PERSONAL DATA PROTECTION AND PROCESSING POLICY

DORLIVA

PERSONAL DATA PROTECTION AND PROCESSING POLICY

The protection of personal data is among the highest priorities of Alon Metal San. ve Tic. Ltd. Şti. (DORLIVA) and its affiliated initiatives. One of the most significant aspects of this commitment is the protection and processing of thepersonal data of job applicants, company shareholders, company officers, visitors, employees, shareholders and officers of institutions with which we cooperate, and thirdparties, all of whom are governed by this Policy.

The activities carried out by our Company regarding the protection of the personal data of our employees are governed under the Employee Personal Data Protection andProcessing Policy, which has been prepared in parallel with the principles set forth in thisPolicy.

Pursuant to the Constitution of the Republic of Türkiye, everyone has the right to request theprotection of their personal data. As the protection of personal data is a constitutional right, DORLIVA exercises the utmost care in protecting the personal data of job applicants, company shareholders, company officers, visitors, employees, shareholders and officers of institutions with which it cooperates, as well as third parties, and has adopted thiscommitment as a corporate policy.

Within this framework, DORLIVA implements all necessary administrative and technicalmeasures to ensure the protection of personal data processed in accordance with theapplicable legislation.

The fundamental principles adopted by our Company regarding the processing of personaldata are as follows:

• Processing personal data lawfully and in accordance with the principles of good faith;

• Ensuring that personal data are accurate and kept up to date where necessary;

• Processing personal data for specific, explicit and legitimate purposes;

• Processing personal data in a manner that is relevant, limited and proportionate to thepurposes for which they are processed;

• Retaining personal data for the period prescribed by the relevant legislation or requiredfor the purpose for which they are processed;

• Informing and enlightening data subjects regarding the processing of their personaldata;

• Establishing the necessary mechanisms to enable data subjects to exercise their legal rights;

• Taking all necessary measures to ensure the security and preservation of personal data;

• Acting in compliance with the applicable legislation and the decisions and regulationsof the Personal Data Protection Board when transferring personal data to third partieswhere required by the purposes of processing;

• Exercising the utmost diligence in the processing, protection and transfer of specialcategories of personal data.

PURPOSE OF THE POLICY

The primary purpose of this Policy is to ensure transparency and establish trust by informingindividuals whose personal data are processed by our Company—including, in particular, our customers, employees, job applicants, company shareholders, company officers, visitors, employees, shareholders and officers of institutions with which we cooperate, and thirdparties—regarding the personal data processing activities carried out lawfully by ourCompany.

SCOPE

This Policy applies to all personal data processed, whether by automated means or by non-automated means provided that they form part of a data recording system, relating to ouremployees, job applicants, company shareholders, company officers, visitors, employees, shareholders and officers of institutions with which we cooperate, and third parties.

The scope of application of this Policy may extend to all provisions of the Policy for thecategories of data subjects specified above, or only to certain provisions depending on therelevant category.

IMPLEMENTATION OF THE POLICY AND APPLICABLE LEGISLATION

The applicable legal provisions in force concerning the processing and protection of personal data shall primarily apply. In the event of any inconsistency between the applicablelegislation and this Policy, our Company accepts that the applicable legislation shall prevail.

This Policy has been prepared by adapting the rules set forth in the applicable legislation tothe practices of our Company.

EFFECTIVENESS OF THE POLICY

This Policy prepared by our Company entered into force on the same date as the relevantlegislation. In the event of any amendment or update to the Policy, its effective date shall be revised accordingly.

The Policy is published on our Company’s website and is made available to data subjectsupon request.

PRINCIPLES REGARDING THE PROTECTION OF PERSONAL DATA

Pursuant to Article 12 of the Turkish Personal Data Protection Law No. 6698 (“PDPL”), ourCompany takes all necessary administrative, legal and technically feasible measures toprevent the unlawful processing of personal data, prevent unlawful access to personal data, ensure the secure preservation of personal data, and conducts the necessary audits to ensurecompliance with these obligations.

ENSURING THE SECURITY OF PERSONAL DATA

Technical and Administrative Measures Taken to Ensure the Lawful Processing of Personal Data

Our Company adopts technical and administrative measures appropriate to the nature of thepersonal data, technological capabilities and implementation costs in order to ensure thatpersonal data are processed lawfully, stored securely, protected against unlawful destruction, loss or alteration, and safeguarded against negligent or unauthorized disclosure, access, transfer or any other unlawful processing activities.

a) Administrative Measures Implemented to Ensure the Lawful Processing of PersonalData

Our Company has implemented the following administrative measures to ensure thatpersonal data are processed lawfully:

• Disciplinary regulations containing provisions on data security are in place foremployees.

