Dear interlocutors, we attach great importance to information security and personal data security. Motor Aşin Automotive Computer Industry and Trade A.Sh. As a company, we would like to make a statement about personal data security. We have shared our personal data security general rules and information security policy about our company with all our valued interlocutors via our web page. We will update and announce it to you again if necessary. Information about the Law on the Protection of Personal Data No. 6698 Motor Aşin Automotive Computer Industry and Trade A.Sh. As a personal data processor, we would like to inform you about the Personal Data Protection Law (KVKK) No. 6698, which regulates the obligations of natural and legal persons processing personal data, as well as the procedures and principles to be followed, to protect the fundamental rights and freedoms of the relevant persons, especially the privacy of private life, and to inform you about the processing of personal data. Some Terms Related to the Law Define Personal Data: Within the scope of this law, personal data is defined as "any kind of information related to an identified or identifiable real person"; processing is defined as "any kind of transaction performed on data, such as obtaining, recording, storing, changing, rearranging, disclosing, transferring, inheriting, making available, classifying, or preventing the use of personal data by means that are fully or partially automatic or non-automatic, provided that they are part of any data recording system". Special categories of personal data: These are information such as race, ethnic origin, political thought, philosophical belief, religion, sect, or other beliefs of persons, disguise and clothing, association, foundation, or trade union membership, health, sexual life, criminal conviction, and security measures related data, as well as biometric and genetic data. Processing of personal data: "All kinds of transactions performed on data, such as obtaining, recording, storing, changing, rearranging, disclosing, transferring, inheriting, making available, classifying, or preventing the use of personal data, by means that are fully or partially automatic or non-automatic, provided that they are part of any data recording system".

Explicit Consent: It is defined as "consent related to a specific subject, based on being informed and explained by free will" related to personal data. As the Data Controller, we may want to inform you and obtain your explicit consent in order to fulfill our obligations under the law. The Purpose of the Lighting Text and the Motor Aşin Automotive Computer Industry and Trade A.Sh. Position as Data Controller Motor Aşin Automotive Computer Industry and Trade A.Sh. to the domestic and international customers, employees, suppliers, stakeholders, visitors, and other persons connected with the institution for whom it provides services, within the scope of the protection of personal data Law No. 6698 (KVKK) 10. We have prepared this text in order to fulfill our obligation to clarify the article. Motor Aşin Automotive Computer Industry and Trade A.Sh. The clarification text on the Protection of Personal Data will be updated within the framework of changes that may be made in the applicable legislation. We will be able to fulfill our disclosure obligations for our company under the coordination of the KVKK Committee via our website, and our bulletin boards. Purpose of Processing and Transfer of Personal Data Belonging to Real Persons Motor Aşin Otomotiv Computer Industry and Trade A.Sh. To be able to carry out sales of stored and manufactured auto spare parts products, to be able to carry out marketing activities related to auto spare parts products, to receive your auto spare parts requests, to carry out purchase processes, to measure your satisfaction, to answer your complaints, wishes, and requests, to process your job applications, and to improve our production and service processes, we process your personal data through printed and digital media. Your personal data Within the framework of the laws of the Republic of Turkey, some of your personal data may be

transferred to the companies we do business with, in accordance with the laws, with the competent judicial and administrative authorities within the scope of public services, in order to ensure that the institutions that provide services to us can do business on behalf of our institution, including in a limited way.

