Dear Business Partners and Prospective Business Partners,

As METGÜN İNŞAAT TAAHHÜT VE TİCARET A.Ş., in our capacity as the “Data Controller” (hereinafter referred to as the “Data Controller”);

We hereby inform you that your personal data, which you have provided to us, will be recorded, stored, preserved, reorganized, shared with institutions legally authorized to request such data, and transferred to third parties within the country or abroad, classified, and processed in other ways as stipulated by the Personal Data Protection Law (KVKK). This will be done within the framework of the purposes requiring their processing, in a limited and measured manner, and by maintaining the accuracy and up-to-date status of the data as reported to us.

1- Your Processed Personal Data

Our company, as the data controller, may collect and process certain personal data within the scope of the Personal Data Protection Law No. 6698, which came into force on April 7, 2016.

Accordingly, we may request information such as the company name, sector, name, surname, e-mail address, telephone number, and other contact details of our business partners, prospective business partners, their employees, or their partners/officials, depending on the nature of the business.

All personal data collected and processed throughout the business development processes and the performance of work regarding these individuals are transferred to relevant units to the extent provided and permitted by the Law, as detailed below.

2- Method and Legal Basis of Personal Data Collection

Your personal data is collected by the Data Controller through the channels shown below, within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of Law No. 6698 (KVKK), for the implementation and execution of the Data Controller’s business development policies, in physical and electronic environments as follows:

• Information and documents sent by our business partners or prospective business partners and their employees or partners/officials via e-mail, cargo, references, and similar methods,
• Correspondence conducted via e-mail addresses, short messages (SMS), multimedia messages, information forms, and all kinds of communication channels including various other communication methods,
• Through reference persons,
• Through the Data Controller’s employees or the employment or consultancy companies it works with,
• Through research conducted by the Data Controller via the internet or other channels.

3- Purpose of Processing Your Personal Data

Within the scope of the purposes specified in this clarification text, the personal data of our business partners or prospective business partners and their employees or partners/officials may be collected and processed by the Data Controller for the following:

• Applying when needed for business development or the execution of existing business,
• Receiving price quotations regarding the work to be carried out,
• Discussing the details of the received price quotations,
• Creating a company pool,
• Verifying the accuracy of information provided by business partners or prospective business partners and their employees/officials when necessary, or contacting third parties to conduct research on the submitted proposals,
• Fulfilling the requirements of any legislation or the requests of authorized institutions or organizations,
• Developing and improving the processes of execution and acceleration of business.

4- Principles Based on the Processing of Your Personal Data

4.1. Processing Personal Data in Accordance with the Principles Provided in the Legislation

Personal data obtained by the Data Controller is processed within the framework of the procedures and principles stipulated by the Law and other legal legislations. These principles are as follows:

• Processing in accordance with the law and the rule of honesty,
• Ensuring that personal data is accurate and, where necessary, up-to-date,
• Processing for specific, clear, and legitimate purposes,
• Being relevant, limited, and measured for the purpose for which they are processed,
• Preserving for the period stipulated in the legislation or required for the purpose for which they are processed.

4.2. Processing of General Personal Data

Article 5 of the Law regulates the conditions for processing personal data. At least one of these conditions must be met for personal data to be processed. It is also possible for personal data processing activity to meet more than one condition. Article 6 of the Law regulates the processing conditions for special categories of personal data. The conditions for processing are listed as follows:

• Explicit consent of the Personal Data Owner,
• Explicitly provided for in the laws,
• Inability to obtain explicit consent due to actual impossibility,
• Direct relevance to the establishment or performance of a contract,
• Fulfillment of a legal obligation,
• The Personal Data Owner making their personal data public,
• Obligatory data processing for the establishment or protection of a right,
• Obligatory data processing for the legitimate interest of the Data Controller.