• Periodic training and awareness programs on personal data security are provided toemployees.

• An authorization matrix has been established for employees.

• Corporate policies regarding access management, information security, use, retention, and destruction of data have been prepared and implemented.

• Confidentiality undertakings are obtained from employees where necessary.

• Access authorizations of employees who change positions or leave the Company arerevoked immediately.

• Executed agreements contain provisions regarding data security.

• Personal data security policies and procedures have been established.

• Personal data security incidents are reported without delay.

• Continuous monitoring of personal data security is carried out.

• Necessary physical security measures have been implemented regarding entry to andexit from areas containing personal data.

• The security of environments containing personal data is ensured.

• Personal data are minimized as much as possible.

• Existing risks and threats have been identified.

• Protocols and procedures regarding the security of special categories of personal data have been established and are effectively implemented.

b) Technical Measures Implemented to Ensure the Lawful Processing of Personal Data

Our Company has implemented the following technical measures to ensure the lawfulprocessing and security of personal data:

• Network security and application security are maintained.

• Key management procedures are implemented.

• Security measures are applied throughout the procurement, development, andmaintenance processes of information technology systems.

• Access logs are maintained on a regular basis.

• Up-to-date antivirus software is utilized.

• Personal data are backed up, and the security of backup data is ensured.

• User account management and authorization control systems are implemented andcontinuously monitored.

• Log records are maintained in a manner that prevents unauthorized user intervention.

Audit of Measures Implemented for the Protection of Personal Data

In accordance with Article 12 of the Turkish Personal Data Protection Law No. 6698 (“PDPL”), our Company conducts or commissions the necessary internal audits regardingthe protection of personal data.

The results of such audits are reported to the relevant departments within the Company, andthe necessary corrective and preventive actions are implemented in order to improveexisting security measures and ensure continuous compliance.

Measures to Be Taken in Case of Unauthorized Disclosure of Personal Data

Should personal data processed by our Company be obtained by unauthorized personsthrough unlawful means, our Company shall, in accordance with Article 12 of the PDPL, notify the relevant data subject and the Personal Data Protection Board as soon as possible.

Where deemed necessary by the Personal Data Protection Board, such incident may also be announced publicly through the official website of the Board or by any other appropriatemeans.

Protection of Data Subjects‘ Rights, Establishment of Communication Channels andEvaluation of Requests

Our Company establishes the necessary communication channels, internal procedures, administrative and technical infrastructure in accordance with Article 13 of the PDPL toenable data subjects to exercise their legal rights and to ensure that they receive thenecessary information regarding the processing of their personal data.

Where data subjects submit their requests to our Company in writing concerning the rightslisted below, our Company shall evaluate and conclude such requests free of charge as soonas possible and, in any event, within thirty (30) days, depending on the nature of the request.

However, where the requested transaction requires an additional cost, the fee determined bythe Personal Data Protection Board shall be charged.

Data subjects are entitled to:

• Learn whether their personal data are being processed;

• Request information if their personal data have been processed;

• Learn the purpose of processing personal data and whether they are used in accordancewith that purpose;

• Learn the third parties to whom personal data are transferred within Türkiye or abroad;

• Request the rectification of incomplete or inaccurate personal data and requestnotification of such rectification to third parties to whom the data have beentransferred;

• Request the deletion or destruction of personal data where the reasons requiring theirprocessing cease to exist, despite having been processed in accordance with thePDPL and other relevant legislation, and request notification of such action to thirdparties to whom the data have been transferred;

• Object to any result that is detrimental to them arising exclusively from the analysis of processed data through automated systems;

• Request compensation for damages incurred as a result of the unlawful processing of personal data.

Detailed information regarding the rights of data subjects is provided in the relevant sectionsof this Policy.

PROTECTİON OF SPECİAL CATEGORİES OF PERSONAL DATA

Under the Turkish Personal Data Protection Law No. 6698, certain categories of personaldata have been granted special protection due to the risk that unlawful processing may resultin discrimination or victimization of individuals.

These data include information relating to: race, ethnic origin,political opinion,philosophicalbelief, religion, sect or other beliefs, appearance and attire, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, biometric data and genetic data.

Our Company exercises the highest degree of care in the processing and protection of special categories of personal data designated under the PDPL.

Accordingly, the administrative and technical safeguards adopted by our Company for theprotection of personal data are applied with enhanced diligence in relation to specialcategories of personal data, and the necessary internal controls and audits are continuouslymaintained.

Detailed information regarding the processing of special categories of personal data is provided in the relevant sections of this Policy.

