General Information and Privacy Notice Regarding the Processing of Personal Data

We would like to inform you about the Law on the Protection of Personal Data No. 6698 ("LPPD"), enacted to protect the fundamental rights and freedoms of individuals—particularly the right to privacy—and to regulate the obligations of natural and legal persons who process personal data.

Pursuant to Article 10 of Law No. 6698 regarding the obligation to inform, Troy-Met Kalite Kontrol Sistemleri Ltd. Şti. presents the following disclosures for the attention of our clients and third parties who visit our websites.

Key legal definitions under the Law and details regarding our data processing procedures are outlined below.

What is the LPPD?

The Law on the Protection of Personal Data (hereinafter referred to as the "Law") was adopted by the Grand National Assembly of Turkey on March 24, 2016, and entered into force upon publication in the Official Gazette No. 29677 on April 7, 2016.

The Law requires compliance from all individuals and entities processing personal data, with core objectives including safeguarding privacy, ensuring security, and preventing unauthorized use. Like all organizations, our company is subject to this Law, and all personal data processed throughout our business operations falls under its scope.

What is Personal Data?

Article 3(d) of the LPPD defines personal data as "any information relating to an identified or identifiable natural person."

Accordingly, any data or dataset that identifies or makes an individual identifiable, directly or indirectly, constitutes personal data. Examples include identifying information directly belonging to or created on behalf of an individual, such as name, surname, date/place of birth, phone number, resume, photograph, and voice recordings.

What is Data Processing?

"Data processing" refers to any operation performed on personal data, whether or not by automated means. This includes collecting, recording, storing, retaining, altering, reorganizing, disclosing, transferring, analyzing, and classifying personal data.

Who is the Data Subject?

The terms "data subject" or "relevant person" refer to the natural person whose personal data is being processed.

Who is the Data Controller?

The data controller is the natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system. In this context, our company acts as the Data Controller regarding personal data belonging to our clients, website visitors, and employees.

Who is the Data Processor?

A data processor is a natural or legal person who processes personal data on behalf of the data controller, based on the authority granted by the controller.

Legal Grounds for Data Processing

Data controllers may only process personal data if explicit consent is obtained or if at least one of the following conditions is met:

• Explicitly provided for by law,

• Directly related to the establishment or performance of a contract,

• Necessary for the data controller to fulfill a legal obligation,

• The data has been made public by the data subject,

• Processing is necessary for the establishment, exercise, or protection of a legal right,

• Processing is necessary for the legitimate interests of the data controller, provided it does not harm the fundamental rights and freedoms of the data subject.

Data Subject Inquiries and Rights

The Law grants data subjects the right to obtain information regarding which personal data is processed, through which operations, and its current status. As a company, we are obligated to respond to requests submitted by data subjects.

If your application is rejected, the response is deemed insufficient, or no response is provided within the statutory timeframe, you are entitled to lodge a complaint with the Personal Data Protection Board within 30 days of learning the response, and in any event within 60 days of the initial application date.

Under Article 13 of the LPPD ("Application to Data Controller"), data subjects must submit their requests in writing. To have your request evaluated, please send a written petition along with valid identification documents to the following address:

Troy-Met Kalite Kontrol Sistemleri Ltd. Şti.

Mert Plaza, Aydınevler Mah. Aslanbey Cad. No: 1-3 A Blok Kat: 3 D: 19-20

34854 Maltepe, Istanbul, Turkey

Privacy Notice on the Protection of Personal Data

Troy-Met Kalite Kontrol Sistemleri Ltd. Şti., acting in its capacity as Data Controller, implements necessary technical and administrative measures to process, store, and transfer your personal data in full compliance with Law No. 6698 (LPPD) and the fundamental principles of privacy and human rights.

Collection of Personal Data and Legal Grounds

Troy-Met Kalite Kontrol Sistemleri Ltd. Şti. collects personal data from clients, client representatives, third-party service providers, and competent legal authorities. Data may be collected via automated or non-automated means through written, verbal, or electronic channels.

This data is gathered to deliver our products and services within the established legal framework, satisfy contractual obligations, and fulfill the purposes set out below, pursuant to the conditions governing the processing of personal data and special categories of personal data set forth in Articles 5 and 6 of the LPPD.

Purposes of Processing Personal Data

Beyond mandatory requirements, our company processes, stores, and transfers only the personal data and special categories of personal data deemed necessary to deliver high-quality products and services within legal bounds. Your personal data may be processed for the following purposes:

• Execution and management of core business activities and commercial operations,

• Planning, implementation, and tracking of business processes,

• Provision, support, and delivery of purchased products and services,

• Communicating general information, commercial updates, and available offers,

• Sales, marketing, and client outreach activities,

• Client acquisition, satisfaction management, and service optimization,

• Market research, analysis, reporting, segmentation, and operational modeling,

• Regulatory reporting and audits required within our sector of operation.

Our company is legally obligated to retain records and documents related to client transactions for specified retention periods. If you request the deletion, destruction, or anonymization of your personal data, your request will be executed upon the expiration of statutory retention periods. During this interim period, your data will not be processed or shared with third parties, except as required by domestic or international laws, regulations, and binding agreements.

Protection and Security of Your Personal Data

Troy-Met Kalite Kontrol Sistemleri Ltd. Şti. places the highest priority on data security. We implement robust technical and organizational security measures to prevent unauthorized access, unlawful disclosure, alteration, loss, or destruction of personal data.

In the event that personal data is compromised or accessed by unauthorized third parties despite our implemented security measures, our company will notify the affected data subjects and the Personal Data Protection Board without undue delay.

Rights of the Data Subject

Under Article 11 of the LPPD, you may apply to Troy-Met Kalite Kontrol Sistemleri Ltd. Şti. to exercise the following rights:

• Learn whether your personal data is being processed,

• Request information regarding processing operations if your data has been processed,

• Learn the purpose of data processing and verify whether the data is used in accordance with its purpose,

• Know the third parties to whom personal data is transferred domestically or abroad,

• Request correction of incomplete or inaccurate data,

• Request deletion or destruction of personal data under the conditions provided by the Law,

• Request notification of data corrections, deletions, or destructions to third parties to whom data has been transferred,

• Object to any unfavorable result arising from data processed exclusively through automated systems,

• Claim compensation for damages incurred as a result of unlawful data processing.

All submitted requests will be evaluated and finalized by Troy-Met Kalite Kontrol Sistemleri Ltd. Şti. in accordance with legal requirements.

Contact Information

To submit an inquiry, file a request, or exercise your rights under the LPPD, please send a written petition along with valid identity verification documents to:

Troy-Met Kalite Kontrol Sistemleri Ltd. Şti.

Mert Plaza, Aydınevler Mah. Aslanbey Cad. No: 1-3 A Blok Kat: 3 D: 19-20

34854 Maltepe, Istanbul, Turkey