PROMSONN TEKNOLOJİ MUHENDISLIK SAN. TIC. LTD. STI. INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA

1. Data Controller

Pursuant to the Law No. 6698 on the Protection of Personal Data (“KVKK”), your personal data may be processed, in the capacity of data controller, by;

Trade Name: PROMSONN TEKNOLOJİ MUHENDISLIK SAN. TIC. LTD. STI.
Head Office Address: Fethiye OSB Pembe Cad. No:3 Nilüfer / Bursa / Türkiye
Telephone: +90 224 502 1 502
E-mail: info[at]promsonn.com

Here in after referred to as “Promsonn” or the “Company”, within the scope explained below.

This Information Notice has been prepared for the purpose of informing our customers, prospective customers, suppliers, subcontractors, business partners, company representatives and employees, visitors, website users and other persons who communicate with our Company for any reason.

2. Personal Data Processed

Depending on the nature of the relationship established with Promsonn, the following categories of personal data may be processed:

Identity information

Name, surname, title, position, signature, Republic of Türkiye identity number, date of birth and, where necessary, other information contained in the identity document.

Contact information

Telephone number, e-mail address, business address, residential or notification address and communication records.

Customer and supplier transaction information

Quotations, orders, contracts, purchase and sales records, shipment information, technical specifications, sample and project records, customer complaints, quality records, audit information, meeting notes and commercial correspondence.

Financial information

Bank account and IBAN information, payment and collection information, current account records, invoice information, cheque and promissory note records, and information relating to accounting and financial transactions.

Professional information

Company of employment, position and title, department, professional qualification, education, certificate and authorization information.

Legal transaction and compliance information

Contracts, notices, litigation and enforcement files, correspondence with official institutions, legal claims, audit records and information maintained within the scope of regulatory compliance.

Physical premises security information

Entry and exit records for Company facilities, visitor records, vehicle licence plate information and security camera footage.

Security cameras are used solely for the purposes of ensuring security, implementing occupational health and safety measures, protecting Company assets and providing evidence in potential legal disputes. Camera recording is not carried out in areas where it may violate the privacy of private life.

Transaction security information

IP address, website access records, system user information, date-time records, log records and data relating to the security of information systems.

Visual and audio records

Security camera footage, online or physical meeting records, and photographs, video and audio recordings obtained on condition that the relevant person is informed or, where necessary, explicit consent is obtained.

Special categories of personal data

To the extent necessary within the scope of our activities, health information, occupational health and safety records, disability information, and information relating to criminal convictions and security measures may be processed.

Special categories of personal data are processed only where the conditions specified in Article 6 of the KVKK are met, limited to the purpose, and with the necessary technical and administrative security measures in place.

3. Purposes of Processing Personal Data

Your personal data may be processed for the following purposes:

• Carrying out quotation, order, sales, purchasing and contract processes,
• Managing relationships with customers, suppliers, subcontractors and business partners,
• Carrying out plastic injection, moulding, coating, assembly and automotive parts manufacturing processes,
• Carrying out project planning, product development, sampling, testing, production and shipment activities,
• Fulfilling customer-specific requests and quality and technical requirements,
• Carrying out RFQ, APQP, PPAP, change management, traceability and serial production processes,
• Fulfilling the requirements of IATF 16949, ISO 9001, ISO 14001, ISO 45001 and relevant management systems,
• Carrying out product safety, quality control, failure analysis, corrective and preventive activities,
• Conducting customer and certification body audits,
• Carrying out finance, accounting, invoicing, payment and collection transactions,
• Managing logistics, warehousing, customs clearance, export and import processes,
• Ensuring the security of Company facilities, employees, visitors, information systems and commercial assets,
• Controlling visitor entries and exits,
• Carrying out request, suggestion, complaint and customer satisfaction processes,
• Ensuring business continuity and operational activities,
• Carrying out internal control, audit, reporting and risk management activities,
• Fulfilling legal obligations,
• Responding to requests from authorized public institutions and organizations,
• Managing legal disputes and protecting the rights of the Company,
• Carrying out information security processes,
• Fulfilling retention, archiving and document management obligations,
• Carrying out product, service, promotional and commercial communication activities where the relevant person has given communication permission or the necessary legal conditions are met.

Your personal data are processed in a manner that is connected with, limited to and proportionate to the stated purposes.

4. Legal Grounds for the Processing of Personal Data

Your personal data are processed on the basis of the following legal grounds set out in Article 5 and, where necessary, Article 6 of the KVKK:

• It is expressly provided for by law,
• It is directly related to the establishment or performance of a contract,
• It is necessary for the data controller to fulfil its legal obligation,
• Processing is necessary for the establishment, exercise or protection of a right,
• Processing is necessary for the legitimate interests of Promsonn, provided that it does not prejudice the fundamental rights and freedoms of the relevant person,
• The personal data have been made public by the relevant person,
• It is necessary for the protection of the life or physical integrity of the person himself/herself or another person, where the person is unable to express consent due to actual impossibility,
• For special categories of personal data, one of the processing conditions specified in Article 6 of the KVKK is present,
• For activities where the above legal grounds do not exist, the explicit consent of the relevant person is obtained.

Acceptance of the Information Notice does not, by itself, mean that explicit consent has been given. For activities requiring explicit consent, consent is requested separately and explicitly.