4.3. Processing of Special Categories of Personal Data

Article 6 of the Law regulates the conditions for processing special categories of personal data. These are processed by the Data Controller in accordance with the principles stated in this Clarification Text, by taking all necessary administrative and technical measures, including methods determined by the Board, and in the presence of the following conditions:

Processing of special categories of personal data is only possible in case of:

• Explicit consent of the relevant person,
• Explicitly provided for in the laws,
• Obligatory for the protection of life or physical integrity of the person or another person who is unable to express their consent due to actual impossibility or whose consent is not legally valid,
• Personal data made public by the data subject and in accordance with the will of making it public,
• Obligatory for the establishment, use, or protection of a right,
• Necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management, and financing of health services by persons under the obligation of secrecy or authorized institutions and organizations,
• Obligatory for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services, and social assistance,
• For members or former members of foundations, associations, and other non-profit organizations or formations established for political, philosophical, religious, or trade union purposes, provided that it complies with the legislation and purposes they are subject to, is limited to their fields of activity, and is not disclosed to third parties.

Processing of special categories of personal data is prohibited except for these cases. Additionally, it is mandatory to take adequate measures determined by the Board.

5- Clarification of Business Partners, Prospective Business Partners, and Their Employees/Officials

In accordance with KVKK, the data controller or the person authorized by them is obliged to provide information during the collection of personal data regarding:

• The identity of the data controller and their representative, if any,
• The purpose for which personal data will be processed,
• To whom and for what purpose the processed personal data can be transferred,
• The method and legal reason for personal data collection,
• Other rights listed in Article 11 of the Law.

The Data Controller fulfills the obligation of clarification during the collection of personal data and aims to maintain a transparent data processing policy.

6- To Whom and For What Purpose Personal Data Will Be Transferred

According to Article 8 of Law No. 6698, personal data cannot be transferred without the explicit consent of the relevant person. However, personal data may be transferred to third parties without explicit consent in cases where data can be processed without the data owner’s explicit consent.

Special categories of personal data may also be transferred without explicit consent if one of the conditions specified in Article 6/3 of the KVKK exists, provided that adequate precautions are taken.

Provisions in other laws regarding the transfer of personal data are reserved.

According to Article 9 of the KVKK, personal data may be transferred abroad by data controllers and data processors if there is an adequacy decision regarding the country, sectors within the country, or international organizations, and one of the conditions specified in Articles 5 and 6 exists.

In the absence of an adequacy decision, data may be transferred provided that the data subject has the opportunity to exercise their rights and apply for effective legal remedies in the country of transfer, and one of the following safeguards is provided:

• The existence of an agreement between public institutions or international organizations, and permission from the Board,
• The existence of binding corporate rules approved by the Board,
• The existence of a standard contract containing matters such as data categories, purposes, and technical measures,
• The existence of a written undertaking providing adequate protection and permission from the Board.

Standard contracts are notified to the Authority within five business days of signing.

Processed personal data may be transferred to:

• Business partners,
• Company officials,
• Legally authorized public institutions and organizations,
• Legally authorized private law persons, limited to the conditions specified in Articles 8 and 9 of Law No. 6698.

7- Storage Period of Your Personal Data

When determining the storage period of personal data, the obligations brought by legal regulations are taken into account. Beyond legal regulations, the storage period is determined by considering the purposes of processing. After the period has expired, your personal data will be deleted, destroyed, and/or anonymized by the Data Controller.

Personal data of our business partners are stored for 15 years from the end of the contract. Information regarding prospective business partners and their employees/officials is stored for three years from the date of acquisition. If a business relationship cannot be established, such data will be deleted or anonymized in accordance with the destruction policy.

You can always withdraw your consent for the processing of personal data other than those that must be processed by law.

8- Your Rights as a Personal Data Owner

Within the scope of Article 11 of the KVKK, you have the following rights regarding your personal data:

• Learning whether personal data is processed,
• Requesting information if personal data has been processed,
• Learning the purpose of processing and whether they are used in accordance with their purpose,
• Knowing the third parties to whom personal data is transferred at home or abroad,
• Requesting correction of personal data if it is incomplete or incorrectly processed,
• Requesting the deletion or destruction of data if the reasons requiring processing disappear,
• Requesting notification of the corrected or deleted information to third parties to whom the data was transferred,
• Objecting to a result against the person themselves by analyzing the processed data exclusively through automated systems,
• Requesting compensation for damages in case of loss due to unlawful processing.

To exercise these rights, you can submit your written request with a wet signature in person to “Huzur Mah. Ayazağa Cad. Metgün Binası No:2/2 Sarıyer / İstanbul“, clearly stating it is related to KVKK, or send it through a notary or other methods specified in Law No. 6698. Applications must be made in Turkish.