Personal Data Protection Law No. 6698 The Conditions for the Processing of Personal Data The conditions that make it possible to process personal data without seeking the explicit consent of the person concerned are listed; to be clearly stipulated in the Laws. The fact that a person who is unable to disclose his consent due to actual impossibility or whose consent is not legally recognized is mandatory for the protection of his life or body integrity. It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of the contract. It is mandatory for the data controller to fulfill his/her legal obligation. The fact that the relevant person has been publicly identified by him. Data processing is mandatory for the establishment, use, or protection of a right. It is mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject. Your personal data is used by our institution for the following purposes: To receive your identification and license plate information when you come to our warehouse to receive and deliver your products and orders, To conduct marketing and sales studies of vehicle parts and products that we produce and sell, to transmit sales opportunities in vehicle parts and products to our customers, to perform building, facility, and factory management and services in this context, to ensure occupational health and safety during workplace visits, Users of our website, applications via our website / mobile applications Collect IP address and similar information in accordance with the “cookie policy”, People who have business ties with our institution perform addresses and communications for communication purposes, contact our customers about the terms of our business contracts, contracts, current status and updates, the ability to provide necessary information, issues related to public safety and public health on request and in accordance with legislation to provide information to public officials, from our customers, visitors, ability to evaluate complaints and suggestions related to the production and services of vehicle parts from our suppliers, solving problems, planning and conducting customer satisfaction studies, tracking customer requests, complaints, requests and wishes, planning and conducting business activities conducted by our company. To be able to provide the information needed by our business partners, suppliers, to carry out procurement processes, logistics processes, and distribution processes.

Ensuring the security of physical areas of our company such as facilities, warehouses, Ensuring the timeliness of data of our customers, suppliers and other relevant stakeholders, Ensuring the financial activities of our company, Planning and performing audit activities in our institution, Providing information to authorized institutions and organizations based on legislation, Evaluating your job and internship applications, Cooperation, joint work, procurement and subcontracting during work and operations Jul, Fulfillment of obligations related to contracts. To fulfill our legal obligations and exercise our rights arising from the applicable legislation,

To prevent fraud and other illegal activities, Health information results obtained within the scope of occupational health and safety of employees are processed only in accordance with the laws within the scope of occupational health and safety, Camera images through security cameras in warehouses, workplaces and facilities can ensure public safety and occupational safety, Body temperature information for public health and human health due to COVID-19, HEPP code result information can be processed.

Information about the transfer to third parties and the reasons for this Motor Aşin Automotive Computer Industry and Trade A.Sh. The sharing of personal data belonging to our customers, employees, stakeholders, and suppliers with third parties is carried out by obtaining the obligation of disclosure and explicit consent within the framework of the permission of the relevant persons, and as a rule, your personal data is not transferred to third parties without the consent of our employees, customers, suppliers, and stakeholders. Personal data or some special personal data for business purposes, due to and limited to our legal obligations, your personal data is shared only with contractors conducting business on behalf of our institution, social security institutions, law enforcement agencies and courts for legal investigations and prosecutions, and other authorized public institutions, and in some cases some of your data is transferred within the legal framework. Necessary technical, administrative, technological, systemic, and legal measures are taken to prevent rights violations during data transfer to third parties. The goal of all these studies is to be able to comply with national and international legal requirements in the fields of information security, personal data security. Method of Collection of Personal Data and Legal Reason Personal data are collected partially or completely automatically through media such as personal data, printed media, electronic media, cameras, software, digital storage units (NAS devices), CD, DVD, USB, copier, printer, video, camera, phone, tablet, B2B, web page, mobile application or as part of any recording system.

These personal data are collected in accordance with the Labor Law, Occupational Health and Safety legislation, in accordance with the Law on Regulating Publications Made on the Internet and Combating Crimes Committed Through These Publications, in accordance with the Electronic Commerce Regulation Law No. 6563, in accordance with the Turkish Commercial Code, in accordance with the Turkish Code of Obligations, the Turkish Criminal Code, in accordance with other relevant legislation such as the Personal Data Protection Law No. 6698. Your personal data, for the performance of a contract, if it is stipulated in the laws; for the purpose of bringing a legal obligation, the data are collected and processed in accordance with the legitimate interest of the responsible person or for different legal legal reasons. Motor Aşin Automotive Computer Industry and Trade A.Sh. as Jul, our obligations regarding personal data security are to prevent unlawful access to personal data, to ensure the preservation of personal data, to take all necessary technical and administrative measures to ensure the appropriate level of security. In case the personal data is processed by another natural or legal person on his/her behalf, the data controller is jointly responsible together with these persons for taking the measures specified in the first paragraph. The data controller is obliged to carry out or make the necessary audits in his/her institution or organization in order to ensure the implementation of the provisions of this Law. Data controllers and data processors may not disclose the personal data they have learned to anyone else in violation of the provisions of this Law and may not use it for other than the purpose of processing.

