1) Identity of Data Controller and Representative

In accordance with Article 10 of the Law on the Protection of Personal Data No. 6698 (“KVKK”), your personal data is transferred to TAELCO A.S. The extent to which it can be processed is explained below.

2) Purpose of Processing Personal Data

Your collected personal data is sent to TAELCO A.S. in accordance with the basic principles stipulated by the legislation. maybe processed for the following purposes:

• To carry out the necessary work by the business units of our company in order to carry out the commercial activities carried out by TAELCO A.S. in accordance with the legislation and Company policies, and to carry out activities in this direction;

• Determination of the human resources policy of TAELCO A.S., execution and execution of its activities;

• Determining, planning and implementing the commercial policies of TAELCO A.S. in the short, medium and long term;

• TAELCO A.S. Ensuring the commercial, technical and legal safety of the related persons with whom it has a business relationship and liaising with these real / legal persons;

• Protecting TAELCO A.S.’s commercial reputation and trust;

• Complying with the information storage, reporting and informing obligations stipulated by the official institutions within the scope of the relevant legislation, and fulfilling the legal obligations we are subject to regarding the use of these services;

• In order to determine and implement our company’s commercial and business strategies; financial operations, communication, market research and social responsibility activities, purchasing operations (demand, offer, evaluation, order, budgeting), internal system and application management operations, management of legal operations;

• Examining, evaluating and responding to requests from official authorities or relevant persons;

• Ensuring the security and control of the physical spaces of the company with camera recording systems;

• Fulfilling the burden of proof as evidence in legal disputes that may arise in the future;

• It is processed within the scope of the processing conditions and purposes of the personal data specified in Articles 5 and 6 of the KVKK.

• Your data is classified within the scope of automatic decision making in order to process the necessary business and information within the scope of our activities. This situation is a necessity for the reports to be created and the documents to be submitted to the relevant institutions.

The processing of your personal data is a legal and contractual obligation. will become.

3) To Whom The Data Can Be Transferred And For What Purpose

Personal data, limited to the purposes listed above, within the scope of Article 8 and Article 9 of the KVKK, TAELCO A.S. transmitted to the following persons:

• TAELCO A.S.’s business partners and affiliates,

• Persons and institutions permitted by the Turkish Commercial Code, Turkish Code of Obligations, Labor Law and other relevant laws and regulations,

• To legally authorized institutions and organizations, institutions, organizations, individuals and companies ordered by administrative and legal authorities and special legislation;

• In case of transfer, it will be transferred to the real and legal persons with whom we receive products and services and cooperate, by asking whether the domestic institution and/or enterprise to be transferred is also KVKK compliance and data security.

4) Data Collection Method and Legal Reason of Persons

Your personal data is collected by our company through different channels (oral, written, electronic media) in order to carry out our activities, on the basis of legal reasons such as ensuring compliance with the legislation and company policies, performance of contracts, clearly stipulated by the law, and legal interests of the company. Your personal data may also be processed and transferred for the purposes specified in this Clarification Text within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVKK, in accordance with the basic principles stipulated by the KVKK.

5) Identity of Data Controller and Representative

Period of Storage of Personal Data

Your personal data is retained for as long as required by the relevant legislation or for the purpose for which they are processed. The following criteria are taken into account when determining the maximum duration:

• The period accepted as a requirement of general custom in the sector in which the data controller operates within the scope of the purpose of processing the relevant data category, The period that requires the processing of personal data in the relevant data category and the legal relationship established with the data subject will continue,

• The period during which the legitimate interest to be obtained by the data controller, depending on the purpose of processing the relevant data category, will be valid in accordance with the law and honesty rules,

• The period during which the risks, costs and responsibilities arising from the storage of the relevant data category, depending on the purpose of processing, will continue legally,

• Whether the maximum period to be determined is suitable for keeping the relevant data category accurate and up-to-date when necessary,

• The period during which the data controller has to keep the personal data in the relevant data category due to its legal obligation,

• Timeout period determined by the data controller for asserting a right related to personal data in the relevant data category.

