PRIVACY AND PERSONAL DATA DISCLOSURE

Organik Kimya processes personal data for: • Emergency Management Processes • Information Security Processes • Audit / Ethics Activities • Activities in Compliance with the Legislation • Financial and Accounting Affairs • Physical Security • Legal Affairs • Occupational Health / Safety Activities • Improving Business Processes • Goods / Services Purchasing Processes • Goods / Services After Sales Support Services • Goods / Services Sales Processes • Activities for Customer Satisfaction • Marketing Analysis Studies • Risk Management Processes • Contract Processes • Requests / Complaints • Keeping the Facility Entry and Exit under Control • Supply Chain Management Processes • Security of Data Responsible Operations • Giving Information to Authorized Persons, Institutions and Organizations • Creation and Tracking of Visitor Records Personal data are collected in verbally, writing or electronically by Organik Kimya either automatically or non-automatically. The relevant personal data will be processed by taking all necessary information security measures, and will be stored and retained by transferring them to physical archives and information systems during the legal retention or as required by the processing purpose. The relevant personal data will be harmed, destroyed or anonymized by Organik Kimya after the time required by the processing purpose.

Personal data processed by Organik Kimya may be shared with the following third parties for the purpose of conducting operational processes, and with necessary security measures: • Taxation, social security legislations and related legislation within the scope of our obligations, to auditors and the third parties providing consultancy services • Legally authorized government institutions, • Facility security units and contractors, • All persons with your open consent for transfer of personal data, • With auditors and consultants authorised properly, • With our affiliates and group companies During the transfer of data to third parties, all necessary security measures are taken to prevent violations of rights.

Organik Kimya processes personal data with following method and reasoning: • Obtaining explicit consent, provided that it is based on information, on a particular subject and disclosed with free will. • Provision of allowance for data processing in legislation • Necessary personal data for meeting contractual obligations, provided that it is necessary for the establishment, and performance of the contracts • Personal data compulsory to fulfill our legal obligations (especially for our commercial and administrative activities in order to fulfill our obligations arising from the current trade, business, taxation and social security legislation). • Data processing mandatory for the establishment, use or protection of a legitimate right • Data processing is mandatory for legitimate interests, provided that it does not harm rights and fundamental freedoms of any. • In cases where the person is unable to explain his/her consent due to actual impossibility or whose consent is is mandatory for the protection of himself or someone else's life or bodily integrity. • Personal data being publicized by the data owner • Data supervisor fulfills its legal obligation These data can be submitted to Organik Kimya both verbally and in writing, and can be obtained from official and institutional organizations within the scope of company activities. The data in question is kept in physically secure areas, as well as in digital systems which are protected and any security measures are taken.

Under the law, the following rights have been granted: • Being informed whether personal data is processed, • Being informedif personal data has been processed, • Being informed about the purpose of processing personal data and whether they are used in accordance with this purpose, • To know the third parties to whom personal data are transferred, local or international, • Correction of personal data if it is incomplete or incorrectly processed, and notification of the this to relevant third parties to whom personal data has been transferred, • The deletion or destruction of personal data in case the basis of its processing disappear even if it has been processed in accordance with the lawand the notification of this to relevant third parties to whom the personal data has been transferred, • To object to the emergence of an outcome resulting from analysis of the processed data through automated systems, • Request remedy of the damage suffered due to illegal processing of personal data. Requests to learn more about the compliance and policies of Organik Kimya regarding the law and other applicable legislation and the exercise of the rights mentioned above should be submitted to the Risk Management and Compliance department in writing. For the application; below details need to be included: • Full name • Signature if the application is in writing • For the citizens of the Republic of Turkey T.C. identification number, nationality for foreigners, passport number or identification number, • Notification address (residence or business address) • E-mail address, telephone and fax number for notification, • Demand In addition, information and documents related to the demand must be attached to the application.

You may contact us to get more detailed information about Organik Kimya Personal Data Protection Law and to consult the compliance of the applications with the rules and standards. Contact Person : Murat Turaman, Chief Compliance Officer Tel : +90 212 331 00 00 Ext: 108 Fax : +90 212 331 00 01 E-Mail : m_turaman@organikkimya.com compliance@organikkimya.com