Privacy Notice and Information on the Processing of Personal Data

The Law on Protection of Personal Data No. 6698 was adopted on March 24, 2016, and published in the Official Gazette No. 29677 dated April 7, 2016. The Law on Protection of Personal Data No. 6698 aims to regulate the principles and procedures that natural and legal persons processing personal data must comply with in order to protect the fundamental rights and freedoms of individuals, primarily the privacy of private life.

This Privacy Notice has been prepared to inform you about the purposes, legal basis, and your rights regarding the processing of your personal data in accordance with Law No. 6698 on Protection of Personal Data ("Law") and related legislation.

Information About Data Controller As Gentaş Decorative Surfaces Industry and Trade Co. Inc., we will process your personal data as the Data Controller in accordance with the relevant legislation on the protection of personal data.

Purposes of Processing Personal Data Personal data collected, as well as special categories of personal data collected depending on the nature of the work, are processed within the scope of the activities listed below in accordance with the conditions and purposes specified in Articles 5 and 6 of the Law:

• Creating emergency contact lists and conducting emergency operations within the scope of occupational health and safety, ensuring information security in business processes, receiving job applications from job candidates/interns, internship processes, conducting candidate selection/placement processes, fulfilling contractual and legal obligations, ensuring compliance with the legislation for the continuity, execution, and improvement of activities, planning human resources processes, training and development activities, compensation policy implementation, performance evaluation, career development activities, execution of fringe benefits and rights processes, insurance transactions, retirement transactions, personnel files creation, work permits for foreign personnel, occupational accident and labor force notification processes, financial, accounting, tax, payment, and invoicing transactions, execution of stock exchange and dematerialization transactions, investment processes, granting access authorizations, physical security of premises, creation and tracking of visitor and employee entry/exit records, assignment and travel processes, tracking and execution of legal affairs, providing information to authorized institutions/organizations when necessary, logistics, transportation, invoice, and waybill transactions, activities for the continuity of operations and improvement of processes, support services during pre-sale, post-sale, and sales processes of goods/services, execution of goods/service operations processes, customer satisfaction and customer relationship management activities, social responsibility activities, conduct of advertising/promotion/campaign activities, sponsorship transactions, fulfillment of concluded or to be concluded contracts, retention and reporting activities, marketing and analysis studies, execution of risk management processes, tracking of requests and complaints related to products/services/company policies, monitoring of internal/external audit activities, communication activities, transmission of cargo and correspondence, organization/event participation and management, supply chain management, security of movable assets and resources, execution of tender processes, execution of product/service marketing processes, management and strategic planning activities, and processing for the purpose of ensuring the security of the data controller.

Methods of Collecting Personal Data and Legal Basis In accordance with the Law on Protection of Personal Data No. 6698, Gentaş Decorative Surfaces Industry and Trade Co. Inc., as the data controller, may perform any kind of transaction on the data, including but not limited to obtaining, recording, storing, preserving, altering, rearranging, disclosing, transferring, taking over, making it obtainable, classifying, or using it through automatic or non-automatic means, as part of any data recording system, wholly or partially, provided that it is not against the law and with the condition that necessary security measures are taken.

Your personal data may be collected through various methods depending on the nature of the relationship between you and Gentaş Decorative Surfaces Industry and Trade Co. Inc. These methods may include but are not limited to oral, written, or electronic means through our company units, the website of our company, social media channels, training, seminars, or events organized by our company, etc.

Personal data collected through these methods may be processed for the purposes specified in articles 4 and 5 of this notice within the scope of personal data processing conditions and purposes specified in articles 5 and 6 of Law No. 6698, and may also be transferred in a limited manner as specified in articles 8 and 9 of Law No. 6698, within the framework of personal data processing conditions and purposes specified in the related laws and legislation.

