IC INTECHRON TEKNOLOJİ TİCARET ANONİM ŞİRKETİ PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

a) Data Controller

Pursuant to Law No. 6698 on the Protection of Personal Data (the “Law”), the data controller is IC INTECHRON TEKNOLOJİ TİCARET ANONİM ŞİRKETİ (“IC Intechron”), whose address is Mutlukent Mahallesi, 2045 Sokak, No:19, Çankaya/Ankara, Türkiye, and whose registered electronic mail (KEP) address is icintechron@hs03.kep.tr.

IC Intechron processes personal data in accordance with the principles set out under Article 4 of the Law, namely:

• processing lawfully and fairly,
• ensuring that personal data is accurate and, where necessary, kept up to date,
• processing personal data for specified, explicit and legitimate purposes,
• ensuring that personal data is relevant, limited and proportionate to the purposes for which it is processed,
• retaining personal data for the period prescribed by applicable legislation or for as long as necessary for the purposes for which it is processed.

b) Purposes of Processing Personal Data

Depending on the relevant processing activity, personal data obtained by IC Intechron may be processed for the following purposes:

• planning, conducting and monitoring the Company’s activities, business processes and corporate operations,
• establishing and managing relationships with customers, prospective customers, suppliers, business partners and other stakeholders; managing information, quotation, technical support, communication, request and complaint processes,
• conducting human resources and recruitment processes; evaluating job applicants and carrying out interview, offer and pre-employment procedures,
• ensuring the security of the website, electronic communication channels and information systems; preventing unauthorized access, misuse and cybersecurity risks,
• conducting corporate communication, event, announcement and newsletter activities and, where commercial electronic communications are involved, managing communication consents and preferences in accordance with applicable legislation,
• conducting pre-contractual and contractual processes, fulfilling legal obligations, responding to requests from authorized authorities and establishing, exercising or protecting the rights of IC Intechron.

c) Recipients and Purposes of Personal Data Transfers

Personal data may, to the extent necessary, limited and proportionate to the relevant processing purpose, be transferred to:

• relevant Company employees and managers,
• service providers providing information technology, hosting, e-mail, security, consultancy, legal, audit and similar support services,
• customers, suppliers and business partners depending on the nature of the business relationship,
• IC Holding and other group companies only to the extent necessary,
• legally authorized public authorities and institutions and authorized private law persons,

in accordance with the personal data transfer requirements set out under Article 8 of the Law.

d) Methods and Legal Grounds for Collecting Personal Data

Personal data may be collected electronically or physically through the website and forms, e-mail, telephone, career and professional networking platforms, face-to-face meetings, contracts, corporate correspondence, technical systems and security records, as well as information and documents provided directly by the data subject or through authorized third parties.

Depending on the relevant processing activity, personal data is processed on the legal grounds set out under Article 5 of the Law, including:

• where processing is expressly provided for by law,
• where processing is necessary for the establishment or performance of a contract,
• where processing is necessary for the data controller to fulfil its legal obligations,
• where processing is necessary for the establishment, exercise or protection of a right,
• where processing is necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not adversely affected.

Where a personal data processing activity requires explicit consent, such consent shall be obtained separately from the privacy notice and based on the data subject’s freely given decision.

e) Your Rights under Article 11 of the Law

As a data subject, you have the following rights under Article 11 of the Law:

• to learn whether your personal data is being processed,
• to request information if your personal data has been processed,
• to learn the purpose of processing your personal data and whether it is being used in accordance with such purpose,
• to know the third parties to whom your personal data has been transferred within Türkiye or abroad,
• to request correction of your personal data if it has been processed incompletely or inaccurately,
• to request the deletion or destruction of your personal data under the conditions set out under Article 7 of the Law,
• to request notification of correction, deletion or destruction operations to third parties to whom your personal data has been transferred,
• to object to any result arising against you as a consequence of the analysis of processed data exclusively through automated systems,
• to claim compensation if you suffer damage due to the unlawful processing of your personal data.

You may submit your requests:

• in writing to Mutlukent Mahallesi, 2045 Sokak, No:19, Çankaya/Ankara, Türkiye,
• via your registered electronic mail (KEP) account to icintechron@hs03.kep.tr,
• by using a secure electronic signature or mobile signature and sending your application to info@intechron.com.tr,
• from an e-mail address previously notified to IC Intechron and registered in the Company’s systems to info@intechron.com.tr.

The Data Subject Application Form is available under the “Related Documents” section of this page to facilitate the complete submission of your requests.

Applications will be processed as soon as possible and, in any event, within 30 days, depending on the nature of the request. If processing the application requires an additional cost, the fee determined by the Turkish Personal Data Protection Board may apply.

f) Retention Period of Personal Data

Personal data is retained for the periods prescribed by applicable legislation and for as long as necessary for the relevant processing purposes.

Upon expiry of the applicable retention periods or when all conditions requiring the processing of personal data cease to exist, personal data shall be deleted, destroyed or anonymized in accordance with the IC Intechron Personal Data Retention and Disposal Policy and applicable legislation.