İLERİ TRAFİK SİNYALİZASYON SAN. TİC. LTD. ŞTİ PERSONAL DATA PROTECTION AND PROCESSING POLICY

1. PURPOSE AND SCOPE

Within all enterprises operating under İLERİ TRAFİK SİNYALİZASYON SAN. TİC. LTD. ŞTİ. (hereinafter referred to as İLERİ TRAFİK), utmost sensitivity is shown regarding the security of personal data. With this awareness, we attach great importance to the processing, recording, transfer, sharing, and storage of all kinds of personal data belonging to all individuals associated with our Companies, including those benefiting from our products and services, in accordance with the Turkish Personal Data Protection Law No. 6698 (“PDPL”).

In line with the importance it attaches to the protection of personal data, İLERİ TRAFİK establishes the fundamental principles regarding compliance of the activities carried out by İLERİ TRAFİK with the regulations set forth in the PDPL through the İLERİ TRAFİK Personal Data Protection Policy. With the implementation of the provisions of the İLERİ TRAFİK PDPL Policy, the data security principles adopted by İLERİ TRAFİK will be sustained.

The İLERİ TRAFİK PDPL Policy applies to real persons whose personal data are processed by İLERİ TRAFİK, including İLERİ TRAFİK employees, through fully or partially automated means or non-automated means provided that they form part of a data recording system.

2. OBJECTIVE

With the İLERİ TRAFİK PDPL Policy, it is aimed to establish the necessary systems and to set up the required order to ensure compliance with legislation, in line with the objective of creating awareness regarding the lawful processing and protection of personal data within İLERİ TRAFİK. In this context, the İLERİ TRAFİK PDPL Policy serves as guidance for the implementation of the regulations introduced by the PDPL and related legislation.

3. DEFINITIONS

The significant terms used in the İLERİ TRAFİK PDPL Policy are defined below:

Explicit Consent: Consent that is related to a specific issue, based on information, and expressed with free will.

Anonymization: Rendering personal data impossible to be associated with an identified or identifiable real person, even by matching with other data.

Communique on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform:  The communiqué published in the Official Gazette dated March 10, 2018 and numbered 30356.

Employee(s): Employees of İLERİ TRAFİK.

Customer(s): Persons benefiting from the services of İLERİ TRAFİK.

Regulation on the Processing of Personal Health Data: The Regulation on the Processing of Personal Health Data and Protection of Privacy, published in the Official Gazette dated October 20, 2016 and numbered 29863.

Personal Health Data: Any information relating to the physical and mental health of an identified or identifiable real person and information related to health services provided to the person.

Personal Data: Any information relating to an identified or identifiable real person.

Data Subject: The real person whose personal data are processed (e.g., customers and employees).

Personal Data Protection Unit: The unit established within İLERİ TRAFİK to ensure coordination for compliance with personal data protection legislation.

Processing of Personal Data: Any operation performed on personal data such as collection, recording, storage, preservation, alteration, reorganization, disclosure, transfer, acquisition, making available, classification, or prevention of use, whether fully or partially automated or non-automated provided that it forms part of a data recording system.

PDPL: The Personal Data Protection Law No. 6698, published in the Official Gazette dated April 7, 2016.

PDPL Board: The Personal Data Protection Board.

PDPL Authority: The Personal Data Protection Authority.

PDPL Compliance Program: The program implemented by İLERİ TRAFİK to ensure compliance with personal data protection legislation.

Special Category Personal Data: Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, association, foundation or union membership, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

İLERİ TRAFİK: All companies included within İLERİ TRAFİK SİNYALİZASYON SAN. TİC. LTD. ŞTİ.

İLERİ TRAFİK Business Partners: Parties with whom İLERİ TRAFİK establishes business partnerships for various purposes while carrying out its commercial activities.

İLERİ TRAFİK Personal Data Retention and Destruction Policy: The policy determining the maximum retention period and procedures for deletion, destruction, or anonymization of personal data pursuant to the Regulation on Deletion, Destruction or Anonymization of Personal Data.