INCREASİNG AWARENESS AND SUPERVİSİON OF BUSİNESS UNİTS REGARDİNG THE PROTECTİON AND PROCESSİNG OF PERSONAL DATA

Our Company organizes the necessary training activities for its business units in order toincrease awareness regarding the prevention of unlawful processing of personal data, prevention of unauthorized access to personal data, and the secure preservation of personaldata.

Necessary systems are established to ensure that both existing employees and newlyrecruited employees within DORLIVA’s business units develop sufficient awarenessconcerning the protection of personal data. Where deemed necessary, professionalconsultants and specialized institutions may be engaged for this purpose.

INCREASİNG AWARENESS AND SUPERVİSİON OF BUSİNESS PARTNERS AND BRANCHES REGARDİNG THE PROTECTİON AND PROCESSİNG OF PERSONAL DATA

Our Company provides guidance and awareness activities to its branches in order to preventthe unlawful processing of personal data, prevent unauthorized access to personal data, andensure their secure preservation.

Such awareness activities directed towards business partners and branches are repeatedwhenever necessary in line with legislative amendments and regulatory developments. Necessary reminders are provided to both existing personnel and newly recruited employeesof business partners to ensure awareness regarding the protection of personal data. Whererequired, support may also be obtained from professional individuals or organizations.

The results of awareness and training activities carried out for business partners concerningthe protection and processing of personal data are reported to the management of DORLIVA.

Within this framework, our Company evaluates participation in the relevant meetings andinformation sessions and carries out, or has carried out, the necessary audits.

PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA

Our Company processes personal data in accordance with Article 20 of the Constitution of the Republic of Türkiye and Article 4 of the Turkish Personal Data Protection Law No. 6698 (“PDPL”).

Accordingly, personal data are processed: lawfully and in good faith, accurately and, wherenecessary, kept up to date, for specified, explicit and legitimate purposes, in a manner that is relevant, limited and proportionate to the purposes for which they are processed and retainedonly for the period prescribed by law or required for the purpose of processing.

Our Company processes personal data only where one or more of the legal grounds set forthunder Article 5 of the PDPL exist.

Furthermore, pursuant to Articles 20 of the Constitution and 10 of the PDPL, our Companyfulfills its obligation to inform data subjects and provides all necessary informationwhenever requested by them.

Our Company also complies with the specific provisions governing the processing of specialcategories of personal data under Article 6 of the PDPL.

Likewise, all transfers of personal data are carried out in accordance with Articles 8 and 9 of the PDPL and the regulations issued by the Personal Data Protection Board.

PROCESSİNG PERSONAL DATA İN ACCORDANCE WİTH THE FUNDAMENTAL PRİNCİPLES SET FORTH İN THE LEGİSLATİON

• Processing in Compliance with the Law and the Principle of Good Faith

Our Company processes personal data in accordance with all applicable legal regulationsand the general principles of honesty, fairness and good faith.

Within this scope, the principle of proportionality is observed, and personal data are neverused for purposes beyond those for which they are collected.

• Ensuring That Personal Data Are Accurate and Up to Date

Taking into account both the legitimate interests of our Company and the fundamental rightsand freedoms of data subjects, our Company adopts all necessary measures to ensure thatpersonal data remain accurate and up to date whenever required.

• Processing for Specific, Explicit and Legitimate Purposes

Before processing personal data, our Company clearly determines the lawful and legitimatepurposes for which such data will be processed.

Only personal data that are necessary for the provision of the Company’s services anddirectly related to those purposes are processed.

• Processing Limited to What Is Relevant, Necessary and Proportionate

Our Company processes personal data only to the extent necessary for achieving thepurposes for which they are collected.

Personal data that are unrelated to the intended purpose or that are not necessary for thefulfillment of such purpose are not processed.

Accordingly, our Company does not process personal data merely to address possible futureneeds.

• Retention for the Period Required by Legislation or Processing Purposes

Personal data are retained only for the period stipulated under applicable legislation or forthe duration necessary to fulfill the purposes of processing.

Our Company first determines whether a specific retention period has been prescribed bylaw.

Where such a period exists, personal data are retained accordingly.

Where no statutory period exists, personal data are retained only for the duration required bythe relevant processing purpose.

Upon expiration of the applicable retention period or once the reasons requiring processingcease to exist, personal data are deleted, destroyed or anonymized by our Company in accordance with applicable legislation.

Personal data are never retained solely on the assumption that they may be needed in thefuture.

Detailed information concerning retention periods is provided in the relevant sections of thisPolicy.

