Personal Data Protection

MCACHEM Metal ve Kimya Sanayi A.Ş. — Privacy Notice on the Processing of Personal Data

1. Data Controller and Contact Person

Pursuant to Law No. 6698 on the Protection of Personal Data (the “Law”), your personal data is processed by Mcachem Metal Kimya Sanayi A.Ş. (the “Company”) as the data controller, within the scope described below.

2. Methods and Legal Grounds for Collecting Personal Data

Your personal data is collected through the electronic form you fill in.

The personal data listed below is collected and processed primarily under Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed through Such Publications, Electronic Communications Law No. 5809 and the Regulation on Mass Internet Use Providers, within the scope of the obligation of mass use providers offering internet access in public areas to establish systems that identify their users:

The following personal data may be provided at your discretion and will be processed, based on your explicit consent, for the purposes set out in this Privacy Notice:

3. Purposes of Processing Personal Data

The personal data above may be processed for the purposes for which you disclosed it to the Company, listed below, in accordance with the processing conditions set out in Article 5 and, where necessary, Article 6 of the Law.

Personal data that must be processed under the legislation will be processed for the following purposes, in particular under Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed through Such Publications, Electronic Communications Law No. 5809 and the provisions of Turkish Penal Code No. 5237:

• Combating crime,
• Blocking access to content that constitutes a crime,
• Protecting families and children,
• Preventing crime and identifying offenders,
• Taking preventive measures against access to content that constitutes a crime,
• Ensuring the effectiveness of access blocking and filtering systems,
• Ensuring transaction security,
• Ensuring legal transaction security,
• Planning, managing, auditing and executing the recording and processing of access logs,
• Planning, managing, auditing and executing information security processes,
• Building, managing and protecting the information technology infrastructure,
• Managing traffic,
• Providing the internet service and establishing and managing the connection,
• Ensuring the legal, technical and commercial security of the Company,
• Detecting misuse, use beyond the intended purpose, unlawful use, irregularities and fraud,
• Ensuring that data is accurate and up to date,
• Cases where processing is necessary to fulfil our legal obligations,
• Applying and monitoring the conditions set out in the Internet Service User Agreement and taking the necessary actions.

Your optional personal data will be processed for the following purposes:

• Planning and carrying out market research for the sale and marketing of products and services,
• Planning and carrying out the processes needed to obtain the greatest benefit from the Company’s products and services,
• Planning and carrying out the marketing processes of products and/or services,
• Planning and/or carrying out customer satisfaction activities,
• Identifying and/or evaluating the persons to be targeted by marketing activities according to consumer behaviour criteria,
• Designing and/or carrying out personalised marketing and/or promotional activities,
• Designing and/or carrying out advertising, promotional and/or marketing activities in digital and/or other channels,
• Designing and/or carrying out activities for acquiring customers and/or creating value for existing customers in digital and/or other channels,
• Planning and/or carrying out data analytics for marketing purposes,
• Planning and/or carrying out campaign, promotion and/or advertising processes,
• Carrying out strategic planning activities,
• Planning and/or carrying out projects in line with strategic or corporate goals,
• Conducting statistical studies by the Company,
• Conducting analytical analyses and data studies.

4. Purposes of Transfer and Recipients of Processed Personal Data

The personal data collected may be transferred, solely for and limited to the purposes stated above, to our Company departments; to the internet service providers and solution partners that provide the infrastructure for the internet service; to our service providers; and to public institutions and organisations authorised by law to request information and documents, in particular the Information and Communication Technologies Authority, public prosecutors, law enforcement agencies, courts and the relevant judicial and administrative authorities, in accordance with the processing conditions set out in Articles 8 and 9 of the Law. The data may be processed within Türkiye.

5. Your Rights as a Data Subject

Under Article 11 of the Law, data subjects have the right to:

• Learn whether their personal data is processed,
• Request information if their personal data has been processed,
• Learn the purpose of processing and whether the data is used in accordance with that purpose,
• Know the third parties in Türkiye or abroad to whom their personal data is transferred,
• Request correction if their personal data is incomplete or inaccurate,
• Request the deletion or destruction of their personal data,
• Request that third parties to whom the data was transferred be notified of any correction, deletion or destruction,
• Object to any outcome against them arising from the analysis of processed data exclusively by automated systems,
• Claim compensation for damages arising from the unlawful processing of their personal data.

To exercise the rights above in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may contact us at[email protected], or fill in the “Application Form” available at www.mcachem.com and:

• Deliver it in person to ASO 2. ve 3. OSB, Eskişehir Yolu 42. Km, Alcı OSB Mah. 2013. Cad. No:28, 06930 Sincan / Ankara,
• Send it with a wet signature to the same address through a notary public,
• Send it to the Company’s registered electronic mail (KEP) address with a secure electronic or mobile signature, or via your registered email address or the email address registered in our system.

Your application must include your name and surname; your Turkish ID number if you are a Turkish citizen, or your nationality and passport or identity number if you are a foreign national; your residential or business address for notification; your email address for notification, if any; your telephone and fax numbers; and the subject of your request.

If your application is answered in writing, no fee is charged for up to ten pages. A processing fee of 1 Turkish lira may be charged for each page above ten. If the response is provided on a recording medium such as a CD or USB flash drive, the Company may ask you to cover the cost of the medium.