In accordance with Article 5 of the Law on Protection of Personal Data No. 6698, any information related to an identified or identifiable natural person is considered personal data, and personal data cannot be processed without the explicit consent of the data subject. However, personal data may be processed without the explicit consent of the data subject in the presence of one of the following conditions:

Explicitly prescribed by laws. Necessity to process personal data belonging to the contracting parties, provided that it is directly related to the establishment or performance of a contract. Necessity for the data controller to fulfill its legal obligation. Personal data has been made public by the data subject. Processing of personal data is necessary for the establishment, exercise, or protection of a right. Processing of personal data is necessary for the legitimate interests pursued by the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject. As per Article 6 of the Law on Protection of Personal Data No. 6698, personal data regarding race, ethnicity, political opinion, philosophical belief, religion, sect, or other beliefs, clothing and dress, association, foundation, or union membership, health, sexual life, criminal conviction, and security measures, as well as biometric and genetic data, are considered special categories of personal data. Processing of special categories of personal data without the explicit consent of the data subject is prohibited. However, non-health and non-sexual life special categories of personal data may be processed without the explicit consent of the data subject in cases prescribed by the laws. Health and sexual life-related personal data may only be processed without the explicit consent of the data subject for the purposes of protecting public health, carrying out preventive medicine, medical diagnosis, treatment, and care services, planning and managing healthcare services and financing, and fulfilling the obligations of secrecy.

Persons or Organizations to Which Personal Data May Be Transferred In accordance with the Law on Protection of Personal Data No. 6698 and related legislation, your personal data that you share with us may be transferred to individuals/institutions such as all official authorities and institutions, our parent company, affiliated companies, and subsidiaries, both directly and indirectly, which are affiliated with GENTAŞ DECORATIVE SURFACES INDUSTRY and TRADE CO. INC., our direct/indirect domestic/foreign subsidiaries; organizations we receive services from, cooperate with, program partner organizations, domestic/foreign organizations, and other third parties in order to conduct our activities.

Storage and Disposal of Personal Data Our company keeps personal data for the time necessary for the purpose for which they were processed and for the minimum period specified in the relevant legislation. If there is no specified period in the legislation regarding the storage of personal data, our company processes the personal data for the period required for the processing purpose in the ongoing activity. If it is necessary to keep the data for a longer period for the legitimate interests of the company, our company acts in compliance with the Law and this Policy, taking the necessary care.

Personal data are deleted, destroyed, or anonymized in accordance with the provisions in the laws and relevant legislation. In cases where the reasons requiring the processing of personal data cease to exist or upon the request of the Data Subject, personal data are deleted, destroyed, or anonymized by applying the specified destruction methods.

Rights of the Data Subject in accordance with Article 11 of the Law The rights of the data subject as per Article 11 of the Law on Protection of Personal Data No. 6698 are as follows:

Learning whether personal data is processed, Requesting information if personal data has been processed, Learning the purpose of processing personal data and whether they are used in accordance with their purpose, Knowing the third parties to whom personal data is transferred domestically or abroad, Requesting correction of personal data if it is incomplete or incorrectly processed and requesting notification of the transaction made within this scope to third parties to whom personal data has been transferred, Requesting the deletion or destruction of personal data in the event that the reasons requiring its processing cease to exist, despite being processed in accordance with the provisions of the Law and other relevant laws, and requesting notification of the transaction made within this scope to third parties to whom personal data has been transferred, Objecting to the occurrence of a result against the person himself by analyzing the processed data exclusively through automated systems, In the event of damage due to the unlawful processing of personal data, requesting the compensation of the damage.

Receipt of Data Subject's Application As data subjects, if you submit your requests regarding your rights in accordance with the Law by filling out the "Data Subject Application Form" through the methods described below, Gentaş Decorative Surfaces Industry and Trade Co. Inc. will respond to your request as soon as possible and no later than thirty (30) days free of charge, depending on the nature of the request.

To ensure the security of your personal data, within seven (7) days after your information request reaches the Company, the Company may contact you to confirm that you are the data subject and may request some information and documents from you. If the requested information and documents are incomplete, you will be required to complete and submit them. Until the requested information and documents are fully submitted to us, the thirty (30) day period specified in Article 13/2 of the Law will be suspended.

Within the scope of these rights, you can send your requests to our Company in writing "Beşler Mah. Serpek Mevkii Mengen/BOLU" in person or through a notary, by registered electronic mail (KEP) to the address "gentas@hs02.kep.tr" with secure electronic signature, or by email to the address "insankaynaklari@gentas.com.tr" using the email address you previously provided to our Company and registered in our system.

Your application will be processed free of charge, but if it requires an additional cost, a fee may be charged in accordance with the relevant legislation.

Our Company may accept or reject your request, explaining the reasons, and will notify you in writing or electronically. In case of rejection of the application, finding the response insufficient, or no response within the specified period, the Data Subject has the right to apply to the Personal Data Protection Board within thirty (30) days from the date he/she learned the response, and in any case, within sixty (60) days from the date of application.