GENERAL DISCLOSURE STATEMENT ON THE PROCESSING OF PERSONAL DATA

This General Disclosure Statement on the Processing of Personal Data has been prepared in accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK”), published in the Official Gazette dated 07.04.2016 and numbered 29677; the Regulation on Personal Health Data published in the Official Gazette dated 21.06.2019 and numbered 30808; the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform published in the Official Gazette dated 10.03.2018 and numbered 30356; and other applicable legislation.

As NOKSEL Çelik Boru Sanayi Anonim Şirketi (“Company” or “NOKSEL”), acting in the capacity of Data Controller, we may process your personal data within the limits set forth under the KVKK and for the purposes specified therein. In accordance with Article 10 of the KVKK, our Company fulfills its legal obligation to inform you about our personal data processing activities.

1. Data Controller and Representative

Pursuant to the KVKK, NOKSEL, as the data controller, may process your personal data in connection with the purposes described below, in a limited and proportionate manner, in compliance with the law and the principles of honesty, and in an accurate and up-to-date manner.

Your personal data may be recorded, stored, classified, updated, and, where required or permitted by legislation and/or limited to the purpose for which they are processed, disclosed or transferred to third parties.

2. Purpose of Processing Personal Data

Personal data such as your name, surname, e-mail address, and phone number shared through the contact form available on https://www.noksel.com/ and via the phone number provided on the same website, as well as any customer transaction data that may be included in the message content if shared, are processed in accordance with the fundamental principles set out in the KVKK.

Such personal data are processed for the following purposes:

• Receiving and fulfilling requests of current or potential customers
• Conducting customer relationship management processes
• Carrying out customer satisfaction activities
• Following up requests and complaints
• Conducting strategic planning activities
• Managing product/service loyalty processes

Personal data are processed based on the following legal grounds:

• Article 5/2(c): Processing is necessary for the establishment or performance of a contract
• Article 5/2(ç): Processing is necessary for the data controller to fulfill its legal obligations
• Article 5/2(f): Processing is necessary for the legitimate interests of the data controller

Processing of personal data for the purpose of sending commercial electronic communications is carried out only where explicit consent is obtained in accordance with the relevant legislation.

Personal data are securely stored in electronic environments, limited to the stated purposes and for the retention periods prescribed by applicable legislation.

While filling out application, offer, information request, and contact forms on the Company’s website, special categories of personal data must not be shared. Sensitive personal data such as religion, race, or health information unrelated to the subject of communication should not be transmitted.

3. Transfer of Personal Data

Personal data processed within the scope of this disclosure statement may be transferred in accordance with Articles 8 and 9 of the KVKK.

Personal data provided through the contact form are processed for:

• Receiving and responding to applications
• Conducting service processes
• Ensuring the operation and security of information systems

Within this scope, personal data may be transferred to information technology service providers and authorized public institutions and organizations based on legal obligation and legitimate interest.

Contact information related to commercial electronic communications is processed upon consent and shared with the relevant authorities for registration with the Message Management System (İYS) in accordance with Law No. 6563.

If servers used within the website infrastructure are located abroad, personal data may be transferred abroad upon obtaining explicit consent.

Personal data may also be disclosed to authorized public institutions and professional advisors under confidentiality obligations for the purposes of fulfilling legal obligations and protecting legal rights.

NOKSEL takes appropriate technical and administrative measures to ensure the confidentiality and security of personal data.

4. Method of Collection and Legal Basis

Your personal data are collected electronically through the Company’s website for the purposes specified in this disclosure statement.

Personal data are processed in accordance with Article 4/2 of the KVKK and, where necessary, based on explicit consent or the legal grounds set out in Article 5/2, particularly legal obligation and legitimate interest.

NOKSEL complies with applicable legislation and may update its practices in line with legislative changes.

5. Rights of the Data Subject under Article 11 of the KVKK

You may submit your requests regarding your rights, together with documents verifying your identity, to the following address:

Yukarı Öveçler Mah. Lizbon Cad. No:10
Çankaya / Ankara, Türkiye

You may also send your request via e-mail to: noksel@noksel.com.tr

Requests will be concluded free of charge within thirty (30) days unless additional costs arise as determined by the Personal Data Protection Board.

Under Article 11 of the KVKK, you have the right to:

• Learn whether your personal data are processed
• Request information regarding processed data
• Learn the purpose of processing and whether data are used accordingly
• Learn third parties to whom data are transferred
• Request correction of inaccurate data
• Request deletion or destruction where legal grounds cease to exist
• Object to automated decision-making outcomes
• Request compensation for unlawful processing