INFORMATION TEXT WITHIN THE SCOPE OF THE LAW ON THE PROTECTION OF PERSONAL DATA NO. 6698

A. Purpose and Scope of the Privacy Notice

Texylon Teknoloji Anonim Şirketi (“Texylon”), residing at the address in Istanbul/Turkey, registered with the Istanbul Trade Registry Directorate under Trade Registry Number ----- and MERSIS Number ----, and registered with the ----- Tax Office under Tax Identification Number -----, places great importance on the processing and storage of your personal data in accordance with the Law on the Protection of Personal Data No. 6698 (“Law”), and we ensure the security of your personal data with utmost sensitivity.

In terms of the personal data we process within the scope of the Law, we hold the status of “data controller” towards you, in other words, the data subjects whose personal data are processed. In this regard, with this privacy notice, we would like to inform you, your employees, about our purposes, methods of collecting and processing personal data, and your rights arising from the Law.

This privacy notice has been prepared in accordance with Article 10 of the Law, titled “Informing Obligation of the Data Controller,” for the purpose of informing you in the most transparent manner regarding our identity as the data controller, the method and legal basis of collecting your personal data, the purpose for which this data will be processed, to whom and for what purpose it can be transferred, the duration of data processing, and what your rights are specified in Article 11 of the Law. The explanations made for your personal data in this privacy notice also cover your special categories of personal data.

Texylon provides a SaaS (Software as a Service) product service operating under a B2B model, enabling digital management of Human Resources processes with a modular structure. Within Texylon’s services, facts and information regarding employees of companies registered in the system, such as Identification and Personal Info, address details, IBAN details, -----, seniority details, position details, ect., representing all information regarding human resources processes specified in Article C of this privacy notice, are contained as personal data. Therefore, as Texylon, within the scope specified in Article 10 of the Law on the Protection of Personal Data No. 6698, we aim to inform you regarding how we process personal data due to the digital service concerning Human Resources processes offered to business owners. We attach importance to the security and protection of the personal data you share with Texylon. Texylon is a 'Data Controller' as defined in the Law. In this context, we process your personal data in accordance with the Law and take appropriate, proportionate, and sufficient administrative and technical measures for the protection of your personal data. The obligation to inform other personal data owners, such as your Employees, Suppliers, and Customers whose data are processed by you, as member companies of the system which are distinct 'data controllers', namely the business owners, that their data are also processed by us, remains under your responsibility. As the data controller, we fulfill our obligations arising from the legislation and the Board decisions by taking administrative measures and technical measures at an appropriate and proportionate level.

B. Method and Legal Basis for Collecting Your Personal Data

Your personal data may be collected through automatic and non-automatic methods, provided that they are part of a data filing system, via computers and computer programs, computer software and virtual storage spaces, internet-connected services, and physical and digital forms and petitions. Your personal data may be processed by being generated and updated as long as your relationship with Texylon continues, and will be preserved in physical and/or digital environments. Your personal data listed below are processed by Texylon within the scope of paragraph 2 of Article 5 of the Law, based on the legal grounds of: “a) Being clearly prescribed by law, c) Being necessary to process personal data of the parties of a contract, provided that it is directly related to the establishment or performance of the contract”:

The processing purposes of your personal data are as follows:

• - Execution / Securing Supervision of Business Activities,

• - Execution of necessary activities by our relevant business units to ensure that real and/or legal third parties, institutions, and organizations (customers, employees, visitors, suppliers, business partners, etc.) in a relationship with Texylon can benefit from the products and services of our company and/or our affiliated headquarters and units,

• - Conducting Activities in Accordance with the Legislation,

• - Conducting Activities for Ensuring Business Continuity,

• - Execution of Goods / Services Procurement Processes,

• - Follow-up and Execution of Legal Affairs,

• - Execution of Contractual Processes,

• - Execution of Finance, Human Resources Processes, and Accounting Affairs,

• - Providing information to necessary persons and institutions,

• - Conducting audit and/or regulatory duties by authorized and competent public institutions and organizations and professional organizations having the status of public institutions,

• - Fulfilling requests for information and documents requested by judicial authorities and/or administrative authorities,

• - Conducting Communication Activities,

• - Fulfilling obligations arising from employment contracts and legislation for employees,

• - Planning fringe benefits and benefits processes for employees,

• - Conducting Audit / Ethical Activities.

Your personal data may primarily be processed based on the condition of 'explicit consent' as specified in Article 5 of the Law. Furthermore, they may be processed 'without requiring explicit consent' in reliance on the following legal grounds referred to in the same article:

• 1. 'Being clearly prescribed by law',

• 2. Based on the legal ground of 'Establishment or performance of a contract'; the fulfillment of the requirements of the contract to which you are a party,

• 3. Based on the legal ground of 'Fulfilling the legal obligation of the data controller', the fulfillment of legal obligations stipulated in the relevant legislation, such as responding to requests from courts and public institutions and organizations requesting information and documents,

• 4. 'Having been made public by the data subject himself/herself',

• 5. Based on the legal ground of 'Establishment, exercise, or protection of a right', serving as evidence in possible disputes, and obtaining legal counsel and technical support,

• 6. Provided that it does not violate the fundamental rights and freedoms of the data subject, the processing of data is mandatory 'for the legitimate interests' of the data controller.