This obligation continues after they leave office. If the processed personal data is obtained by others by illegal means, the data controller notifies this situation to the relevant person and the Board as soon as possible. If necessary, the Board may announce this situation on its

website or by any other method it deems appropriate. As the Personal Data Controller, You have the Rights of the Related Persons 11 of the law No. 6698. according to the article data owners: To learn whether personal data about themselves are processed, To request information about this if their personal data have been processed, To learn the purpose of processing personal data and whether they are used in accordance with their purpose, To know the third parties to whom personal data are transferred domestically or abroad, To request correction of personal data if it is incompletely or incorrectly processed, and to request notification of the transaction made in this context to the third parties to whom personal data are transferred, Although it has been processed in accordance with the provisions of the law and other relevant laws, it has the right to request the deletion or destruction of personal data if the reasons for processing disappear and to request notification of the processing to the third parties to whom the personal data has been transferred, to object to the occurrence of a result against the person himself by analyzing the processed data exclusively through automatic systems, and to request compensation for the damage if the personal data has been damaged due to illegal processing.

Periods of storage and destruction of your personal data and methods of destruction The personal data processed in our company are kept for the period stipulated in the relevant legislation. Data, information, documents that do not need to be stored are safely destroyed in accordance with our relevant domestic legislation and legal regulations. Personal data; Especially the Law on the Protection of Personal Data No. 6698, the Turkish Code of Obligations No. 6098, the Law on Social Insurance and General Health Insurance No. 5510, the Law No. 5651 on the Regulation of Publications on the Internet and the Fight against Crimes Committed Through These Publications, the Occupational Health and Safety Law No. 6331, the Information Acquisition Law No. 4982, the Law on the Exercise of the Right to Petition No. 3071, the Labor Law No. 4857, It is stored for the period of storage stipulated within the framework of other secondary regulations in force in accordance with other laws, such as the Regulation on Health and Safety Measures to be Taken in Workplace Buildings and Add-ons.

Destruction operations are carried out by recycling paper, cropping, destroying electronic devices, securely deleting, or anonymizing digital data. communication with the data subject, including within the scope of the personal data protection law No. 6698, Requests for the exercise of these rights, personal data owners, may be transmitted by the data subjects by the methods specified in the legislation on the Processing and Protection of Personal Data within the Scope of the Law No. 6698 at this address. Motor Aşin Automotive Computer Industry and Trade A.Ş. it will evaluate these requests from the relevant persons and finalize them within 30 days. As a related person, you can fulfill your requests related to Law No. 6698 on our Application and Disclosure Obligation page. You can contact us on our Application and Disclosure Obligation page for all kinds of questions and opinions, including about the use of personal data within the scope of the Law on the Exercise of the Right of Non-Acceptance and Cancellation. With the explanations we have given above, we have informed you and fulfilled our Obligation to Clarify. For the deletion, updating, anonymization, destruction of your personal data or other legal requests related to your personal data, you can send your requests to us via the Contact Person Application Form. As the relevant person, we will respond to you as soon as possible in accordance with the Law on the Protection of Personal Data No. 6698 or within the legal time limits. In accordance with the KVKK data minimization principle, our company has the principle of processing the minimum personal data that it can do business with before, during, and after work. The Identity and Full Address of the Data Controller You will Apply For İS Motor Aşin Otomotiv Bilgi Sanayi ve Ticaret A.Ş. Atatürk Mah. Ikitelli Cad. No. 44 Küçükçekmece / Istanbul. motorasin@hs01.kep.tr kvkk@motorasin.com