In accordance with Article 10 of the Personal Data Protection Law No. 6698 (“KVKK/PDPL”), this notice is provided to inform you about how OZ CONSULTING SERVICES LTD. STI. (As the data controller) processes your personal data. This includes the purposes for which your personal data is collected, the methods used, and your rights under the law.

1. Data Controller and Protection Officer

In line with the Personal Data Protection Law, OZ Consultancy Services, acting as the data controller, has the authority to handle, log, retain, categorize, revişe and share or transmit your personal information to third parties. This will be conducted within the boundaries allowed by legislation and for the objectives outlined below, adhering to legal requirements and principles of fairness.

2. The Purposes of Processing Your Personal Data

The information we gather about you can differ based on the services, products or business activities offered by OZ Consultancy Services. This data may be processed, recorded, stored, categorized, updated and shared or sent to third parties, following the guidelines established by the Personal Data Protection Law. This can occur automatically or manually through our offices, exam centers, call center, website, mobile apps or similar channels, for the purposes outlined below and within the legal limits.

Your Personal Datas;

• Activities resulting in legal, technical and administrative consequences and the fulfillment of the obligations arising from these activities,
• Enhancing the quality of our company’s service offerings and refining our quality policy,
• Keeping you informed and allowing you to take advantage of our company’s general and special campaigns, promotions, advertising, discounts and similar benefits
• Providing information regarding certification services offered by our company (including surveillance, renewal, and cancellation), facilitating any communication with you and notifying you of new services, products and any changes or updates to our personal data policies and terms of service,
• Performing required quality and compliance audits and meeting legal and regulatory obligations,
• Strategy, planning and managing partnerships and suppliers,
• Outsourcing services to suppliers to support the company’s business operations.
• Managing customer-facing processes and operations (such as creating quotes, contracts, and executing plans)
• Managing financial relationships with customers, suppliers, and other parties (including opening accounts receivable, verifying tax information, and processing invoices).
• Carrying out other internal and external company operations.
• The company reserves the right to monitor and control all company vehicles and equipment provided to employees, both during and outside of working hours.
• Using biometric data to track employee attendance as part of the employer’s management rights.
• Maintaining occupational, general, and building safety.
• Recording internet usage data as required by the law on the regulation of online publications.
• When you use our services, we may collect and process your personal information, including your preferences and browsing history, to provide you with the services you request.
• To fulfill other legal obligations.
• We may process your personal data to manage our human resources and to comply with legal requirements. Your data may be shared with our affiliates. (In Article 5 of the Law within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the Personal Data Protection Law)

For detailed information on how your personal data is processed by our company, please visit www.ozdanismanlik.com.tr and access the “Öz Danışmanlık Hizmetleri Personal Data Protection, Storage, and Deletion Policy.”

PDP-INF-01 REV.00 19.09.2019 PAGE 1/5

3. Your Personal Data May be Shared With:

Your personal data may be transferred to the following recipients, including but not limited to; public institutions such as the Vocational Qualifications Authority, the Turkish Accreditation Agency, and relevant ministries; law firms providing legal consultancy services; audit firms; OZ Consulting Services’ business partners, shareholders, service providers and existing or future subsidiaries; companies providing support services for our operations and independent audit firms, for the purposes specified in Article 2 and in accordance with the fundamental principles stipulated in the Personal Data Protection Law (PDPL) and the personal data processing conditions and purposes specified in Articles 8 and 9 of the PDPL.

4. Data Transfer Abroad

OZ Consulting Services does not transfer personal data abroad. However, your personal data may be transferred to individuals and organizations located in foreign countries that have been determined by the Personal Data Protection Authority (“Authority”) to have adequate safeguards, in accordance with Article 9 of the Law and subject to your explicit consent in accordance with the principles stipulated in Article 4(2) of the KVKK, or in the absence of explicit consent if the conditions specified in Articles 5(2) and 6(3) are met. For transfers to countries that have been determined and announced by the Authority as not having adequate safeguards, the transfer shall be limited to cases where the data controllers in Türkiye and the relevant foreign country provide a written undertaking that adequate safeguards are in place and the Authority’s permission has been obtained for the relevant transfer, in accordance with the Standard Contractual Clauses for the Transfer of Personal Data to Third Countries (KVK-AYD-01 Rev.00, dated 19.09.2019).

5. Data Collection Methods and Legal Justifications

Your personal data may be collected by verbal, written, visual, or electronic means for the purposes specified above and for legal reasons arising from the law, including the Personal Data Protection Law No. 6698, and contractual obligations. Additionally, when you:

1. a) contact our call center or visit our website;
2. b) visit our offices or social media pages;
3. c) participate in our events or training;
4. d) receive our audit services.
5. Processing of Sensitive Personal Data:

Under the Personal Data Protection Law, certain types of personal data, such as those related to your race, religion, health, or genetic information, are considered sensitive. Our company takes extra precautions when handling this sensitive data and will only do so with your explicit consent and when it is necessary to provide you with our services.

7. Your Rights Under Article 11 of The Personal Data Protection Law

As a data subject, you may submit your requests regarding your rights by filling out the Data Subject Application Form on our website, www.ozdanismanlik.com.tr and sending it to Yıldız Posta St. Akın Buildings 1st Block No:14 Beşiktaş/İstanbul / TÜRKİYE. Öz Danışmanlık Hizmetleri will finalize your request as soon as possible and no later than thirty (30) days, depending on the nature of the request, free of charge. However, if the process requires additional costs, we will charge the fee determined by the Authority.