6) Rights of Personal Data Owners Enumerated in Article 11 of Law No. 6698

As personal data owners, you can submit your requests regarding your rights to TAELCO A.S. If you forward it to TAELCO A.S. with the methods set out in the Personal Data Protection and Processing Policy, our company will finalize the request as soon as possible and within thirty days at the latest, depending on the nature of the request. In this context, personal data owners;

• Learning whether personal data is processed or not,

• If personal data has been processed, requesting information about it,

• To learn the purpose of processing personal data and whether they are used in accordance with the purpose,

• Knowing the third parties to whom personal data is transferred in the country or abroad,

• Requesting correction of personal data in case of incomplete or incorrect processing and requesting notification of the transaction made within this scope to the third parties to whom the personal data has been transferred,

• Requesting the deletion or destruction of personal data in the event that the reasons requiring its processing have disappeared, although it has been processed in accordance with the provisions of the KVKK and other relevant laws, and requesting the notification of the transaction made within this scope to the third parties to whom the personal data has been transferred,

• Objecting to the emergence of a result against the person himself by analyzing the processed data exclusively through automated systems,

• They have the right to demand the compensation of the damage in case of loss due to unlawful processing of personal data.

In cases where the application is rejected, the answer given is insufficient or the application is not answered in due time; The person concerned may file a complaint with the Personal Data Protection Board within thirty days from the date of learning the answer of the data controller, and possibly within sixty days from the date of application. Pursuant to Article 13 of the Law, a complaint cannot be made before the remedy is exhausted. Apart from the above-mentioned rights of the person concerned, within the scope of international legislation; There is also the right to request restriction of the processing of personal data and to withdraw consent for the processing or transfer of personal data.

TAELCO A.S. We attach importance to the security of your Personal Data. TAELCO A.S. to the people who benefit from our products and services and TAELCO A.S. We are sensitive about the processing and preservation of all kinds of personal data belonging to all persons related to the Company in accordance with the Law on the Protection of Personal Data No. 6698 (KVK Law). We process your Personal Data within the limits set forth in the legislation and explained in the policy text below.

1. PURPOSE, SCOPE AND DEFINITIONS

1.1. GOAL

This Personal Data Processing and Protection Policy is the main policy text of TAELCO A.S.

1.2. SCOPE

Policy, TAELCO A.S., including its employees, customers, website visitors. It covers the Personal Data collected, processed or shared with the Company during its activities; TAELCO A.S. is binding on its departments and employees.

1.3. DEFINITIONS

Personal Data is directly or indirectly shared with TAELCO A.S. ‘s identity of a Relevant Person, alone or with TAELCO A.S. It means any information that allows the company to determine it by combining it with other information in its possession or control.

Sensitive Personal Data, information about race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, disguise and dress, membership to associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and means data on genetic information.

Personal Health Data means any health information relating to an identified or identifiable natural person.

Data Processing means any operation performed on Personal Data, including collection, recording, storage, preservation, modification, rearrangement, disclosure, transfer, takeover, making available, classification or preventing its use.

Relevant Person Personal Data TAELCO A.S. means all natural persons processed by or on behalf of

Explicit Consent means the consent given on a particular subject, after being informed, of free will.

Destruction means the deletion or destruction of Personal Data.

Anonymized Data means making Personal Data in no way associated with an identified or identifiable natural person, even after the data controller or any other person to make the Relevant Person identifiable, has used all reasonable and usual methods.

Data Processor means the natural or legal person who processes Personal Data on behalf of the data controller, based on the authority given by the data controller. In each concrete case, who the Data Processor is should be evaluated separately.

Data Controller means the natural or legal person who determines the purposes and means of processing Personal Data and is responsible for the establishment and management of the data recording system. Data controller TAELCO A.S. may be, from time to time TAELCO A.S. on behalf of or a third person authorized by TAELCO A.S. In each concrete case, who is the data controller should be evaluated separately.

Board means Personal Data Protection Board.

