PRIVACY AND PERSONAL DATA DISCLOSURE

INFORMATION TEXT ON THE PROTECTION OF PERSONAL DATA

Scope

As Organik Kimya, we care about the security of your personal data. With this awareness, we place the utmost importance on the storage of all personal data of all all our customers, suppliers and business partners in accordance with Law No. 6698 on the Protection of Personal Data ("Law").

Organik Group would like to inform its employees with regards the following in order to fulfil its obligation under the Law as the Data Controller.

1) Purposes of Processing Personal Data and Methods of Data Collection

Organik Kimya processes personal data for the following purposes:

• Execution of Emergency Management Processes

• Execution of Information Security Processes

• Conducting Audit / Ethical Activities

• Conducting Activities in Compliance with the Legislation

• Execution of Finance and Accounting Affairs

• Ensuring Physical Location Security

• Following and Execution of Legal Affairs

• Conducting Occupational Health / Safety Activities

• Receiving and Evaluating Suggestions for the Improvement of Business Processes

• Execution of Goods / Service Purchase Processes

• Execution of Goods / Service After Sales Support Services

• Execution of Goods / Service Sales Processes

• Carrying out Activities relating to Customer Satisfaction

• Carrying out Marketing Analysis Studies

• Execution of Risk Management Processes

• Execution of Contract Processes

• Monitoring of Requests / Complaints

• Controlling Entry and Exit to Facilities

• Execution of Supply Chain Management Processes

• Ensuring the Security of Data Controller Operations

• Informing Authorized Persons, Institutions and Organizations when necessary

• Creating and Monitoring Visitor Records

Your personal data is collected by Organik Kimya by automatic or non-automatic methods verbally, in writing or electronically. The personal data in question will be processed by taking all necessary information security measures and will be stored and preserved by transferring them to physical archives and information systems during the legal storage period or as required by the processing purpose. The relevant personal data will be destroyed, destroyed or anonymized by Organik Kimya at the end of the period required by the purpose of processing.

2) Persons to whom Personal Data are Transferred and Transfer Purposes

Personal data processed by Organik Kimya may be shared with the following third parties for the purpose of conducting operational processes, and with necessary security measures:

• To auditors and the third parties providing consultancy services when necessary pursuant to our duties under applicable tax and social security legislation and other relevant laws

• Legally authorized government institutions,

• Facility security units and contractors,

• Persons whom you have provided your explicit consent for us to transfer your personal data to,

• Auditors and consultants, provided this is limited to the purpose of transferring

• With our affiliates and group companies

During the transfer of data to third parties, all necessary technical and administrative security measures are taken to prevent any violation of your rights by Organik Kimya, and we ensure that any third parties to whom your data is transferred also store your data in compliance with the law.

3) Method and Legal Basis of Data Processing

Your personal data can be processed by the Company for the purposes specified above and on the following legal bases set out in the Law:

• Data processing is provided for in legislation,

• Processing of data belonging to parties to a contract provided processing is necessary for the establishment or performance of such contract,

• Processing is necessary to fulfil our legal obligations (especially with respect to our commercial and administrative activities in order to fulfil our obligations arising from applicable trade, business, tax and social security legislation).

• Data processing mandatory for the establishment, use or protection of a right

• Data processing is mandatory for our legitimate interests, provided this does not violate rights and fundamental freedoms of data subjects

• In cases where it is impossible for a person to provide his/her consent, or their consent is not legally valid, processing is mandatory for the protection of that person or someone else's life or bodily integrity. (e.g. you are unable to give consent during an accident / emergency that may occur during your visit to our facilities)

• Processing of personal data disclosed by the data owner to the public (processing of the contact information shared on the web pages of the customer / supplier / business partner for the purpose of establishing / conducting a commercial relationship)

• Processing necessary for the data controller to fulfil its legal obligation (data shared with public institutions in accordance with tax and customs legislation)

These data can be submitted to Organik Kimya both verbally and in writing, and can be obtained from official and institutional organizations within the scope of company activities. The data in question is kept in physically secure areas, as well as in digital systems which are protected and any security measures are taken.

4) Rights of the Data Subject

Within the scope of the law, you have the following rights as the data subject:

• Learning whether your personal data is processed,

• If your personal data has been processed, to request information regarding this,

• Learning the purpose of processing personal data and whether they are used appropriately for their purpose,

• Knowing the third parties in the country or abroad to whom your personal data has been transferred,

• To request correction of your personal data if it is incomplete or incorrectly processed, and to request notification of the transaction made within this scope to third parties to whom personal data are transferred

• To request the deletion or destruction of your personal data in the event that the reasons requiring its processing disappear, despite the fact that it has been processed in accordance with the provisions of the law and other relevant laws, and to request the third parties to whom your personal data is transferred to

• Objection to the emergence of a result against you by analyzing your processed data exclusively through automated systems,

• Request compensation in case you suffer damage due to unlawful processing of your personal data.

Requests to learn more about the compliance and policies of Organik Kimya regarding the law and other applicable legislation and the exercise of the rights mentioned above should be submitted to the Risk Management and Compliance department in writing.

For the application; below details need to be included:

• Full name

• Signature if the application is in writing

• For the citizens of the Republic of Turkey T.C. identification number, nationality for foreigners, passport number or identification number,

• Notification address (residence or business address)

• E-mail address, telephone and fax number for notification,

• Demand

In addition, information and documents related to the demand must be attached to the application.

4) Information and Inquiries

You may contact us to get more detailed information about Organik Kimya Personal Data Protection Law and to consult the compliance of the applications with the rules and standards.

Contact Person : Murat Turaman, Chief Compliance Officer

Tel : +90 212 331 00 00 Ext: 108

Fax : +90 212 331 00 01

E-Mail :

m_turaman@organikkimya.com

compliance@organikkimya.com