PERSONAL DATA PROTECTION AND PROCESSING DISCLOSURE NOTICE

1. Identity of the Data Controller

In accordance with the Turkish Personal Data Protection Law No. 6698, your personal data is processed by Netzr Teknoloji A.Ş. in its capacity as data controller. Headquarters address: Muallim Mah. Deniz Cad. No:143/6, Bilişim Vadisi, Gebze/Kocaeli, Turkey. Manufacturing facility address: Acısu Mah., Vatan Cad., No:26/1, 41080 Kartepe/Kocaeli, Turkey. Our Company operates in the field of EV energy systems (battery packs, electronic boards, power distribution units) and acts in compliance with KVKK and relevant legislation provisions in the processing of personal data.

2. Categories of Personal Data Processed

The following categories of your personal data may be processed by our Company, depending on the nature of our activities and the type of our relationship:

• Identity Information: Name, surname, Turkish national ID number, date and place of birth, nationality, signature, copies of ID card/driver's license/passport, and similar identifying information.
• Contact Information: Email address, telephone number (landline/mobile), address information (residential/business), fax number, and information relating to other communication channels.
• Professional Information: Company name, position/title, department, employment history, curriculum vitae (CV), diploma and certificate information, reference information.
• Digital Data: IP address, cookie data, browser type and version, operating system information, website visit data, click and browsing data, session durations, device identifiers.
• Financial Information: Bank account number (IBAN), invoice information, tax identification number, payment and collection information within the scope of commercial relationships.
• Visual and Audio Data: Photographs, security camera (CCTV) recordings, meeting and event recordings (with explicit consent).

3. Purposes of Processing Personal Data

Your collected personal data is processed in accordance with the personal data processing conditions specified in Articles 5 and 6 of the KVKK for the following purposes:

• Provision, development, quality control, and improvement of customer satisfaction for the products and services offered by our Company.
• Evaluation, response, and follow-up of requests, complaints, suggestions, and information inquiries; conducting customer relationship management processes.
• Fulfillment of legal and regulatory obligations arising from applicable legislation; responding to requests from official institutions and organizations.
• Ensuring the physical security of our Company premises; planning, conducting, and auditing information security processes.
• Conducting human resources processes; evaluating job applications, carrying out recruitment processes, managing interns and employee candidates.
• Planning and conducting marketing, promotion, and advertising activities; providing campaign, promotion, and event notifications (with explicit consent).
• Executing contractual processes, establishing and managing commercial relationships, operating supply chain management processes.
• Conducting analysis and reporting activities for the improvement of business processes; carrying out statistical studies.

4. Legal Grounds for Processing Personal Data

Your personal data is processed based on the following legal grounds specified in Article 5, paragraph 2 and Article 6, paragraph 3 of the KVKK:

• Explicit Consent: The existence of your explicit consent for the processing of your personal data (KVKK Art. 5/1). Explicit consent is obtained particularly for marketing activities, newsletter distribution, and profiling.
• Establishment or Performance of a Contract: Where the processing of your personal data is necessary, provided that it is directly related to the establishment or performance of a contract concluded with you (KVKK Art. 5/2-c).
• Legal Obligation: Where processing is mandatory for our Company to fulfill its legal obligations (KVKK Art. 5/2-ç). Obligations arising from tax legislation, labor law, commercial law, and other legal regulations fall within this scope.
• Legitimate Interest: Where data processing is mandatory for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the data subject (KVKK Art. 5/2-f).
• Vital Interest: Where processing is necessary for the protection of life or physical integrity of a person who is unable to express consent due to physical impossibility or whose consent is not legally valid (KVKK Art. 5/2-e).
• Publicly Available Data: Processing of personal data that has been made public by the data subject themselves (KVKK Art. 5/2-d).

5. Transfer of Personal Data

Your collected personal data may be transferred to the following parties in accordance with the purposes stated above and in compliance with Articles 8 and 9 of the KVKK:

• Public Institutions and Organizations: To competent public institutions and organizations as required by legal obligations (Personal Data Protection Authority, tax offices, Social Security Institution, courts, law enforcement agencies, etc.).
• Service Providers: To third parties from whom we receive services for the conduct of our business processes (IT services, accounting, legal consultancy, logistics, cloud service providers, etc.).
• Group Companies: To our Company's subsidiaries and business partners for the purpose of conducting joint business processes.
• International Transfer: To our business partners and service providers abroad, within the framework of the conditions specified in Article 9 of the KVKK (to countries with adequate protection with your explicit consent, or to countries without adequate protection through written undertakings).
• Cloud Service Providers: To domestic and/or international cloud computing service providers for data storage, backup, and business continuity purposes.

