The 6698 Personal Data Protection Act

1. PURPOSE AND SCOPE OF THE PRIVACY NOTICE

MERCAN KİMYA SAN VE TİC. A.Ş (MERSIS NO: 0616030635600017) is a publicly traded joint-stock company subject to the oversight and supervision of relevant regulatory authorities under capital markets legislation, primarily the Capital Markets Board of Türkiye (CMB / SPK) and the Central Securities Depository of Türkiye (CSD / MKK). Within this scope, our processing and transfer of personal data are not limited solely to the Personal Data Protection Law No. 6698 (KVKK), but are also conducted within the framework of capital market regulations and relevant statutory obligations.

Our Company places high value on the security of personal data belonging to candidate employees, current employees, interns, authorized representatives and employees of our business partners and suppliers, shareholders, individual shareholder representatives, officials working within regulatory and supervisory authorities, visitors, website users, and other natural persons establishing legal, administrative, or commercial relationships with our Company; acting as the "data controller," it processes such data lawfully, when necessary, and proportionally to the legitimate processing purposes.

2. COLLECTION METHODS AND LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

Your personal data may be collected via automated or non-automated channels for purposes including establishing or executing contractual relationships, managing recruitment processes of candidate employees, maintaining employee personnel files, ensuring occupational health and safety, managing secure visitor entry-exit logs, administering vendor relationships, fulfilling statutory obligations governing chemical manufacturing and trade, complying with legal and administrative liabilities before authorized bodies, and satisfying reporting and disclosure mandates under capital markets legislation.

Your collected data is processed pursuant to Article 5/2 (a-c-ç-e-f) and, where applicable, Article 6 of Law No. 6698, grounded upon the legal bases of fulfilling our statutory duties, executing contractual relationships, and protecting our legitimate interests. Security cameras record video footage only; no audio recording is conducted.

3. CATEGORIES OF PROCESSED PERSONAL DATA

Depending on the nature of your relationship with our Company, the following categories of personal data may be processed:

• Identity Information: Full name, national identity number, date of birth, required identity document details, etc.
• Contact Information: Phone number, e-mail address, postal address, internal corporate contact data, and data used during communications with shareholders and investors.
• Personnel and Candidate Information: (Exclusively for employees/candidates): Identity, contact, education, and reference details; payroll, social security, and occupational health records in case of an established employment relationship.
• Financial and Accounting Information: Payment and billing details, bank account details, salary and payroll data, tax records.
• Supplier / Customer Representative Information: Full name, title/position, signature authorization information, contact details, authorization certificates.
• Visitor Registration Information: Full name, entry-exit timestamp records (for facility security purposes).
• Physical Space Security Information: Closed-circuit security camera (CCTV) footage (without audio).
• Transaction Security Information: Corporate IT system activity logs, access and event logs.
• Legal Transaction Information: Information necessary for conducting legal, administrative, and judicial proceedings.

4. PURPOSES OF PROCESSING PERSONAL DATA

• Execution and monitoring of commercial, business, and contractual operations,
• Planning and administration of human resources processes,
• Operational workflows enabling you to benefit from our products and services,
• Management of procurement and supply chain procedures,
• Execution of financial, accounting, and treasury transactions,
• Customer and vendor satisfaction and corporate communication activities,
• Ensuring personnel and visitor safety across facilities,
• Implementation of occupational health and safety protocols,
• Management of legal disputes and safeguarding corporate legal rights,
• Corporate information technology and system security management,
• Administration of corporate training and development initiatives,
• Execution of enterprise risk management and internal auditing activities,
• Fulfilling information and document requests from public institutions,
• Statutory compliance under the Labor Law, Commercial Code, Code of Obligations, and OHS laws,
• Capital markets compliance (such as Public Disclosure Platform / KAP disclosures).

5. PARTIES TO WHOM PERSONAL DATA MAY BE TRANSFERRED AND PURPOSES OF TRANSFER

Your personal data may be transferred to the following third parties and authorized institutions in compliance with the KVKK and pertinent legislation:

• Competent public authorities and institutions (SPK, MKK, Tax Offices, SGK, etc.),
• The Public Disclosure Platform (KAP) and pertinent regulatory bodies,
• Legal counsels, certified public accountants, auditors, and licensed brokerage firms,
• Our subsidiaries, affiliates, and group companies,
• Auditors, independent audit firms, and authorized commercial partners,
• Private insurance companies.

Cross-Border Transfers: In order to provide technical IT infrastructure, your data may be hosted on servers located abroad by cloud service providers such as Microsoft 365, subject to adequate security measures implemented in full compliance with Article 9 of the KVKK.

6. DATA RETENTION AND DISPOSAL PERIODS

The retention schedules based on business processes are set forth below:

MERCAN KİMYA has determined its periodic disposal interval as 6 months. Periodic deletion, destruction, or anonymization operations are executed in June and January of each calendar year.

7. RIGHTS OF THE DATA SUBJECT

• To learn whether personal data is being processed and to request relevant information,
• To learn the purpose of the data processing and whether data is used in accordance with its purpose,
• To know the third parties to whom personal data is transferred domestically or abroad,
• To request rectification if data is incomplete or inaccurate, or deletion/destruction where conditions are met,
• To object to adverse outcomes resulting exclusively from automated analysis, and to demand compensation for damages incurred due to unlawful processing.

8. APPLICATION METHODS

Data subjects may submit their statutory inquiries and requests through the following channels:

• Written Application: By completing the application form available at www.mercankimya.com.tr and delivering it in person or via registered mail with return receipt to Hacı Eyüplü Mah. 3125 Sok No 23 Merkezefendi / Denizli / Türkiye.
• Electronic Application: Via Registered Electronic Mail (KEP) to [email protected] or via e-mail to [email protected].

9. RELATED DOCUMENTS & POLICIES