PROCESSİNG PERSONAL DATA BASED ON ONE OR MORE OF THE LEGAL GROUNDS SET FORTH UNDER ARTİCLE 5 OF THE PDPL

The protection of personal data constitutes a constitutional right.

Fundamental rights and freedoms may only be restricted by law and only for the reasonsexplicitly provided in the relevant provisions of the Constitution, without impairing theiressence.

Pursuant to the third paragraph of Article 20 of the Constitution, personal data may be processed only where expressly permitted by law or where the data subject has givenexplicit consent.

Accordingly, our Company processes personal data only where one of the legal groundsprescribed by law exists or where the explicit consent of the data subject has been obtained.

Further details regarding these legal grounds are provided in the relevant sections of thisPolicy.

INFORMATİON AND TRANSPARENCY TOWARD DATA SUBJECTS

In accordance with Article 10 of the PDPL, our Company fulfills its obligation to informdata subjects at the time personal data are collected.

Within this scope, DORLIVA informs data subjects regarding:

• the identity of DORLIVA and, where applicable, its representative;

• the purposes for which personal data are processed;

• the persons to whom personal data may be transferred and the purposes of suchtransfers;

• the legal basis and methods of collecting personal data; and

• the rights granted to data subjects under the PDPL.

Detailed information concerning the Company’s obligation to inform data subjects is provided in the relevant sections of this Policy.

Article 20 of the Constitution recognizes every individual’s right to be informed aboutpersonal data relating to them.

Likewise, Article 11 of the PDPL expressly recognizes the right of data subjects to requestinformation regarding the processing of their personal data.

Accordingly, our Company provides all necessary information whenever such requests aresubmitted by data subjects.

Further details are set forth in this Policy and in the relevant Application Form.

PROCESSİNG OF SPECİAL CATEGORİES OF PERSONAL DATA

Our Company processes special categories of personal data, as defined under the TurkishPersonal Data Protection Law No. 6698 (“PDPL”), with the utmost care and in strictcompliance with the provisions stipulated therein.

Article 6 of the PDPL defines certain categories of personal data as “special categories of personal data” due to the higher risk that their unlawful processing may result in discrimination or victimization of individuals.

These data include information relating to: race, ethnic origin, political opinion,philosophical belief, religion, sect or other beliefs, appearance and attire, membership of associations, foundations or trade unions, health, sexual life, criminal convictions andsecurity measures, biometric data and genetic data.

In accordance with the PDPL, our Company processes special categories of personal data only under the following circumstances and provided that adequate safeguards determinedby the Personal Data Protection Board have been implemented:

• where the data subject has given explicit consent; or

• where explicit consent is not required under the PDPL:

o Special categories of personal data other than data relating to health and sexuallife may be processed where expressly permitted by law.

o Personal data relating to health and sexual life may only be processed bypersons under a legal duty of confidentiality or by authorized institutions andorganizations for the purposes of protecting public health, preventivemedicine, medical diagnosis, treatment and care services, and the planning, management and financing of healthcare services.

TRANSFER OF PERSONAL DATA

Our Company may transfer personal data and special categories of personal data to thirdparties (including private companies, shareholders, business partners, public institutions, andnatural or legal persons) by implementing the necessary security measures and only forlawful processing purposes.

Such transfers are carried out strictly in accordance with Article 8 of the PDPL.

Detailed information regarding transfers of personal data is provided in the relevant sectionsof this Policy.

Transfer of Personal Data to Third Parties

Our Company may transfer personal data to third parties based on one or more of the legal grounds specified in Article 5 of the PDPL, including but not limited to the following:

• where the data subject has given explicit consent;

• where such transfer is expressly prescribed by law;

• where the transfer is necessary to protect the life or physical integrity of the data subject or another person and the data subject is physically or legally incapable of giving consent;

• where the transfer is directly related to the establishment or performance of a contractto which the data subject is a party;

• where the transfer is necessary for our Company to fulfill its legal obligations;

• where the relevant personal data have been made public by the data subject;

• where the transfer is necessary for the establishment, exercise or protection of a legal right; or

• where the transfer is necessary for the legitimate interests of our Company, providedthat such interests do not prejudice the fundamental rights and freedoms of the data subject.

Transfer of Special Categories of Personal Data

Special categories of personal data may be transferred by our Company only afterimplementing all administrative and technical safeguards required by law and the adequatemeasures determined by the Personal Data Protection Board.

Such transfers may be carried out under the following conditions:

• where the data subject has provided explicit consent; or

• where explicit consent is not required by law:

o Special categories of personal data other than data relating to health and sexuallife may be transferred where expressly permitted by law.

o Data relating to health and sexual life may only be transferred by personsunder a statutory duty of confidentiality or by authorized public institutionsand organizations for the purposes of protecting public health, preventivemedicine, medical diagnosis, treatment and care services, and the planning, management and financing of healthcare services.