In line with these legal grounds, we also process your personal data within the framework of the following legislation:

• 1- Law on the Protection of Personal Data No. 6698 Art. 5/a (Being clearly prescribed by law)

• 2- Law on the Protection of Personal Data No. 6698 Art. 5/c (Being directly related to the establishment and performance of a contract)

• 3- Law on the Protection of Personal Data No. 6698 Art. 5/ç (Legal Obligation)

• 4- Law on the Protection of Personal Data No. 6698 Art. 5/e (Establishment, Exercise, and Protection of a Right)

• 5- Law on the Protection of Personal Data No. 6698 Art. 5/f (Legitimate Interest)

• 6- Turkish Commercial Code No. 6102

• 7- Turkish Code of Obligations No. 6098

• 8- Tax Procedure Law No. 213

• 9- Income Tax Law No. 193

• 10- Social Insurance and General Health Insurance Law No. 9783

• 11- Law on the Prevention of Laundering Proceeds of Crime No. 5549

C. Your Processed Personal Data

Personal data, as defined in Article 3 of the Law, refers to any information relating to an identified or identifiable natural person and constitutes the personal data referred to in this Privacy Notice. Your personal data are processed safely in accordance with the Law, due to legal obligations or in order to ensure the business and operations of the firm in a more lawful and effective manner.

In this context, the personal data processed within the scope of Texylon’s digital services are as follows:

• - Identity Information: (The data group containing information regarding the identity of the person.) Signature, Name, Surname, Mother's name, Father's name, ID Card serial number, ID Card family row number, ID Card row number, ID Card volume number, Registered Place of Identity, Gender, Date of Birth, Place of Birth, Marital Status, ID Number, Passport Number, Driver's License Details, Nationality

• - Contact: (The data group that can be used to contact the person.) Phone Number, E-mail Address, Residential Address, Emergency Contact Person Information

• - Finance: (The data group that can be used for the financial information of the person.) Bank Name, Bank Account Number, IBAN Number, Salary Information

• - Customer Transaction: (The data group that can be used for information regarding the transactions of the person.) Check, Promissory Note Details, Order Request Information

• - Criminal Conviction and Security Measures: The data group containing criminal convictions and security measures information belonging to the person.) Criminal Record

• - Education: (The data group containing information regarding your educational status.) Graduation grade, Name of graduated school and department, Transcript Details, Diploma, Graduation date, Educational Status, In-service Training, Certificate Information, Foreign Language Proficiency, Computer Literacy, Course Information

• - Visual and Audio Records: (The category of data used for visual/auditory identification of the person.) Photograph

• - Personnel: (Refers to the types of data contained in the employee personnel file.) CV, İŞKUR Registration Date, Social Security Institution (SGK) Service History, Employment Contract Details, Leave Information, Social Security / Retirement Information (SGK Entry), Payroll Details, Job Title,

• - Physical Space Security: The category of data used to ensure physical space security.)
  Camera recording (Video Only)

• - Legal Action: (Contains information regarding legal actions belonging to the person.)
  Enforcement Files and Judicial Case Information

• - Risk Management: (Refers to risk management information belonging to the person.)
  Risk Management Data

• - Other: (The data group containing data of categories not specified in the Law belonging to the person.) Employee Clothing-Size Information, Human Resources and other department-related data concerning the modules used within Texylon, leave, expenditure, assigned inventory, etc. information.

D. Transfer of Your Personal Data

Providing that all necessary technical and administrative measures are taken to ensure the appropriate level of security in accordance with the Law and relevant legislation, your personal data may be transferred, in line with the purposes mentioned above, to;

• - Legally authorized public institutions and organizations, in accordance with the requests of relevant public institutions and organizations, limited to the purposes of the request,

• - Private insurance companies and banks for the execution and ensuring the continuity of financial services,

• - Attorneys or attorney partnerships for the follow-up of legal matters,

• - Our direct/indirect domestic shareholders,

• - Domestic organizations from which we receive services contractually and/or to which we provide services, and with which we cooperate to carry out our activities, within the framework of the personal data processing conditions specified in Article 8 of the Law.

E. Data Processing and Retention Period

Your personal data will be processed, limited to the purposes specified in this Privacy Notice, in compliance with the data processing and limitation periods set forth in all relevant laws and other legal regulations to which our company and our affiliated branches and units are subject. In the event of changes to data processing periods in the relevant laws, the newly determined periods shall be taken as basis.

Your personal data, as a requirement of the purpose limitation principle, are processed for a period limited to the achievement of the purposes explained in this Privacy Notice and, in any event, for the duration requiring processing in accordance with company practices and trade customs. Upon expiry of these periods, the data shall be deleted, destroyed, or anonymized.

F. Rights of the Data Subject

Pursuant to Article 11 of the Law, as data subjects, you have the right to;

• - Learn whether your personal data are processed,

• - Request information if your personal data have been processed,

• - Learn the purpose of processing your personal data and whether they are used in accordance with their purpose,

• - Know the third parties to whom your personal data are transferred domestically or abroad,

• - Request rectification of your personal data if they are processed incompletely or inaccurately, and request notification of this transaction to the third parties to whom the personal data have been transferred,

• - Request erasure or destruction of your personal data in the event that the reasons requiring processing no longer exist, even though they have been processed in accordance with the provisions of the Law and other relevant laws, and request notification of this transaction to the third parties to whom the personal data have been transferred,

• - Object to occurrence of any result that is to your detriment by means of analysis of processed data exclusively through automated systems,

• - Demand compensation for damages in the event that you incur damages due to unlawful processing of your personal data.