İLERİ TRAFİK Suppliers: Parties providing services to İLERİ TRAFİK on a contractual basis.

İLERİ TRAFİK Data Subject Application Form: The application form used by data subjects when exercising their rights under Article 11 of the PDPL.

Data Processor: A real or legal person who processes personal data on behalf of the data controller based on the authority granted.

Data Controller: The person who determines the purposes and means of processing personal data and manages the place where data are systematically stored.

Data Controllers Registry: The publicly available registry kept under the supervision of the PDPL Authority.

Communique on the Procedures and Principles of Application to the Data Controller:  The communiqué published in the Official Gazette dated March 10, 2018 and numbered 30356.

4. ROLES AND RESPONSIBILITIES

İLERİ TRAFİK is responsible for the implementation of the İLERİ TRAFİK PDPL Policy in all business operations, activities, and processes. Legal Advisors and PDPL Consultants shall serve as advisory and guiding sources in the implementation of regulations, procedures, guidelines, standards, and training activities prepared in accordance with the Policy. All employees, stakeholders, guests, visitors, and relevant third parties across İLERİ TRAFİK are obliged to comply with the Policy and cooperate with Legal Advisors in preventing legal risks and imminent dangers. All bodies and departments of İLERİ TRAFİK are responsible for overseeing compliance with the Policy.

5.1. DATA SUBJECT GROUPS MANAGED UNDER THE İLERİ TRAFİK PDPL POLICY

The data subjects whose personal data are processed by İLERİ TRAFİK within the scope of the İLERİ TRAFİK PDPL Policy are grouped as follows:

 İLERİ TRAFİK Job Applicants: Persons who have not entered into an employment contract with İLERİ TRAFİK but are evaluated for potential employment.

 İLERİ TRAFİK Business Partners' Authorized Representatives and Employees: Authorized representatives, shareholders, and employees of organizations with which İLERİ TRAFİK has commercial relations.

 İLERİ TRAFİK Visitors and Guests: Guests and visitors of İLERİ TRAFİK or real persons who visit websites operated by İLERİ TRAFİK.

Other Real Persons: All real persons not covered under the İLERİ TRAFİK Employees Personal Data Protection and Processing Policy.

5.2. PURPOSES OF PROCESSING PERSONAL DATA WITHIN THE SCOPE OF BUSINESS ACTIVITIES CARRIED OUT BY İLERİ TRAFİK

MAIN AND SUB-PURPOSES

1. Determination, planning, and implementation of İLERİ TRAFİK’s short-, medium-, and long-term commercial policies
   a. Planning and execution of training activities
   b. Management of relationships with business partners and suppliers

2. Design and execution of İLERİ TRAFİK’s Human Resources activities
   a. Execution of employee recruitment processes
   b. Planning and execution of internship and student recruitment, placement, and operational processes
   c. Planning of human resources processes
   d. Fulfillment of obligations arising from employment contracts and legislation for company employees
   e. Monitoring and supervision of employees’ work activities
   f. Planning and execution of fringe benefits and employee benefits
   g. Planning and execution of employee exit processes
   h. Planning and monitoring of employee performance evaluation processes
   i. Planning and execution of training activities
   j. Management of relationships with business partners and suppliers
   k. Wage and salary management
   l. Planning and execution of internal orientation activities

3. Carrying out necessary works by the relevant business units within the Company and executing activities accordingly, in order to ensure that the commercial activities carried out by İLERİ TRAFİK are performed in compliance with legislation and company policies
   a. Monitoring finance and accounting operations
   b. Conducting investor relations
   c. Planning and execution of corporate communication activities
   d. Performing efficiency, productivity, and appropriateness analyses of business activities
   e. Event management
   f. Establishment and management of information technology infrastructure
   g. Planning, auditing, and execution of information security processes
   h. Planning and execution of business continuity activities
   i. Planning and execution of access impacts of business partners and suppliers to information