5. Methods of Collecting Personal Data

Your personal data may be collected by the following automatic, partially automatic or non-automatic methods, provided that the latter form part of a data recording system:

• Contracts, quotations, orders and invoices,
• E-mail, telephone, post and other communication channels,
• The Company website and online contact forms,
• Face-to-face or online meetings,
• Customer and supplier portals,
• ERP, accounting, quality and document management systems,
• Visitor registration forms and security cameras,
• Trade fairs, meetings, audits and commercial events,
• Authorized public institutions and private organizations,
• Customers, suppliers, logistics companies and other business partners,
• Documents and information provided directly by the relevant person.

6. Transfer of Personal Data

Your personal data may be shared with the following persons and organizations where the transfer is necessary and the conditions stipulated by the legislation are met:

• Customers, suppliers, subcontractors and business partners,
• Group companies and affiliates,
• Transportation, logistics, customs clearance and warehousing service providers,
• Banks, financial institutions, insurance companies and payment service providers,
• Financial advisors, independent auditors, lawyers, consultants and certification bodies,
• Information technology, software, server, cloud, archiving and technical support service providers,
• Occupational health and safety organizations and authorized healthcare institutions,
• Notaries public, courts, enforcement offices, law enforcement units and other authorized public institutions,
• Tax offices, the Social Security Institution, ministries and other relevant official authorities,
• Other real and legal persons authorized by law to obtain information.

Transfers are carried out only to the extent required by the relevant service or transaction and with the necessary security measures applied.

7. Transfer of Personal Data Abroad

Within the scope of export, project, quality, quotation and contract processes carried out with Promsonn’s foreign customers, suppliers and business partners, it may be necessary to transfer your personal data abroad.

In addition, due to the use of e-mail, cloud computing, data storage, remote meeting, customer portal or international software services, data may be processed in the systems of service providers located abroad.

The transfer of data abroad is carried out on the basis of the applicable legal transfer methods, such as the presence of one of the conditions set out in Article 9 of the KVKK, the existence of an adequacy decision or the provision of appropriate safeguards. Where necessary, the explicit consent of the relevant person is also obtained separately.

8. Retention Period of Personal Data

Your personal data;

• The period required by the relevant processing purpose,
• The period during which the contract or commercial relationship between the parties continues,
• The statutory retention periods prescribed by the relevant legislation,
• Limitation periods and forfeiture periods,
• The period necessary for the conclusion of potential legal disputes

are retained for the periods specified above.

Where the reasons for processing cease to exist and there is no other legal obligation requiring the retention of the data, personal data are deleted, destroyed or anonymized in accordance with Promsonn’s retention and destruction procedures.

9. Security of Personal Data

Promsonn, with regard to personal data;

• Preventing the unlawful processing of personal data,
• Preventing unlawful access to personal data,
• Ensuring that personal data are stored securely

takes appropriate technical and administrative security measures for these purposes.

Within this scope, access authorization, user and password management, network security, backup, logging, physical security, confidentiality undertakings, personnel awareness activities, supplier controls and other necessary security practices are carried out.

10. Rights of the Relevant Person

Within the scope of Article 11 of the KVKK, everyone, by applying to the data controller, with respect to himself/herself:

1. Learn whether personal data relating to him/her are processed,
2. Request information if his/her personal data have been processed,
3. Learn the purpose of processing personal data and whether they are used in accordance with their purpose,
4. Know the third parties to whom personal data are transferred domestically or abroad,
5. Request correction of personal data if they have been processed incompletely or incorrectly,
6. Request the deletion or destruction of personal data within the framework of the conditions set out in Article 7 of the KVKK,
7. Request that correction, deletion or destruction operations be notified to third parties to whom personal data have been transferred,
8. Object to the occurrence of a result against the person himself/herself arising from the analysis of the processed data exclusively through automated systems,
9. Request compensation for damages in the event of suffering damage due to the unlawful processing of personal data

has the rights listed above.

11. Method of Application to the Data Controller

You may submit your requests under the KVKK to Promsonn by one of the following methods:

• In person together with documents verifying your identity,
• Through a notary public,
• By registered mail with return receipt,
• Using a secure electronic signature or mobile signature,
• Via your e-mail address previously notified to our Company and registered in our system,
• Via a registered electronic mail (KEP) address.

Application address:Fethiye OSB Pembe Cad. No:3 Nilüfer / Bursa / Türkiye
E-mail:info[at]promsonn.com

The application must include the following information:

• Name and surname,
• Signature if the application is in writing,
• Republic of Türkiye identity number for citizens of the Republic of Türkiye; for foreigners, nationality, passport number or identity number, if any,
• Address for notification,
• E-mail address, telephone and fax number for notification, if any,
• Subject of the request,
• Information and documents supporting the request.

Applications are concluded free of charge as soon as possible depending on the nature of the request and no later than 30 days. If the transaction requires an additional cost, the fee specified in the tariff determined by the Personal Data Protection Board may be charged.

If the application is made on behalf of another person, a power of attorney or authorization document showing that the applicant is specifically authorized in this regard must be submitted.

12. Entry into Force and Updating of the Notice

Promsonn may update this Information Notice in line with changes in legislation, decisions of the Personal Data Protection Board or changes in personal data processing activities.

The current version of the Notice is published on the Company website or made available by other methods suitable for access by the relevant persons.

Effective date: 27.08.2025
PROMSONN TEKNOLOJİ MUHENDISLIK SAN. TIC. LTD. STI.