TRANSFER OF PERSONAL DATA ABROAD

Our Company may transfer personal data and special categories of personal data abroad byimplementing all necessary administrative and technical safeguards and only for lawfulprocessing purposes.

Personal data may be transferred to:

• foreign countries recognized by the Personal Data Protection Board as providing an adequate level of protection (“Countries Providing Adequate Protection“); or

• where adequate protection does not exist, foreign countries whose data controllersundertake in writing to provide adequate protection and for which authorization has been granted by the Personal Data Protection Board.

Such transfers are carried out in accordance with Article 9 of the PDPL.

International Transfer of Personal Data

Where the data subject has given explicit consent, or where another legal ground under thePDPL exists, personal data may be transferred abroad under the following circumstances:

• where expressly permitted by law;

• where necessary to protect the life or physical integrity of the data subject or anotherperson and the data subject is unable to provide consent;

• where necessary for the establishment or performance of a contract;

• where necessary for the fulfillment of our Company’s legal obligations;

• where the personal data have been made public by the data subject;

• where necessary for the establishment, exercise or protection of a legal right; or

• where necessary for the legitimate interests of our Company, provided that suchinterests do not override the fundamental rights and freedoms of the data subject.

International Transfer of Special Categories of Personal Data

Special categories of personal data may be transferred abroad only where all legal requirements and adequate safeguards determined by the Personal Data Protection Board have been fulfilled.

Such transfers may take place:

• with the explicit consent of the data subject; or

• without explicit consent where expressly permitted under applicable legislation.

Health data and data relating to sexual life may only be transferred abroad by persons undera statutory duty of confidentiality or by authorized institutions and organizations forpurposes relating to public health, preventive medicine, medical diagnosis, treatment andcare services, and the planning, management and financing of healthcare services.

CATEGORİZATİON OF PERSONAL DATA PROCESSED BY OUR COMPANY

In accordance with Article 10 of the PDPL, our Company informs data subjects regardingthe categories of personal data processed, the purposes of processing and the applicableretention periods.

The categories of personal data processed by our Company include, but are not limited to:

• Identity Information;

• Contact Information;

• Personnel Records;

• Legal Transaction Information;

• Customer Transaction Information;

• Physical Premises Security Information;

• Financial Information;

• Professional Experience Information;

• Marketing Information;

• Visual and Audio Records;

• Health Information;

• Criminal Convictions and Security Measures Information.

PURPOSES OF PROCESSİNG PERSONAL DATA

Depending on the relevant category of personal data, our Company processes personal data for purposes including, but not limited to:

• conducting recruitment, internship and student placement processes;

• managing employment applications;

• fulfilling obligations arising from employment contracts and applicable legislation;

• administering employee benefits and fringe benefits;

• managing access authorization processes;

• ensuring compliance with applicable legislation;

• carrying out finance and accounting operations;

• managing assignment and delegation processes;

• conducting legal affairs;

• carrying out communication activities;

• planning and managing human resources processes;

• conducting and supervising business operations;

• carrying out occupational health and safety activities;

• ensuring business continuity;

• conducting logistics operations;

• managing procurement processes;

• managing sales processes;

• managing customer relationship processes;

• carrying out marketing and analytical activities;

• managing contractual processes;

• promoting products and services;

• ensuring the security of data controller operations; and

• providing information to authorized public institutions, authorities and organizationswhere required by law.

RETENTİON PERİODS OF PERSONAL DATA

Our Company retains personal data for the periods prescribed under the applicable laws andregulations.

Where no specific retention period is stipulated by law, personal data shall be retained onlyfor the period necessary in light of the purposes for which they are processed, the servicesprovided by our Company, its business practices, and commercial customs. Upon expirationof such period, personal data shall be deleted, destroyed, or anonymized in accordance withthe applicable legislation.

Where the purpose of processing personal data has ceased to exist and the statutory orCompany-designated retention periods have expired, personal data may continue to be retained solely for the purposes of serving as evidence in potential legal disputes, exercisingor defending legal rights, or protecting the legitimate interests of the Company.

The retention periods applicable in such circumstances are determined by taking intoaccount the relevant statutes of limitation and previous legal claims directed against theCompany in similar matters.

During such period, the retained personal data shall not be accessed or processed for anypurpose other than the relevant legal dispute. Upon expiry of the applicable limitationperiod, such personal data shall be deleted, destroyed, or anonymized.

