Personal Data Protection Disclosure Statement “NAKOSAN NAKIŞ KONFEKSİYON TEKSTİL SAN. VE TİC. A.Ş.” takes the highest possible security measures to ensure the lawful collection, storage, and sharing of your personal data and to protect your privacy. Our aim is to inform you in the most transparent way possible, in accordance with Article 10 of the Law No. 6698 on the Protection of Personal Data and in line with your satisfaction, about the methods of obtaining your personal data, the purposes of processing, the persons with whom it is shared, the legal reasons, and your rights. a) Data Controller In accordance with the Law No. 6698 on the Protection of Personal Data (“Law No. 6698”), your personal data may be collected and processed by “NAKOSAN NAKIŞ KONFEKSİYON TEKSTİL SAN. VE TİC. A.Ş.” (“COMPANY”) as the data controller, within the scope explained below. b) Your Processed Personal Data;

1- Identity;

1. Personal Data:

Name, Surname, Mother's and Father's Names, Mother's Maiden Name, Date of Birth, Place of Birth, Marital Status, National Identity Card Serial Number, Turkish Republic Identity Number, etc.

2. Communication:

Address number, Email address, Contact address, Registered Electronic Mail Address (KEP), Phone number, etc.

3. Customer Transactions:

Call center records, Invoice, promissory note, check information, Information on cashier receipts, Order information, Request information, etc.

4. Marketing: Shopping history information, Surveys, Cookie records, Information obtained through campaign work, etc. c) Purposes for Which Personal Data Will Be Processed:

Your personal data will be processed by the COMPANY for the following purposes:  Our business units will carry out the necessary work to enable you to benefit from the products and services offered by our company,  Recommending the products and services offered by our company to you,  Planning and/or executing market research activities for the sales and marketing of products and services,  Organizing and supervising all your activities such as installation, assembly and disassembly related to the products and services offered by our company,  Planning and/or executing after-sales support services activities,  Following up on contract processes and/or legal matters and requests,  Ensuring the legal, technical and commercial security of relevant persons in the business relationship,  Contacting you if you request information or a product demo from our company,  Fulfilling the sales or service contract if you purchase a product or service,

 Planning, monitoring and executing information security processes,  Creating and managing the information technology infrastructure,  Following up on finance and/or accounting matters and products and services within this scope Your personal data will be processed for the following purposes:  Issuing invoices and carrying out the collection processes for fees,  Recording and fulfilling requests you direct,  Planning and executing company activities,  Contacting you via SMS, e-mail and telephone within the scope of contract performance,  Planning and executing corporate communication activities,  Planning and executing logistics activities,  Determining and implementing the commercial and business strategies of our company, within the legal grounds specified in Article 5 (2) of the KVKK: “a) Explicitly provided for in the laws”, “c) The processing of personal data belonging to the parties of a contract is necessary, provided that it is directly related to the establishment or performance of a contract”, “d) It is necessary for the data controller to fulfill its legal obligations”, “e) Data processing is necessary for the establishment, exercise or protection of a right”, “f) Data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”. d) To Whom and for What Purpose the Processed Personal Data May Be Transferred Your personal data will be transferred without the explicit consent of the data subject, in accordance with Article 8 (2) (a) of the KVKK, for the purposes stated below:  For the purpose of carrying out financial and/or accounting operations within the scope of collecting fees for products and services, it may be transferred to notaries, enforcement offices and/or courts, if necessary; to call centers, process support and related operational services in the field of follow-up and collection services.  It may be shared with our lawyers as much as necessary within the framework of confidentiality obligations in order to follow legal processes.  It may be shared with relevant public institutions and organizations, if necessary or upon request, in order to fulfill legal obligations in accordance with the relevant legislation.  It may be shared with authorized service providers in order to fulfill assembly and disassembly requests within the scope of contract performance. – To individuals or organizations permitted by the Tax Procedure Law, Social Security Institution legislation, Court of Accounts, Law on the Prevention of Money Laundering, Turkish Commercial Code, Law of Obligations and other legislation,  Legally authorized public institutions and organizations, administrative authorities and legal authorities, e) Personal and Method and Legal Basis for Data Collection Your personal data is obtained through automated or non-automated methods, verbally, in writing or electronically, based on the legal grounds specified in Article 5 (2) of the KVKK (Personal Data Protection Law) in order to fulfill the purposes stated in paragraph (b) of this text:  Filling out forms by the data subject, sending e-mail messages, contacting via telephone call, visiting the website/filling out forms and contacting via social media platforms.  Sharing business cards during fair or seminar visits, establishing a communication network in training and event activities, and transmission through solution or business partner institutions or organizations.  Transmission by you and/or our dealers, authorized service representatives verbally, in writing or electronically.  Recording of telephone conversations conducted with the call center. f) Rights of the Personal Data Subject as Listed in Article 11 of Law No. 6698 As personal data subjects, if you submit your requests regarding your rights using the methods described below, the COMPANY will process your request as soon as possible and within thirty days at the latest, depending on the nature of the request. No fee will be charged for responses up to ten pages. A processing fee of 1 Turkish Lira will be charged for each page exceeding ten pages. If the response to the application is provided on a recording medium such as a CD or flash drive, the fee that may be requested by our company will not exceed the cost of the recording medium. In this context, personal data subjects have the following rights: Individuals have the right to:  Learn whether their personal data is being processed;  Request information regarding the processing of their personal data if it has been processed;  Learn the purpose of the processing of their personal data and whether it is being used in accordance with that purpose;  Know the third parties to whom their personal data has been transferred, domestically or internationally;  Request the correction of their personal data if it is incomplete or inaccurate, and request that this correction be notified to the third parties to whom their personal data has been transferred;  Request the deletion or destruction of their personal data if the reasons requiring its processing have ceased to exist, even if it has been processed in accordance with Law No. 6698 and other relevant laws, and request that this action be notified to the third parties to whom their personal data has been transferred;  Object to a result that is detrimental to them arising from the analysis of their processed data exclusively through automated systems;  Demand compensation for damages incurred as a result of the unlawful processing of their personal data. You can submit your request regarding the exercise of your rights mentioned above in Turkish, in writing, or via registered electronic mail (KEP) address, secure electronic signature, mobile signature, or using the electronic mail address previously notified to the COMPANY and registered in our system, in accordance with Article 13, paragraph 1 of Law No. 6698 and the Communiqué No. 30356 dated 10.03.2018 on the Procedures and Principles for Applications to the Data Controller. Only information about the applicant will be provided in the applications; it will not be possible to obtain information about other family members or third parties. The COMPANY reserves the right to verify your identity before responding. In your application, please include: a) Your name, surname, and signature if the application is in writing,

b) For Turkish citizens, your Turkish Republic Identity Number (T.C. Kimlik No.). Your application must include: a) your nationality (or nationality if you are a foreigner), b) your residential or business address for notification purposes, c) your email address, telephone and fax number (if applicable) for notification purposes, d) the subject of your request. Any relevant information and documents should also be attached to the application. You can submit your written application, along with the necessary documents, to our Company, the data controller, at the following address: Akçeşme Mah. Bozburun_1 Cad. No:6 Merkezefendi / DENİZLİ. You can access the application form here. Depending on the nature of your request, you must provide us with complete and accurate information and documents that will enable identity verification. Failure to provide the requested information and documents properly may hinder the COMPANY's ability to conduct thorough and effective investigations based on your request. In this case, the COMPANY reserves its legal rights. Therefore, your application must be submitted completely and include all the requested information and documents, according to the nature of your request.