INFORMATION NOTICE ON THE PROTECTION OF PERSONAL DATA

The purpose of this information notice is to explain and inform you how and for what purposes we will process your personal data.

1. Data Controller

In accordance with the Turkish Personal Data Protection Law no. 6698 (“Law no. 6698”), Ceylan Mineral (Central Reg. System no. 0207053781500019) may in its capacity as the data controller process your personal for the purposes defined below, in such form as will be submitted to us by you, making sure to always use the latest version only. To learn more about the purposes for which our Company may process your personal data, please go to www.ceylanmineral.com/tr/ to read our PDP Policy.

2. Purpose of Personal Data Processing

Your collected personal data will be processed physically and electronically in line with the requirements of applicable legislation, within the framework of the personal data processing conditions and purposes specified in Articles 5 and 6 of Law No. 6698, for such reasons as are defined by law, and in particular for the purpose of fulfilling our legal and contractual obligations including without limitation:

1. Providing information to authorized institutions and organizations
2. Performance of business activities aimed at facilitating the functioning and development of our services
3. Execution of finance and accounting works
4. Ensuring and controlling physical space security
5. Conducting communication activities
6. Execution of customer relationship management processes
7. Coordination of emergency operations
8. Execution of goods/service purchase and sale processes
9. Execution of contract processes
10. Ensuring business continuity
11. Execution/follow-up of legal affairs and transactions
12. Management of request and complaint processes
13. Ensuring that the activities are carried out in accordance with company procedures and legal requirements

3. Personal Data Transfer to Third Parties

Your personal data processed for the purposes explained above can be transferred to third parties within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of Law No. 6698, to the extent such transfer is required for the purposes set out in our PDP Policy (www.ceylanmineral.com) and for fulfilling our legal obligations.

4. Method and Legal Grounds for Personal Data Collection

Your personal data is collected to fulfil our company's contractual and/or legal obligations and carry out our commercial activities, to the extent that such collection is explicitly foreseen by law and that it is carried out in line with applicable legislation and the “personal data processing conditions and purposes” stipulated by the Personal Data Protection Law. Accordingly, and based on the legal grounds explained above, your personal data is obtained and collected by our company by automated or non-automated means, whether it may be in verbal, written or electronical form, including without limitation camera recording systems, information shared via email correspondence, forms, petitions, on-site data, authorized institutions, internet access data, login data, and other similar channels or technologies.

Your personal data collected with the above methods and legal grounds can be processed and transferred to the extent it is required for the purposes set out in this Information Notice and for fulfilling our legal obligations, provided that such processing and transfer is in line with the personal data processing conditions and purposes specified in Articles 8 and 9 of Law No. 6698.

5. Rights of the Data Subject

As per Article 11 of the Law no. 6698, you have the right to contact our company at any time in accordance with the procedures defined in Article 6 of this Information Notice and

learn whether your personal data have been processed;

1. if yes, request information about it;
2. learn the purpose of data processing and whether the data is used for intended purposes;
3. get information about the third parties to whom your personal data is transferred in or outside the country;
4. request rectification of incomplete or inaccurate personal data (if any);
5. request deletion or destruction of your personal data after the reasons for processing your personal data have ceased;
6. if you have requested the rectification of incomplete or inaccurate personal data or the deletion or destruction of your personal data after the reasons for processing have ceased, request that such rectification, deletion or destruction is notified to the third parties to whom your personal data was transferred;
7. object to any outcome that results from your personal data being processed by automatic means exclusively, to the detriment of your person; and
8. request compensation for damage incurred due to the unlawful processing of your personal data.

6. Exercise of the Data Subject’s Rights

As provided for in the “Communiqué on the Procedures and Principles for Applications to the Data Controller”, data subjects can submit their requests regarding the exercise of their rights under Article 11 of the Law No. 6698 either in writing or by using a registered e-mail (KEP) address, secure electronic signature, mobile signature or an e-mail address previously notified to the data controller and registered in the data controller's system, or by using a software or application developed for this purpose, together with the relevant information and documents to be attached thereto.

Applications must contain the data subject’s name and surname, signature (if the application is made in writing), Turkish national ID for Turkish citizens, nationality and passport number or ID number (if any) for foreign citizens, place of residence or workplace address for notifications, e-mail address for notifications (if any), phone number, facsimile number and the subject matter of the request.

Applications made by registered letter with return receipt or through a notary public must be sent to: “Kızılırmak Mah. Dumlupınar Bulv. No:9A2 YDA Center Kat:7 D:230-231 Çankaya/Ankara”.

Ceylan Mineral will finalize your requests within the shortest time reasonably possible but no later than 30 (thirty) days depending on the nature of your request and in accordance with applicable legislation.

If your request is approved, Ceylan Mineral will take the necessary action in the shortest time possible and inform you of the outcome.