PDP-INF-01 Rev.00, 19.09.2019 Page 3 / 5

Pursuant to Article 11 of the Personal Data Protection Law, you have the following rights:

• a) To learn whether your personal data is processed or not,
• b) To request information if your personal data has been processed,
• c) To learn the purpose of processing personal data and whether such data is used in accordance with its purpose,  
• d) To learn the third parties to whom personal data is transferred domestically or abroad,
• e) To request the rectification of incomplete or inaccurate personal data and to request that the notification of the rectification be made to the third parties to which the personal data has been transferred,
• f) To request the deletion or destruction of personal data or conversion into anonymous form within the framework of the conditions stipulated in Article 7 of the Personal Data Protection Law and to request that the notification of the operation be made to the third parties to which the personal data has been transferred,
• g) To object to the emergence of a result against you by analyzing the processed data exclusively by automated systems,
• h) To demand compensation for the damages if you are damaged due to the unlawful processing of personal data.

However, individuals have no rights regarding anonymized data within the company. Our company may share personal data with relevant institutions and organizations due to the employment and contractual relationship, a judicial duty or for the purpose of using the legal authority of a government authority.

8. For How Long Will Your Personal Data be Processed

As outlined in this Privacy Notice we will process your personal data in compliance with the Personal Data Protection Law. Once the reason for processing your data as defined in Article 7/f.1 of the Law no longer exists or when the legal retention periods expire we will delete, destroy, or anonymize your personal data.

9. Situations in Which Your Company May Process Your Personal Data Without Your Explicit Consent as Required by Law:

Pursuant to Article 5 of the Personal Data Protection Law our Company may process your personal data, which has been obtained in accordance with the law without seeking your explicit consent in the following cases:

Cases explicitly stipulated by law;

• a. Where you as the data subject are unable to express your consent due to physical impossibility or your consent is not legally valid and it is necessary to process your personal data to protect your life or bodily integrity or that of another person;
• b. Directly related to the establishment or performance of a contract that our company and its affiliated companies/institutions have entered into with other real and/or legal persons specified in Article (3), provided that it is necessary to process the personal data of the parties to the contract;
• c. Where it is necessary for our company to fulfill a legal obligation;
• d. Where your personal data has been made public by you;
• e. Where it is necessary to process data for the establishment, exercise or protection of a right.
• f. Where it is necessary for the processing of data for the legitimate interests pursued by our Company provided that the processing does not infringe upon your fundamental rights and freedoms.

PDP-INF-01 REV.00, 19.09.2019 PAGE 4/5

10 – The Data Controller to Whom You Can Apply Within the Scope of the PDPL

Pursuant to the first paragraph of Article 13 of the Personal Data Protection Law, you may submit your request to exercise the aforementioned rights to our Company using the method(s) determined or to be determined by the Personal Data Protection Board. Alternatively, if you wish, you may submit your application to our Company in writing in accordance with the Personal Data Protection Law. To do this, please first fill out and sign the Data Subject Application Form on www.ozdanismanlik.com.tr. Detailed information regarding the use and submission of the form is included in the form itself. Please note that rights related to personal data can only be exercised by the individuals themselves. Requests regarding the data of persons other than the person who fills out the form and attaches official documents proving their identity will not be considered. We would like to inform you that even if data deletion requests are fulfilled, we are obliged to share the data with official authorities if requested by them.

Data Controller Contact Information:

OZ CONSULTING SERVICES TRADE LIMITED COMPANY

Yıldız Posta St. No:6 Akın Building No:14 Gayrettepe, Beşiktaş, İstanbul 34349 TÜRKİYE

Phone Number: (0212) 356 36 86 Fax: (0212) 356 36 88 www.ozdanismanlik.com.tr

Note: Our company reserves the right to update this “Personal Data Processing and Protection Information Text” at any time in accordance with any amendments that may be made to the applicable legislation.

PDP-INF-01 REV.00, 19.09.2019 PAGE 5/5

WHY SHOULD YOU CHOOSE US?

Our diligence and solution-oriented mindset make us unique.

As OZ Consultancy Services we work to create new opportunities for our clients and create new plans to achieve success. We progress by closely following current laws and regulations. We lead in reaching your goal and walk with you every step of your journey.

Our Journey

Our journey began in 1995 in the electrical sector and has since expanded to include automotive, medical, machinery manufacturing and defense industries. With a network of over 5,000 companies we have grown our presence both domestically and internationally establishing ourselves as a global enterprise.

Reach Your Goal With Us

The business world is changing at an unprecedented pace. To stay ahead, you need an agile partner who can help you drive forward. We explore every opportunity to prepare you for tomorrow. We are confident in our ability to deliver exceptional service and unparalleled regional expertise.

SERVICE STAGES

Our collaborative approach ensures that your goals are met promptly and effectively. With our expert guidance you can achieve 100% success.

Programme Planning

To ensure your project is completed promptly and efficiently we establish clear timelines, deliverables and expectations. We work closely with your team to coordinate efforts and closely monitor progress. We also conduct a thorough documentation and facility assessment to identify any deficiencies and provide recommendations to ensure your next audit is successful.

Programme Applying

We are working to make sure all your paperwork is in order and meets the necessary requirements. We are creating a plan to keep your project on track. We will provide training to help you pass any future audits or inspections. If anything goes wrong before your process is approved, we’ll be there to help you fix it.

Consultancy

We deeply understand the challenges our clients face because we have an in-depth knowledge of the industries we serve. Our consultants possess a powerful combination of business advisory skills and partner with you to deliver actionable recommendations that drive results. We conduct both in-person and online meetings as needed.