Schutz personenbezogener Daten

KÂR KATILIM ALTIN RAFİNERİSİ A.Ş.
INFORMATION NOTICE ON THE PROTECTION OF PERSONAL DATA

For customers, prospective customers, suppliers, business partners and authorized persons/representatives

1. Purpose and Scope

This Information Notice has been prepared pursuant to the Law No. 6698 on the Protection of Personal Data (the "Law") to inform natural persons who engage with the Company as customers, prospective customers, suppliers, business partners or parties to another commercial relationship, as well as the shareholders, directors, employee contact persons, representatives, authorized signatories and ultimate beneficial owners of corporate customers and suppliers, about the processing of their personal data.

Separate, process-specific information is provided at the time of collection for different processing activities involving employees, job applicants, interns, visitors to physical premises, CCTV recordings and access control. If an access control system processes biometric data, that activity is carried out under Article 6 of the Law, subject to obtaining the explicit consent of the relevant data subjects and in accordance with the principle of proportionality; the data are processed solely to ensure access security. If non-essential cookies or similar technologies are used on the website, a separate Cookie Information Notice and preference panel are provided.

2. Identity of the Data Controller

KÂR Katılım Altın Rafinerisi A.Ş., registered with the Istanbul Trade Registry under trade registry number 112700 and MERSIS number 0607094460400001 and having its registered office at Yarımburgaz Mah. 1. Cumhuriyet Cad. No: 50/1 Küçükçekmece/İstanbul, TÜRKİYE, is the data controller under the Law.

3. Categories of Personal Data Processed

1. Identity data: Full name and T.R. Identification Number; nationality and passport/identity number for foreign nationals; date of birth and signature data, only to the extent required by the relevant transaction and legislation.

2. Contact data: Telephone number, email address, and addresses for service of notices, billing, delivery and business premises.

3. Commercial transaction and operations data: Quotations, contracts, orders, precious metal purchases and sales, refining/assay, delivery, shipment, import-export, current account and customer service records.

4. Financial data: Bank/IBAN details and payment, collection, reconciliation, collateral, invoice and accounting records.

5. Legal transaction and representation data: Contracts, signature circulars/declarations, powers of attorney, representation and authorization documents, commercial correspondence, notices, litigation and dispute records.

6. Transaction security data: IP address, session, access, authentication and log records, together with records relating to information security and the prevention of fraud and misuse.

7. Risk, compliance and supply chain data: Customer/supplier due diligence, ultimate beneficial ownership, sanctions, politically exposed person and adverse media information, the source/origin of precious metals, and transaction and supply chain risk assessments and review results.

8. Request, complaint and application data: Applications, suggestions, requests, complaints, ethics reports and message content, together with related processing records.

9. Marketing data: Commercial electronic communication preferences and consent records, solely where the relevant consents have been obtained.

A corporate entity's trade name, corporate tax number and similar purely corporate information do not constitute personal data on their own. Such information falls within the scope of this Notice only to the extent that it can be associated with an individual trader or an identified or identifiable natural person.

4. Purposes of Processing and Legal Bases

Personal data may be processed for the following purposes and on the legal bases set out in Article 5 of the Law:

Processing based on explicit consent is conducted separately from the information process. Explicit consent is not made a condition and may be withdrawn where it is not necessary for entering into a contract or providing a service.

5. Methods and Sources of Personal Data Collection

1. Directly from the data subject through the website, contact and application forms, email, telephone, physical forms, face-to-face meetings, contracts, orders, invoices, bank records, and assay/refining, delivery, shipment and import-export records;

2. From corporate customers, suppliers, service providers and business partners and their authorized persons and representatives;

3. From trade registry records, competent public authorities, regulatory bodies, publicly available sources permitted by law and KYC/compliance screening service providers used by the Company;

4. By wholly or partly automated means, or by non-automated means provided that the processing forms part of a data filing system.

Where personal data are not obtained directly from the data subject, information appropriate to the specific process is provided no later than one month after obtaining the data, at the time of the first communication with the data subject, or before the data are first transferred.

6. Transfer of Personal Data

Personal data may be transferred, solely for the purposes stated above, to competent public institutions and bodies, banks and financial institutions, independent audit firms, legal and financial advisers, business partners, suppliers and service providers in accordance with the conditions set out in Articles 8 and 9 of the Law, in particular to countries announced by the Board as providing an adequate level of protection or by using standard contract/undertaking mechanisms.

7. Retention and Disposal

Personal data are retained for the period necessary for the purpose of processing and for the minimum retention periods prescribed by applicable legislation. Where more than one ground for retention exists, the legal ground requiring the longer period applies. Once all processing conditions cease to exist, the data are erased, destroyed or anonymized during the first periodic disposal process specified in the Company's Personal Data Retention and Disposal Policy, which in any event will occur within six months. Data subject to a statutory retention requirement are processed during the relevant period only to the extent necessary to comply with the retention obligation and protect legal rights.

8. Ethics and Whistleblowing Reports

Reports submitted to [email protected] may involve the processing of identity, contact, employment/business relationship, incident and evidence data relating to the reporting person and the persons concerned by the report. The data are processed under Article 5(2)(ç), (e) and, provided that fundamental rights are not prejudiced, (f) of the Law for the purposes of receiving and reviewing the report, communicating with the parties, carrying out corrective/preventive measures, complying with legal obligations and protecting rights.

Special categories of personal data are not requested unless necessary and should not be included in a report. Where their processing is mandatory, it is based on an applicable processing condition under Article 6 of the Law (explicit consent or circumstances prescribed by law) and carried out subject to the adequate safeguards prescribed by the Board.

9. Rights of the Data Subject

Under Article 11 of the Law, you have the following rights:

1. To learn whether your personal data are processed,

2. To request information if your personal data have been processed,

3. To learn the purpose of processing your personal data and whether they are used in accordance with that purpose,

4. To know the third parties in Türkiye or abroad to whom your personal data have been transferred,

5. To request rectification if your personal data have been processed incompletely or inaccurately,

6. To request the erasure or destruction of your personal data under the conditions set out in Article 7 of the Law,

7. To request notification of any rectification, erasure or destruction to third parties to whom your personal data have been transferred,

8. To object to a result arising against you as a consequence of analysing the processed data exclusively through automated systems,

9. To request compensation if you suffer damage due to the unlawful processing of personal data.

10. Application to the Data Controller

In accordance with the Communiqué on the Principles and Procedures for Requests to the Data Controller, you may submit requests concerning your rights by means of a written application bearing a wet-ink signature to Yarımburgaz Mah. 1. Cumhuriyet Cad. No: 50/1 Küçükçekmece/İstanbul, TÜRKİYE; to the KEP address [email protected] using a secure electronic signature or mobile signature; or to kvkk@karkatilimaltinrafinerisi.com from the email address previously notified to the Company and registered in its records.

The application must state the applicant's full name; signature for written applications; T.R. Identification Number for Turkish citizens; nationality, passport number or identity number, if any, for foreign nationals; address for service of notices; email address, telephone and fax number, if any; and the subject of the request. Applications are concluded as soon as possible according to the nature of the request and no later than thirty days. Where the process entails an additional cost, the fee schedule determined by the Board may apply.

11. Data Security, Updates and Effectiveness

The Company implements technical and organizational measures appropriate to the nature of the processing activity to prevent unlawful processing of and access to personal data and to ensure their protection. This Notice is updated before the relevant processing activity where there is a change in the purposes, data sources, recipient groups, information systems or legislation.