up,
• Financial advisors for accounting and finance processes,
• Domestic shareholders, affiliates, subsidiaries, and company branches,
• Consultants,
• Business partners,
• Domestic or international organizations with which we have contractual service or business relationships.

Your data will be processed and transferred in accordance with Article 8 and, where applicable, Article 9 of KVKK, based on the personal data processing conditions and purposes specified in Article 5 of KVKK.

Data Processing and Retention Period

Your personal data will be processed for the purposes outlined in this Information Notice, within the scope of the legal and regulatory requirements applicable to the Company and its affiliated units, as per data processing and statute of limitations periods stated in relevant laws. If there are changes to these periods, the newly determined periods will be applied.

Your personal data will be processed for the duration necessary for the purposes specified in this Information Notice and, in all cases, in line with legal timeframes, company practices, and commercial customs. After the expiration of these periods, your personal data will be deleted, destroyed, or anonymized.

For detailed information regarding the retention periods of your personal data, you can contact us via the addresses listed in the Rights of the Data Subject section