Elitist Steel Personal Data Protection and Processing Policy

1. INTRODUCTION

1.1. General Overview

Ensuring the confidentiality and security of personal data and compliance with relevant legal regulations are among the top priorities of Elitist Steel, with utmost care taken in this regard. In this context, this Personal Data Protection and Processing Policy ("Policy") and other written policies within the Company are managed processes and intended purposes; informing the processing, storage, protection of personal data of Interested Parties ("Relevant Persons"), and reflecting our corporate culture.

In preparing this Policy; We consider the provisions regarding the protection and processing of personal data in the Constitution of the Republic of Turkey and Law No. 6698 on Protection of Personal Data ("KVKK"), as well as the provisions in relevant legal norms governing the protection and processing of personal data Protection Board decisions are considered as a guide to our Company.

This Policy will provide explanations on the processing processes of personal data adopted by our Company and the basic principles listed below:

• Processing personal data in accordance with law and fairness,

• Keeping personal data accurate and up-to-date when necessary,

• Processing personal data for specific, clear, and legitimate purposes,

• Processing personal data in a way that is relevant, limited, and proportionate to the purposes for which they are processed,

• Keeping personal data for the period prescribed in the relevant legislation or for the duration necessary for the purpose of processing,

• Informing relevant persons,

• Establishing necessary processes for relevant persons to exercise their rights,

• Taking necessary measures in the processing and storage of personal data,

• Transferring personal data to third parties as required by the processing purpose,

• Showing the necessary sensitivity in processing and protecting special categories of personal data,

• Deleting, destroying, or anonymizing personal data when the purpose of processing has ceased.

1.2. Purpose of the Policy

The main purpose of this Policy is to explain the personal data processing activities conducted in accordance with the law by our Company and the procedures adopted for the protection of personal data, and to ensure transparency by informing Interested Persons in this context. In addition, the prepared KVK Policy and other written policies aim to sustain our principle of compliance with KVKK and other relevant legal regulations regarding personal data security.

1.3. Scope of the Policy

The scope of this policy is aimed at real persons whose personal data is processed by our Company either automatically or non-automatically as part of any data registration system, and a directive on Personal Data Protection has been established within the scope of this Policy.

1.4. Implementation of the Policy and Relevant Legislation

This Policy has been prepared by concretizing within the framework of the principles laid down by the relevant legislation. In the event of any inconsistency between the legislation in force and this Policy, our Company undertakes and accepts that the legislation in force will be applied.

1.5. Effectiveness of the Policy

This policy enters into force upon approval by the Board of Directors of our Company, is published on the internet site (www.elitiststeel.com), and is made available to Interested Persons in this way.

3. PRINCIPLES OF PROCESSING PERSONAL DATA

3.1. Processing of Personal Data in Compliance with the Principles Envisaged in the Legislation

3.1.1. Processing in Accordance with Law and Honesty Rules

Our Company adopts the principle of ensuring compliance with the law and honesty in every process to be carried out on personal data. In this context, it informs Interested Persons about the intended use of personal data through this Policy and other texts.

3.1.2. Ensuring Personal Data is Correct and Updated When Necessary

Our Company uses a system and process to ensure the accuracy and currency of personal data when carrying out the processing activity of personal data. In this context, Interested Persons can contact our Company to ensure the accuracy and currency of their personal data.

3.1.3. Processing for Specific, Clear, and Legitimate Purposes

Our Company explicitly states that personal data processing is clearly determined within the limits of legitimate and legal limits, and is informed of Interested Persons before starting the process through this Policy and other texts.

3.1.4. Being Relevant, Limited, and Proportional to Processing Purposes

Our Company processes personal data within the necessary limits and within the scope of the purpose for which they are processed for the realization of the purposes. In this context, our Company avoids the processing of personal data that is not related to the achievement of purposes and that is not possible in the future.

3.1.5. Retention of Personal Data for the Duration Specified in the Relevant Legislation or for the Duration Necessary for the Purpose of Processing

Our Company keeps personal data only for the period specified in the relevant legislation or for the duration necessary for the purpose of processing. In this context, our Company determines whether there is a special period for storing personal data in the relevant legislation, if there is a special period, a process is carried out in compliance with it, and if there is no special period determined, a special period is determined for the purpose of processing each personal data, and it is stored during this period.

In the relevant context, our Company prepares and implements a policy and directive for the deletion, destruction, or anonymization of personal data.

3.2. Processing of Personal Data in Compliance with the Personal Data Processing Conditions Specified in Article 5 of the KVKK and Processing Limited to These Conditions

3.2.1. Explicit Consent

Explicit consent is a statement given on a specific subject based on informed and free will. In accordance with Article 5/1 of the KVKK, our Company respects and complies with the explicit consent of Interested Persons when necessary.

3.2.2. Cases Not Requiring Explicit Consent

Article 5/2 of the KVKK, our Company respects and complies with the explicit consent of Interested Persons when necessary.