PDPL PRIVACY NOTICE

PROTECTION OF PERSONAL DATA

DISCLOSURE NOTICE PURSUANT TO LAW NO. 6698 ON THE PROTECTION OF PERSONAL DATA

a. Identity of the Data Controller and Its Representative, If Any;

This disclosure is made within the scope of Law No. 6698 on the Protection of Personal Data ("PDPL"), in order to fulfill the duty of disclosure of Şehir Otelcilik Yatırım Tic.Ltd.Şti., acting in the capacity of Data Controller, towards its business partners, shareholders, customers, and the natural or legal persons with whom it communicates.

b. Purposes for Which Personal Data Will Be Processed;

Your personal data may vary depending on the service, product, or commercial activity provided by our Company, and may be collected verbally, in writing, or electronically through automated or non-automated methods, including offices, branches, dealers, call centers, the website, social media channels, mobile applications, and similar means. Your personal data may be processed by being created and updated for as long as you benefit from our Company's products and services.

In addition, your personal data may be processed when you use our call center or our website with the intention of using the Company's services, when you visit our Company or our website, and when you attend training sessions, seminars, or organizations held by our Company.

The personal data collected will be processed for the purposes of carrying out the necessary work by our business units in order to enable you to benefit from the products and services offered by our Company; customizing the products and services offered by our Company in line with your preferences, usage habits, and needs and recommending them to you; ensuring the legal and commercial security of our Company and of the persons in a business relationship with our Company (including administrative operations relating to communications conducted by our Company, ensuring the physical security and supervision of Company premises, business partner/customer/supplier (authorized representatives or employees) evaluation processes, legal compliance, financial affairs, etc.); determining and implementing our Company's commercial and business strategies; and ensuring the execution of our Company's human resources policies, within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the PDPL.

c. To Whom and for What Purpose the Processed Personal Data May Be Transferred;

The personal data collected may be transferred to our business partners, suppliers, the companies of Şehir Otelcilik Yatırım Tic.Ltd.Şti., our shareholders, and to public institutions and private persons legally authorized to receive such data, for the purposes of carrying out the necessary work by our business units in order to enable you to benefit from the products and services offered by our Company; customizing the products and services offered by our Company in line with your preferences, usage habits, and needs and recommending them to you; ensuring the legal and commercial security of our Company and of the persons in a business relationship with our Company (including administrative operations relating to communications conducted by our Company, ensuring the physical security and supervision of Company premises, business partner/customer/supplier (authorized representatives or employees) evaluation processes, legal compliance, financial affairs, etc.); determining and implementing our Company's commercial and business strategies; and ensuring the execution of our Company's human resources policies, within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the PDPL.

ç. Method and Legal Basis of Collecting Personal Data;

Your personal data is obtained through any verbal, written, or electronic means, in line with the purposes set out above, for the purpose of enabling our Company to provide its products and services within the determined legal framework and to fulfill its contractual and statutory obligations completely and accurately. On this legal basis, your personal data collected may also be processed and transferred for the purposes specified in items (1) and (2) of this notice, within the scope of the personal data processing conditions and purposes set forth in Articles 5 and 6 of the PDPL.

d. Rights of the Data Subject;

Within the scope of the PDPL, you have the following rights regarding your personal data:

1. To learn whether your personal data is being processed,
2. To request information if your personal data has been processed,
3. To learn the purpose of processing personal data and whether the data is used for its intended purpose,
4. To know the third parties to whom personal data is transferred, domestically or abroad,
5. To request the correction of personal data in the event that it has been processed incompletely or inaccurately,
6. To request the deletion or destruction of personal data in the event that the reasons requiring its processing cease to exist,
7. To request that the correction or deletion of your information, if it has been transferred, be notified to the third parties to whom the personal data has been transferred,
8. To object to the occurrence of a result against yourself by analyzing the processed data exclusively through automated systems,
9. To request compensation for damages in the event that you suffer harm due to the unlawful processing of personal data.

In order to exercise the rights set out above, you may send your written request — together with the necessary information identifying you and your explanations regarding the right you wish to exercise — by wet-ink signature to the address "Muhsin Yazıcıoğlu Bulvarı, No:45 / 24 Serdivan, Sakarya", or by secure electronic signature to our registered electronic mail address info@roof264.com.

In your application for the exercise of the rights you hold as a data subject, the matter you request must be clear and understandable; the subject of your request must be related to you personally; if you are acting on behalf of someone else, you must be specifically authorized to do so and must document your authority; the application must contain your identity and address information, and documents verifying your identity must be attached to the application.

Applications made in this scope will be finalized as soon as possible and within a maximum of 30 days. Such applications are currently free of charge. However, if the process requires an additional cost, the fee determined by the Personal Data Protection Board may be charged.