CATEGORİZATİON OF DATA SUBJECTS

Although our Company processes the personal data of various categories of individuals, thisPolicy principally applies to the following categories of data subjects:

• Customers;

• Prospective Customers;

• Job Applicants;

• Company Shareholders;

• Company Officers;

• Visitors;

• Employees, Shareholders and Officers of Institutions with Which We Cooperate;

• Third Parties.

The processing of employees‘ personal data is governed separately under the EmployeePersonal Data Protection and Processing Policy, through which our Company fulfills itsobligation to inform employees.

Persons falling outside the categories listed above may also submit requests to our Companyunder the PDPL, and such requests shall likewise be evaluated in accordance with thisPolicy.

For this purpose, a separate Application Form has also been prepared to guide data subjectsin exercising their rights.

THİRD PARTİES TO WHOM PERSONAL DATA ARE TRANSFERRED AND PURPOSES OF TRANSFER

In accordance with Article 10 of the PDPL, our Company informs data subjects regardingthe categories of recipients to whom personal data may be transferred.

Pursuant to Articles 8 and 9 of the PDPL, personal data may be transferred to the followingcategories of recipients:

• Natural persons;

• Private legal entities;

• Publicly available platforms or environments where disclosure is legally required;

• Suppliers;

• Competent public institutions and organizations.

Such transfers are carried out only for the following purposes:

• Ensuring the fulfillment of the objectives of business partnerships;

• Obtaining outsourced services required for the Company’s commercial activities;

• Conducting commercial activities requiring the participation of affiliated companies;

• Planning and auditing corporate strategies in accordance with applicable legislation;

• Increasing the Company’s visibility on social media platforms and websites throughvisual and audiovisual publications;

• Complying with lawful requests from competent public authorities for information anddocumentation;

• Complying with lawful requests from competent private legal entities where legallyauthorized;

• Fulfilling the purposes specified in this Policy in accordance with the PDPL and otherapplicable legislation.

OTHER PERSONAL DATA PROCESSİNG ACTİVİTİES CONDUCTED BY OUR COMPANY

Although the legal basis for processing personal data may differ depending on theprocessing activity, our Company conducts all processing activities in compliance with thegeneral principles set forth in Article 4 of the PDPL.

Where the processing of personal data is based on the explicit consent of the data subject, visitors and third parties are provided with the necessary privacy notices, and their explicitconsent is obtained where required.

Upon request, visitors are informed regarding the categories of personal data collected fromthem, and our Company fulfills its obligation to provide information concerning their rightsand our corresponding obligations.

Where the data subject is physically or legally incapable of providing consent and theprocessing of personal data is necessary to protect the life or physical integrity of the data subject or another person, personal data may be processed without explicit consent.

Personal data may also be processed where such processing is directly necessary for theestablishment or performance of a contract.

Furthermore, personal data may be processed where necessary for our Company to fulfill itslegal obligations as the data controller.

Where personal data have been made public by the data subject, such data may be processedwithin the limits of the purpose for which they were made public.

Personal data may also be processed where necessary for the establishment, exercise, orprotection of a legal right, including for evidentiary purposes such as invoices andaccounting records.

Where processing is necessary for the legitimate interests of our Company and does not prejudice the fundamental rights and freedoms of the data subject, personal data may also be processed for purposes such as internal reporting, corporate planning, and operationalmanagement.

MONİTORİNG ACTİVİTİES CONDUCTED WİTHİN COMPANY PREMİSES

Personal data processing activities carried out at the entrances of Company buildings andfacilities, as well as within such premises, are conducted in accordance with the Constitutionof the Republic of Türkiye, the PDPL, and other applicable legislation.

For the purpose of ensuring security, our Company may monitor visitor entrances and exitsand, where necessary, conduct video surveillance through security camera systems installedat Company buildings and facilities.

Visitor registration records are maintained to ensure the security of Company premises andto achieve the purposes specified in this Policy.

Visitors entering Company premises are informed through privacy notices displayed withinthe facilities or made available by other appropriate means.

Information collected within the scope of visitor registration is processed solely for securitypurposes and recorded in the relevant physical or electronic data recording systems.

Deletion, Destruction and Anonymization of Personal Data

In accordance with Article 7 of the PDPL and Article 138 of the Turkish Criminal Code, where the reasons requiring the processing of personal data cease to exist, our Companyshall, either ex officio or upon the request of the data subject, delete, destroy, or anonymizesuch personal data in accordance with the procedures prescribed by law.

Our Company fulfills this legal obligation by applying legally recognized deletion, destruction, and anonymization methods.

Haklısınız. Son kısmı tamamlamamıştım. Aşağıda belgenin kalan bölümünün çevirisini aynı hukuki terminoloji ve formatla sürdürüyorum.