2. PROCESSING PERSONAL DATA

2.1. PRINCIPLES

TAELCO A.S. It acts in accordance with the following principles in all its activities regarding the collection and processing of Personal Data:

2.1.1. Compliance with Law and Integrity Rules

Personal Data will be collected and processed in accordance with the law and honesty rules.

2.1.2. Accuracy and Timeliness When Necessary

TAELCO A.S., if necessary for the purpose of collecting and processing Personal Data:

• Take reasonable precautions to keep Personal Data complete, accurate and up-to-date,

• In case the Relevant Persons provide information about the changes in Personal Data, they will update the Personal Data and take reasonable measures to update, correct or delete incomplete or incorrect data.

2.1.3. Certainty, Clarity, and Legitimate Purposes

TAELCO A.S. undertakes to collect and process Personal Data to the extent necessary and in connection with the business purpose of its collection. Except as permitted or required by law, Personal Data will not be collected and/or processed in advance for purposes expected to arise in the future. Except where the processing of Personal Data is legally required or possible, it will only be processed for the legitimate purposes clearly stated before the data is collected and in accordance with the consent to be obtained or, where necessary, Explicit Consent.

TAELCO A.S. Before any data collection activity, the consent form or online environments where consent is obtained will be used in cases where the Explicit Consent of the Related Person is required in accordance with the data collection method and this Policy.

Personal Data TAELCO A.S. In cases where it is processed by third parties that Process Data on behalf of, the third parties must undertake in writing, contractually or otherwise, that they will act in accordance with the obligations contained in this Policy.

2.1.4. Retention for the Period Required by the Purpose of Processing or Envisioned in the Relevant Legislation

Personal Data are stored for the maximum retention period in accordance with the purposes for which they are processed; this period may be kept longer in order to comply with the obligations set forth in the legislation or to protect legitimate business interests. Personal Data that is not needed after the legal, administrative or commercially necessary periods expire is subject to the legislation and TAELCO A.S. It will be deleted, anonymized or destroyed in accordance with the Personal Data Storage and Disposal Policy.

TAELCO A.S. Regarding Personal Data in physical and electronic data recording systems, it is responsible for the destruction of all data in accordance with the legislation in case the purpose of collection of this data disappears and the legal retention periods expire.

All transactions regarding the deletion, destruction and anonymization of Personal Data will be recorded and these records will be kept for at least three (3) years, excluding other legal obligations.

3. DATA COLLECTION AND PROCESSING

TAELCO A.S. It will collect and process Personal Data in accordance with the following legal conditions.

3.1. Approval

The collection and/or processing of Personal Data will be processed after the Relevant Person is informed in accordance with the legislation and the Policy, and after giving Express Consent in writing or electronically with his free will. In case of processing of Personal Health Data, Explicit Consent must be obtained in writing. Explicit Consent statements received will be documented and stored in physical or electronic media. Personal Data may be processed without the consent of the Relevant Person in the presence of the following conditions listed in the KVKK:

• Explicitly stipulated by law.

• It is compulsory for the protection of life or physical integrity of the person or another person, who is unable to express his consent due to actual impossibility or whose consent is not legally recognized.

• It is necessary to process the Personal Data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract.

• It is mandatory for the Data Controller to fulfill his legal obligation.

• Being made public by the Relevant Person himself.

• Data Processing is mandatory for the establishment, exercise or protection of a right.

• Data processing is mandatory for the legitimate interests of the Data Controller, provided that it does not harm the fundamental rights and freedoms of the Data Subject.

3.2. Special Qualified Personal Data

Sensitive Personal Data can only be processed in cases expressly stipulated by law, excluding the Explicit Consent of the Relevant Person or data related to health and sexual life. Personal Data related to health and sexual life can only be processed without the explicit consent of the person concerned, for the purposes of protecting public health, performing preventive medicine, medical diagnosis, treatment and care services, planning and managing health services and financing. In the processing of Special Quality Personal Data, the decisions of the Personal Data Protection Board are followed.

4.TRANSFERRING PERSONAL DATA

Personal Data can only be transferred to third parties in Turkey if the Data Subject has Explicit Consent to the data transfer or if there is one of the situations where Explicit Consent is not sought.