6. Personal Data Retention Periods

Your personal data is retained for the duration required by the processing purpose and taking into account the statute of limitations periods prescribed in the relevant legislation. When the processing purpose ceases to exist or when the retention period prescribed in the legislation expires, your personal data is deleted, destroyed, or anonymized in accordance with Article 7 of the KVKK and the Regulation on the Deletion, Destruction, or Anonymization of Personal Data. General retention periods are specified below:

• Employee Data: 10 years from the termination of the employment relationship within the framework of legal obligations (Labor Law, Social Security legislation, Turkish Code of Obligations statute of limitations periods).
• Customer and Supplier Data: 10 years from the termination of the commercial relationship (Turkish Commercial Code, Tax Procedure Law retention obligations).
• Job Candidate Data: 2 years from the date of application (this period may be extended with the explicit consent of the applicant).
• Website Usage Data: Traffic data for 2 years pursuant to Law No. 5651; other usage data for 1 year.
• Cookie Data: Session cookies are deleted when the browser is closed; persistent cookies are retained for a maximum of 2 years depending on the type of cookie.

7. Cookie Policy

Various cookies are used on our Company's website (netzr.tech). Cookies are small text files placed on your device for the purpose of ensuring the proper functioning of the website, improving user experience, and analyzing site traffic. The types of cookies used are described below:

• Essential Cookies: Cookies that are necessary for the basic functions of the website to operate. The site cannot function properly without these cookies. Used for session management, security, and accessibility purposes. Legal basis: Legitimate interest.
• Analytics Cookies: Cookies that help us understand how visitors use the site. They collect statistical data such as page view counts, visitor sources, and on-site browsing behavior. Legal basis: Explicit consent.
• Functional Cookies: Cookies that remember user preferences (such as language selection, region preference) and offer enhanced features. Legal basis: Explicit consent.
• Marketing Cookies: Cookies used to display advertisements relevant to visitors' interests. They may be placed by third-party advertising networks. Legal basis: Explicit consent.

8. Automated Decision-Making Processes

Our Company does not make decisions that would produce legal effects against you exclusively through the automated processing of your personal data. The analytics tools and cookies used on our website are solely utilized for statistical analysis and the improvement of service quality, and this data is not used in any individual decision-making process. In the event that automated decision-making mechanisms are employed in the future, the right of data subjects to object pursuant to Article 11, paragraph 1, subparagraph (g) of the KVKK is reserved.

9. Data Processing Inventory

Our Company has fulfilled its registration obligation with the Data Controllers Registry Information System (VERBİS) pursuant to Article 16 of the KVKK and the Regulation on the Data Controllers Registry. Our data processing inventory includes the purposes of personal data processing, data categories, recipient groups, data subject groups, maximum retention periods necessary for the purposes for which personal data is processed, personal data envisaged for transfer to foreign countries, and measures taken regarding data security. For detailed information regarding our data processing inventory, you may contact us at kvkk@netzrglobal.com.

10. Your Rights as a Data Subject

Pursuant to Article 11 of the KVKK, you have the following rights in relation to the processing of your personal data:

• To learn whether your personal data is being processed.
• To request information if your personal data has been processed.
• To learn the purpose of processing your personal data and whether they are used in accordance with their purpose.
• To know the third parties to whom your personal data is transferred, domestically or abroad.
• To request the correction of your personal data if it has been processed incompletely or incorrectly.
• To request the deletion or destruction of your personal data within the framework of conditions set forth in Article 7 of the KVKK.
• To request that correction, deletion, and destruction operations be notified to third parties to whom your personal data has been transferred.
• To object to any result that arises against you through the exclusive analysis of processed data via automated systems.
• To request compensation for damages if your personal data has been processed unlawfully.

11. Application Method and Contact

To exercise your rights stated above, you may submit your request in writing together with documents verifying your identity, or through other methods determined by the Personal Data Protection Board. Application methods: (a) Written Application — To the address Muallim Mah. Deniz Cad. No:143/6, Bilişim Vadisi, Gebze/Kocaeli via notary public, registered mail with return receipt, or in person; (b) Email — To kvkk@netzrglobal.com via registered electronic mail (KEP) address, secure electronic signature, or mobile signature; (c) Through your email address previously notified to and registered in our system. Your applications will be concluded free of charge as soon as possible and within thirty (30) days at the latest, depending on the nature of the request. If the process requires an additional cost, the fee determined by the Personal Data Protection Board may be charged.

12. Data Security Measures

Our Company takes all necessary technical and administrative measures to ensure an appropriate level of security pursuant to Article 12 of the KVKK, in order to prevent the unlawful processing of your personal data, prevent unlawful access to data, and ensure the preservation of data:

• Technical Measures: Firewalls, intrusion detection and prevention systems, anti-virus software, data encryption, access control mechanisms, network security management, regular security tests and vulnerability scans, log management and monitoring, backup and disaster recovery plans.
• Administrative Measures: Personal data security training for employees, confidentiality agreements, establishment of data processing policies and procedures, limitation and regular audit of access authorizations, maintaining up-to-date data processing inventory, data security agreements with third-party service providers.
• Physical Measures: Physical access control to data processing areas, security camera systems, fire suppression and climate control systems, visitor registration and tracking systems, use of locked cabinets and safes.

13. Changes to the Disclosure Notice

Our Company reserves the right to update this Disclosure Notice in line with changes in legal regulations, decisions of the Personal Data Protection Board, and company policies. Updates will be published on our website (netzr.tech) and will enter into force upon publication. In the event of significant changes, you will be informed through your registered communication channels. We recommend that you follow the current version of the Disclosure Notice on our website.