TECHNİQUES FOR THE DELETİON AND DESTRUCTİON OF PERSONAL DATA

Although personal data have been processed in accordance with the applicable legislation, our Company may delete or destroy such data, either ex officio or upon the request of thedata subject, where the reasons requiring their processing cease to exist.

The primary deletion and destruction methods used by our Company include the following:

(i) Physical Destruction

Personal data processed by non-automated means, provided that they form part of a data recording system, may be destroyed physically in such a manner that they can no longer be recovered or used.

(ii) Secure Deletion from Software Systems

Personal data processed wholly or partially by automated means and stored in electronicenvironments are securely deleted using technical methods that prevent their recovery.

(iii) Secure Deletion by Authorized Experts

Where necessary, our Company may engage qualified experts or specialized service providers to securely delete or destroy personal data in such a manner that recovery is technically impossible.

Techniques for the Anonymization of Personal Data

Anonymization refers to rendering personal data incapable of being associated with an identified or identifiable natural person, even if matched with other data.

Where the reasons requiring the processing of personal data cease to exist, our Companymay anonymize such data in accordance with the PDPL.

Pursuant to Article 28 of the PDPL, anonymized data may subsequently be processed forpurposes such as research, planning and statistical analysis. Such processing falls outside thescope of the PDPL, and the explicit consent of the data subject is not required.

The anonymization techniques primarily used by our Company include:

Masking

Masking is the process of removing or obscuring the principal identifying elements of personal data so that the individual can no longer be identified.

Aggregation

Aggregation combines multiple datasets in such a way that the resulting information can nolonger be linked to an identifiable individual.

Data Derivation

Data derivation transforms personal data into more generalized information so that theresulting data cannot be associated with a particular individual.

Data Shuffling

Data shuffling rearranges values within datasets, thereby breaking the relationship betweenpersonal data and the individuals to whom they relate.

Rights of Data Subjects

In accordance with Article 10 of the PDPL, our Company informs data subjects of theirstatutory rights, provides guidance regarding the exercise of such rights, and establishes thenecessary administrative and technical infrastructure required under Article 13 of the PDPL.

Data subjects are entitled to:

1. Learn whether their personal data are being processed;

2. Request information regarding the processing of their personal data;

3. Learn the purposes for which personal data are processed and whether they are used in accordance with those purposes;

4. Learn the third parties to whom personal data are transferred domestically orinternationally;

5. Request the rectification of incomplete or inaccurate personal data and notification of such rectification to recipients;

6. Request the deletion or destruction of personal data where the legal grounds forprocessing cease to exist and request notification thereof to recipients;

7. Object to any outcome that is detrimental to them arising exclusively from automatedprocessing;

8. Request compensation for damages resulting from unlawful processing of personaldata.

Circumstances Under Which Personal Data Subjects Cannot Exercise Their Rights

Pursuant to Article 28 of the KVK Law, since the following situations are excluded from thescope of the KVK Law, personal data subjects cannot exercise the rights listed belowregarding these matters:

1.Processing of personal data for purposes such as research, planning, and statisticsby making them anonymous through official statistics.

2.Processing of personal data for artistic, historical, literary, or scientific purposes, orwithin the scope of freedom of expression, provided that such processing does not violatenational defense, national security, public security, public order, economic security, theprivacy of private life, or personal rights, and does not constitute a crime.

3.Processing of personal data within the scope of preventive, protective, andintelligence activities carried out by public institutions and organizations authorized by lawto ensure national defense, national security, public security, public order, or economicsecurity.

4.Processing of personal data by judicial authorities or enforcement bodies in relationto investigation, prosecution, trial, or execution proceedings.

Pursuant to Article 28/2 of the KVK Law, in the situations listed below, personal data subjects cannot exercise the rights enumerated below, with the exception of the right todemand compensation for damages:

1.Where the processing of personal data is necessary for the prevention of a crime orfor a criminal investigation.

2.Where personal data that has been made public by the personal data subjectthemselves is processed. 3.The processing of personal data being necessary for theperformance of supervisory or regulatory duties, or for disciplinary investigations orprosecutions, by authorized public institutions and organizations—or by professionalorganizations having the status of public institutions—based on the authority granted bylaw.

