CLARIFICATION TEXT ABOUT THE PROCESSING OF PERSONAL DATA

As Onduline Avrasya İnşaat Malzemeleri Sanayi ve Ticaret Anonim Şirketi (“Onduline” or “Company”), we attach utmost importance to the security of your personal data. In order to follow up this understanding, we engrain in our employees that all kinds of personal data are processed in accordance with the Law on the Protection of Personal Data no. 6698 (“KVKK”). We process your personal data in the way explained below and within the limits set by legislation with the full acknowledgement of this responsibility and as the "Data Controller" as defined by KVKK.

1- Processing Aims of your Personal Data

Your personal data submitted by you via e-mail is solely processed by our Company within the subject provided by you in the respective e-mail.

2- Transferring of your Personal Data

Provided that you have given your explicit consent, our Company transfers your personal data to third parties and with the aim to have them stored in Microsoft’s e-mail server in the abroad.

3- Method of Collection of your Personal Data and Legal Basis

Your personal data are automatically and manually collected and processed via the e-mails you sent to our company based on the legal reasons in Article 5/2 of KVKK, provided we have your explicit consent as per Articles 5/1 and 6/2 of KVKK.

4- Rights of Data Owner as per Article 11 of KVKK

As the owner of personal data, we hereby inform you that you have the rights listed below as per Article 11 of KVKK:

• To learn if your personal data are being processed or not,
• Request information if your personal data are processed,
• To learn why your personal data are processed and to learn whether your data are processed in accordance with the main goal behind processing,
• To learn about the domestic or international third parties who receive your personal data,
• To ask for the correction of your personal data if they are processed wrong and/or inadequately, and to ask this correction to be notified to the third parties who have previously received your personal data,
• To ask that your data are deleted or erased in case the reasons requiring the processing disappear, even if they were processed according to the law and concerned legislation, and ask that the third parties who have previously received your data do the same,
• To object if any results against the data owner are produced by the analysis of personal data exclusively via automated systems,
• To ask that any losses and damages are indemnified if the data owner sustains any losses and damages because of illegal processing of personal data.

You may submit your applications about your aforementioned rights in accordance with the provisions of “Application to Data Controller and Notification about its Basis (“Notification”)” via e-mail to [email protected] with identifying documents or deliver these documents by hand at our registered office, or via notary public or with any other procedures given on the Notification, or by submitting the concerned form to [email protected] with a secure electronic signature. Your request and your application will be concluded as soon as possible and latest within 30 (thirty) days free of charge. However, if the operations require further expenses, you may be charged a fee as per the tariff declared by the Board of the Protection of Personal Data.