In the transfer of Personal Data to third parties abroad;

The foreign country to which the Personal Data is transferred provides an adequate level of protection; or In the event that there is no adequate protection in the relevant foreign country, TAELCO A.S. and the data controllers in the relevant foreign country must undertake in writing that adequate protection is provided and that the Board has permission and conditions.

5. RIGHTS AND OBLIGATIONS

5.1. Rights of the Relevant Person

Personal Data TAELCO A.S. Natural persons collected or processed by KVKK have the right to apply to the Data Controller. The Relevant Person may direct the following requests in writing or via e-mail to TAELCO A.S.

• Learning whether Personal Data is processed or not,

• If Personal Data has been processed, obtaining information about it,

• Learning the purpose of processing Personal Data and whether they are used in accordance with its purpose,

• Knowing the third parties to whom Personal Data is transferred, in the country or abroad,

• Correction of Personal Data in case of incomplete or incorrect processing,

• Deletion or destruction of Personal Data within the framework of the law,

• Objecting to the emergence of a result against the person himself by analyzing the processed Personal Data exclusively through automated systems,

• In case of damage due to unlawful processing of Personal Data, compensation of the damage.

5.2. Obligations of the Data Controller

5.2.1. Lighting Obligation

TAELCO A.S. Make an informative, clear and understandable notification to the Related Persons about the process of processing their Personal Data and the purposes of Data Processing during the acquisition of Personal Data; informing these persons about their rights regarding their Personal Data and TAELCO A.S. will ensure that they have reasonable access to their Personal Data processed by

The notification to be made to the Relevant Persons includes at least the following elements:

• Identity of the Data Controller or his representative, if any,

• Purpose, method and legal reason for Data Processing,

• To whom and for what purpose Personal Data can be transferred,

• Legal rights of the Relevant Persons as specified under Article 5.1 above

5.2.2. Obligations Regarding Data Security

TAELCO A.S. within the scope determined in the relevant legislation,

• To prevent the unlawful processing of Personal Data

• To prevent unlawful access to Personal Data.

• Takes necessary technical and administrative measures to ensure the appropriate level of security in order to protect Personal Data against misuse, disclosure, alteration and destruction.

1. TAELCO A.S. It makes or has the necessary controls made in order to ensure the security of Personal Data.

2. TAELCO A.S. Personal Data that it collects and/or processes within the framework of its activities (i) keeps confidential in accordance with the provisions of the KVKK and the Policy, (ii) does not use it for purposes other than processing, (iii) prohibits all kinds of Data Processing activities of its employees who are not involved in the processing of Personal Data due to their duty, and (iv) ) allows its employees to access Personal Data to the extent appropriate to the limits of their duties. This obligation continues even after they leave office.

3. In case the Processed Personal Data is obtained by others unlawfully, TAELCO A.S. notifies the relevant person and the Board as soon as possible.

5.2.3. Registration in the Data Controllers Registry

TAELCO A.S. According to the Regulation on the Data Controllers Registry, it will fulfill the relevant obligation to be fulfilled in accordance with the Regulation by registering in the Data Controllers Registry to be established by the Presidency of the Personal Data Protection Authority. In this context, the following information will be made available to the public:

• Name and address of Data Controller, if any, Data Controller representative and contact person, and KEP address if received,

• For what purposes Personal Data can be processed,

• Person group and groups that are the subject of Personal Data and the data categories of these persons,

• Recipient and recipient groups to whom Personal Data can be transferred,

• Personal Data that is foreseen to be transferred to foreign countries,

• The date of registration in the registry and the date of the end of the registration,

• Measures taken regarding Personal Data security,

• The maximum period required for the purpose for which Personal Data is processed.

6.CHANGES TO THE POLICY

Provisions in this Policy TAELCO A.S. If deemed necessary by the Company, it can be changed by publishing it on the internet sites in accordance with the provisions of the legislation. If any of these provisions are changed, the relevant changes will come into effect on the date of publication of the change.

TAELCO Aeronautics and Defense Inc.