4.The processing of personal data by judicial authorities or enforcement bodies in connection with investigation, prosecution, adjudication, or enforcementproceedings.Procedure for Exercising Rights

Exercise of Rights by the Personal Data Subject

Personal data subjects may submit requests regarding the rights listed in this section free of charge via the following methods:

1. By completing and wet-signing the form available at www.dorliva.com and submitting it via Karacaoğlan Mah. 6169 Sokak No:8/Z-11 İzmir/TÜRKİYE,

2. By completing and wet-signing the form available at www.dorliva.com and submitting it via a notary public; or by signing the form with a secure electronic signature (in accordancewith Electronic Signature Law No. 5070) and transmitting it via Registered Electronic Mail (KEP) to alonmetalmakina@hs01.kep.tr or via e-mail to info@dorliva.com

Requests cannot be made by third parties on behalf of personal data subjects.

For a person other than the personal data subject to make a request, they must possess a clear, official power of attorney authorizing them to act on behalf of the personal data subject regarding such requests.

Right to Lodge a Complaint with the Personal Data Protection Board

Pursuant to Article 14 of the PDPL, where an application is rejected, the response is considered insufficient, or no response is provided within the statutory period, the data subject may lodge a complaint with the Personal Data Protection Board within thirty (30) days following receipt of the Company’s response and, in any event, within sixty (60) daysfrom the date of the original application.

COMPANY’S PROCEDURE FOR RESPONDİNG TO APPLİCATİONS

Our Company’s Procedure and Timeframe for Responding to Requests

If a personal data subject submits a request to our Company in accordance with the procedure outlined in the preceding section, our Company will finalize the request free of charge as soon as possible and, in any event, within thirty days, depending on the nature of the request.

However, if the transaction entails additional costs, our Company will charge the applicant a fee in accordance with the tariff determined by the Personal Data Protection Board.

Information Our Company May Request from the Personal Data Subject

Our Company may request information from the relevant person to verify whether the applicant is indeed the personal data subject.

Our Company may direct questions to the personal data subject regarding their application in order to clarify the matters raised therein. Our Company’s Right to Reject the Personal Data Subject’s Request

Our Company may reject the applicant’s request by explaining the grounds for such rejection in the following cases:

(1)Processing of personal data for purposes such as research, planning, and statistics by making them anonymous through official statistics,

(2)Processing of personal data for artistic, historical, literary, or scientific purposes, or within the scope of freedom of expression, provided that such processing does not violate national defense, national security, public security, public order, economic security, the privacy of private life, or personal rights, and does not constitute a crime,

(3)Processing of personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public security, public order, or economic security,

(4)Processing of personal data by judicial authorities or enforcement bodies in relation to investigation, prosecution, trial, or enforcement proceedings,

(5)Processing of personal data where necessary for the prevention of crime or for a criminal investigation,

(6)Processing of personal data that has been made public by the personal data subject themselves,

RELATIONSHIP BETWEEN THE COMPANY’S PERSONAL DATA PROTECTION AND PROCESSING POLICY AND OTHER POLICIES

A– Personal Data Protection Commission has been established, or an officer has beenappointed, within the Company—pursuant to a decision by senior management—to managethis policy and other policies related or linked to it. The duties in question are outlinedbelow:

•To prepare fundamental policies regarding the Protection and Processing of PersonalData and submit them to senior management for approval and implementation.

•To determine the manner in which the policies concerning the Protection andProcessing of Personal Data are to be implemented and audited, and to submit proposals tosenior management regarding internal assignments and coordination in this context.

•To identify the measures required to ensure compliance with the Personal Data Protection Law and relevant legislation, and to submit these measures to senior managementfor approval; to oversee their implementation and ensure coordination.

•To raise awareness regarding the Protection and Processing of Personal Data withinthe Company and among the institutions with which the Company collaborates.

•Identify potential risks associated with the Company’s personal data processingactivities and ensure that necessary measures are taken; submit improvement proposals tosenior management for approval.

•Design and oversee the delivery of training programs regarding personal data protection and the implementation of relevant policies.

•Make final determinations regarding requests submitted by personal data subjects.

•Coordinate information and training activities to ensure personal data subjects areinformed about personal data processing activities and their legal rights.

•Prepare amendments to core policies concerning the protection and processing of personal data and submit them to senior management for approval and implementation.

•Monitor developments and regulations regarding personal data protection; advisesenior management on necessary internal actions to ensure compliance with thesedevelopments and regulations.

•Coordinate relations with the Personal Data Protection Board and the Personal Data Protection Authority.

•Perform other duties assigned by senior management regarding personal data protection.

Some of the aforementioned policies are intended for internal use. By reflecting theprinciples of these internal policies—to the extent relevant—in publicly available policies, the aim is to inform the concerned parties and ensure transparency and accountabilityregarding the personal data processing activities conducted by the Company.

DORLIVA

PERSONAL DATA PROTECTION AND PROCESSING POLICY

The Golden Essence of Life

Dorliva

Lets Talk With Us