Under Law No. 6698 on the Protection of Personal Data

NANOBİZ TEKNOLOJİ A.Ş.

Pursuant to Law No. 6698 on the Protection of Personal Data, published in the Official Gazette on 07.04.2016 (hereinafter referred to as the "KVKK" or the "Law"), we, NANOBİZ TEKNOLOJİ A.Ş. ("the Company"), as the Data Controller, are under an obligation to inform you about the collection, processing, use, transfer to third parties and destruction of the personal data communicated to us verbally, in writing or electronically.

PURPOSES OF PROCESSING OF PERSONAL DATA COMMUNICATED TO US:

Within the framework of Articles 4, 5 and 6 of the KVKK, your personal data will be processed for the following purposes:

Creating the books and records required to be kept under the Labor Law and social security legislation, and evaluating job applications;

Monitoring finance and accounting affairs;

Providing the goods and services offered by our Company to you, sales and marketing, providing after-sales services, and monitoring the quality of goods and services;

Preparing and performing contracts and their annexes;

Monitoring legal processes;

Ensuring the security of employees and customers at the workplace;

Planning, auditing and carrying out information security processes;

Establishing and managing information technology infrastructure;

Planning and carrying out commercial transactions and activities;

Determining and implementing commercial and business strategies;

Fulfilling our obligations arising from contracts and laws.

PERSONAL DATA THAT MAY BE PROCESSED:

Identity Data

First and last names of individuals; trade names of legal entities; Republic of Türkiye identification numbers provided for the issuance of invoices; MERSIS and tax identification numbers.

Contact Data

Telephone number, full address, e-mail address, and internal company contact details (extension number, corporate e-mail address).

Financial Data

Bank account numbers communicated to us.

OUR PRINCIPLES IN PROCESSING PERSONAL DATA:

When processing your personal data, we act in accordance with the following principles:

Compliance with the law and the rules of good faith;

Being accurate and, where necessary, up to date;

Being processed for specified, explicit and legitimate purposes;

Being relevant, limited and proportionate to the purposes for which they are processed;

Being retained for the period stipulated in the relevant legislation or required for the purpose for which they are processed.

Our Company carries out audits to ensure that processing complies with these principles. Our Company takes all necessary measures with due care regarding the security of the personal data processed.

CONDITIONS AND DURATION OF PROCESSING OF PERSONAL DATA:

Personal data cannot be processed without the explicit consent of the data subject. Personal data may be processed without the explicit consent of the data subject where one of the following conditions exists:

It is expressly provided for by law;

It is necessary for the protection of the life or physical integrity of the data subject or of another person, where the data subject is unable to give consent due to actual impossibility or whose consent is not legally valid;

Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of that contract;

It is necessary for the data controller to comply with a legal obligation;

The data has been made public by the data subject;

Data processing is necessary for the establishment, exercise or protection of a right;

Processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Provided that they are not used outside the conditions stated above and the purposes and scope set out in this privacy notice, personal data may be processed with all necessary information security measures in place. They will be retained for the statutory retention period or for as long as the purpose of processing requires, and will be deleted, destroyed or anonymized in accordance with the KVKK, the Regulation on the Deletion, Destruction or Anonymization of Personal Data, and other applicable legislation.

SHARING OF PERSONAL DATA WITH THIRD PARTIES:

Our Company may transfer your personal data to the persons and institutions listed below, taking the necessary measures within the framework of the security and confidentiality principles set out in the KVKK, and only on the following grounds: the explicit consent of the data subject; the transfer being expressly provided for by law, particularly the legislation to which we are subject; the transfer being necessary for the conclusion or performance of a contract; the transfer being mandatory for the fulfillment of a legal obligation; or the transfer being required by a legitimate interest.

The recipients are our direct or indirect, domestic or foreign affiliates; natural and legal persons with whom we have contractual relations due to our activities; suppliers; subcontractors; business partners; shareholders; legal, financial and tax advisors; auditors and audit firms; and public institutions and organizations authorized by law to request such data. Transfers may be made to such recipients, and to other relevant persons or institutions, for the purpose of conducting the Company's activities, within the framework of the personal data processing conditions and purposes set out in Articles 8 and 9 of the KVKK and in accordance with the conditions stipulated in the KVKK.

YOUR RIGHTS UNDER THE LAW REGARDING YOUR PERSONAL DATA:

The rights of the data subject are set out in Article 11 of the Law. Data subjects exercise these rights by applying to the data controller. Accordingly, the rights of the data subject are as follows:

To learn whether personal data has been processed;

To request information if personal data has been processed;

To learn the purpose of processing and whether the data is used in accordance with that purpose;

To know the third parties, domestic or abroad, to whom personal data has been transferred;

To request correction of personal data if it is incomplete or inaccurately processed;

To request deletion or destruction of personal data;

To request that the operations of correction, deletion or destruction be notified to third parties to whom the personal data has been transferred;

To object to the occurrence of a result against the data subject by means of the analysis of the processed data exclusively through automated systems;

To request compensation for damages in case of loss arising from the unlawful processing of personal data.

Your requests in this regard may be submitted in writing, or by using a registered electronic mail (KEP) address, a secure electronic signature, a mobile signature, or an e-mail address previously notified to us. To do so, you may apply in person at our Company's head office, send your application through a notary public, or apply by e-mail, using an application form containing your explanations regarding the right you wish to exercise, together with: your name and surname, signature, Republic of Türkiye identification number (or, for foreign nationals, nationality and passport number or identification number, if any), your residence or workplace address for notification purposes, your e-mail address for notification purposes (if any), and your telephone or fax number.

Your application will be concluded free of charge as soon as possible and within thirty (30) days at the latest. However, if the processing of your request requires an additional cost, we reserve the right to charge the fee set out in the tariff determined by the Personal Data Protection Board.

DATA CONTROLLER AND CONTACT INFORMATION

NANOBİZ TEKNOLOJİ A.Ş.

ADDRESS                  :

METU Technopolis Gallium Block No: 27 / B14
Cankaya / ANKARA / TURKEY

TELEPHONE             :

+90 444 NANO (62 66)
+90 534 762 NANO (62 66)
+90 312 210 18 71

FAX                     :

+90 312 210 1872

E-MAİL                 :

kvkbilgi@nanobiz.com.tr

KEP ADDRESS        :

nanobiztek@hs01.kep.tr

*This English text is provided for information purposes only. In the event of any discrepancy between the Turkish and English versions, the Turkish version shall prevail.