The purpose of this policy is to inform the Related Persons about the Personal Data Processing activities and related systems that Aktaş Hava Süspansiyon Sistemleri Sanayi ve Ticaret A.Ş. carries out in the capacity of Data Officer in accordance with the Personal Data Protection Law no. 6698 (“KVKK”). In this context, Aktaş hereby discloses in this Policy the activities of Personal Data processing within the scope of KVKK and the rights of Data Owners subject to Personal Data Processing.

In this context, the terms referred to under the Law shall have the following meanings:

• Open Consent: Consent which is based on information and explained with free will on a certain subject,
• Personal Data: Any information relating to an identifiable natural person (in the context of this Policy, the term “Personal Data” shall include, as appropriate, “Private Personal Data” as defined below),
• Private Personal Data: Data on people's race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, appearance and data on membership in the associations, foundations or unions and health, sexual life, criminal convictions and security measures, and biometric and genetic data,
• Personal Data Processing: any transactions and procedures performed on data such as obtaining, recording, retaining, storage, preserving, modification, reorganization, disclosure, transfer, takeover, making available, classifying or preventing use of Personal Data completely or partially automatically or non-automatically as part of any data recording system,
• Data Owner: The natural person whose personal data is processed,
• Data Officer: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system (in this context, Aktaş is the Data Officer responsible for the data of its customers, suppliers, visitors and employees),
• Data Processor: The natural or legal person who processes personal data on behalf of the data officer on the basis of the authority given to him/her,

1. A. PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA

Aktaş hereby adopts the following principles regarding the processing of Personal Data in accordance with paragraph 2 of Article 4 of the KVKK and within the scope of the purposes exemplified in the 'Personal Data Processing Purposes' section of this Policy;

• Compliance with law and integrity rules,
• Being accurate and up-to-date when necessary,
• Processing for specific, clear and legitimate purposes,
• To be connected, limited and restrained for the purpose they are processed,
• Retaining for the period required by the relevant legislation or for the purpose for which they are processed.

B. DATA PROCESSED BY AKTAŞ

Personal Data is processed on the basis of the Data Owner's Open Consent, or in cases not requiring Open Consent, within the scope of the Articles 5 and 6 of the KVKK, in accordance with the purposes set out in the “Personal Data Processing Purposes” section of this Policy. Depending on the type, nature of the relationship between Aktas and the Data Owner and the Personal Data Processing Purposes, the categories of Personal Data processed in accordance with the principles in this Policy are generally as follows:

• Data contained in identification document
• Identifying information created by Aktaş,
• Physical and digital data obtained for customer and supplier identification purposes,
• Contact information and records,
• Information on natural persons in documents for legal entities,
• Descriptive and qualitative information about prospective employee and employees,
• Financial data related to the transactions performed by Aktaş.

C. PERSONAL DATA PROCESSING PURPOSES

Personal Data may be processed by Aktaş for the purposes stated below;

• Conducting activities of Aktaş,
• Execution of legal and administrative obligations,
• Negotiation, creation and execution of contracts,
• Carrying out promotional and marketing activities,
• Ensuring employee, customer and supplier satisfaction,
• Efforts to prevent Aktaş's financial risks,
• Carrying out candidate evaluation and recruitment processes
• Carrying out human resources and personnel processes,
• Planning and execution of corporate sustainability activities,
• Carrying out the commercial activities of Aktaş and its subsidiaries and joint ventures,

D. PERSONAL DATA TRANSFER

Aktaş may transfer data to domestic and international subsidiaries, suppliers and business partners and Personal Data can be processed and stored in appropriate media within the framework of the objectives exemplified in the 'Personal Data Processing Purposes' section of this Policy and the conditions stipulated in Articles 8 and 9 of the KVKK.

E. PERSONAL DATA COLLECTION

In order to meet the objectives exemplified in the 'Personal Data Processing Purposes' section of this Policy by Aktaş, Personal Data will be collected directly from prospective employees, current employees, customers, suppliers, business partners, affiliates, official institutions and other physical environments and also through websites, mobile applications, social media and other public channels or organized trainings, organizations and similar events pursuant to the conditions stipulated in Articles 5 and 6 of KVKK.

F. RETENTION TIME OF PERSONAL DATA

Personal Data is kept by Aktaş for the duration of the relevant legal retention periods or for the period required for the realization of the activities and objectives related to this data. Personal Data whose purpose of use or legal retention period expires is disposed of in accordance with the Data Retention and Disposal Policy.

G. RIGHTS OF DATA OWNER

In accordance with Article 11 of the KVKK, the Data Owner has the following rights:

• Learning whether personal data is processed,
• Request information if Personal Data has been processed,
• Learning the purpose of processing personal data and whether they are used in accordance with their purpose,
• Knowing the third parties to whom Personal Data is transferred at home or abroad,
• Requesting correction of Personal Data if it is incompletely or incorrectly processed,
• Requesting the deletion or disposal of Personal Data in the event that the reasons for the processing of the Personal Data no longer exist,
• Requesting notification of corrections and deletions to third parties to whom Personal Data has been transferred,
• Objecting to a result against himself/herself obtained by analyzing the processed data exclusively through automated systems,
• Requesting indemnification in case of damage due to unlawful processing of Personal Data.

Requests from Data Owners to use one of the above rights will be finalized by Aktaş within 30 days at the latest. Data Owners may forward their requests to one of the following addresses in the specified methods;

Mailing address: Ovaakça Santral Mh. 9.Çalışkan Sk. No:1-1/A-1/B Osmangazi / BURSA / TURKEY

E-mail address:  bgys@aktasholding.com

Registered Electronic Mail (REM): aktashava@hs02.kep.tr

H. SECURITY OF PERSONAL DATA

Aktaş hereby attaches utmost importance to protecting the privacy and security of Personal Data. Accordingly, necessary technical and administrative security measures are taken to protect Personal Data against unauthorized access, damage, loss or disclosure. Necessary system access controls, data access controls, secure transfer controls, business continuity controls and other necessary institutional controls are applied.

R. Serkan AKTAŞ
Board Chairman