4. Supporting the design, planning, and execution of İLERİ TRAFİK’s human resources activities
   a. Supporting the planning of İLERİ TRAFİK’s human resources strategies
   b. Monitoring and announcing transfers, temporary assignments, promotions, and separations of İLERİ TRAFİK employees
   c. Supporting the planning and execution of employee engagement measurement processes
   d. Supporting employee recruitment processes

5. Protection of İLERİ TRAFİK’s commercial reputation and the trust it has established
   a. Request and complaint management
   b. Conducting activities aimed at protecting the reputation of company values                                                                                                                                                                                             

 6. PRINCIPLES ADOPTED BY İLERİ TRAFİK REGARDING THE PROCESSING AND PROTECTION OF PERSONAL DATA

 6.1. CONDUCTING PERSONAL DATA PROCESSING ACTIVITIES IN ACCORDANCE WITH DATA PROCESSING CONDITIONS

İLERİ TRAFİK carries out personal data processing activities in compliance with (i) fundamental principles, (ii) personal data processing conditions, and (iii) special category personal data processing conditions.

6.1.1. Compliance with Fundamental Principles

Within the scope of compliance with personal data protection legislation and maintaining such compliance, the following fundamental principles are adopted by İLERİ TRAFİK:

1. Processing personal data in accordance with the law and principles of good faith
   İLERİ TRAFİK conducts personal data processing activities in compliance with personal data protection legislation, primarily the Constitution of the Republic of Türkiye, and in accordance with the law and principles of good faith. In order for customers to benefit from products and services offered by İLERİ TRAFİK at the highest service quality level, personal data are collected and processed within the limits determined by official legislation and within the scope of the conditions and purposes specified in Articles 5 and 6 of Law No. 6698.

2. Ensuring accuracy and up-to-dateness of processed personal data
   During personal data processing activities, İLERİ TRAFİK takes all necessary administrative and technical measures to ensure the accuracy and currency of personal data within the scope of technical possibilities. In this context, the Company carries out necessary actions to correct inaccurate personal data and verify their accuracy.

3. Processing personal data for specific, explicit, and legitimate purposes
   Personal data processing activities are carried out for purposes that are determined prior to the initiation of processing activities and are explicit and lawful. The primary purpose of processing personal data is to enhance the quality of services provided by İLERİ TRAFİK.

4. Processing personal data in a manner that is relevant, limited, and proportionate to the purpose
   Personal data are processed only to the extent necessary for the realization of data processing purposes and in connection with data processing conditions. Personal data are not processed based on assumptions of potential future use.

5. Retaining personal data for the period stipulated in relevant legislation or required for the purpose for which they are processed
   İLERİ TRAFİK retains personal data only for the period stipulated by legislation or required by the purpose of processing. Upon expiration of such periods or elimination of processing reasons, personal data are deleted, destroyed, or anonymized.

6.1.2. Compliance with Personal Data Processing Conditions

İLERİ TRAFİK conducts personal data processing activities in compliance with the processing conditions set forth in Article 5 of the PDPL. Accordingly, personal data processing activities are carried out in the presence of one or more of the following conditions:

1. Existence of the explicit consent of the data subject

2. Explicitly stipulated in laws

3. Mandatory processing due to the inability to obtain explicit consent because of actual impossibility

4. Directly related to the establishment or performance of a contract

5. Mandatory processing for the fulfillment of İLERİ TRAFİK’s legal obligations

6. Personal data having been made public by the data subject

7. Mandatory processing for the establishment, exercise, or protection of a right

8. Mandatory processing for the legitimate interests of İLERİ TRAFİK, provided that it does not harm the fundamental rights and freedoms of the data subject

6.1.3. Compliance with Special Category Personal Data Processing Conditions

İLERİ TRAFİK attaches particular importance to the processing of special category personal data, which may lead to discrimination if processed unlawfully. In this context, before processing special category personal data, İLERİ TRAFİK carefully determines whether the relevant data processing conditions exist and carries out the processing activity only after ensuring the existence of lawful grounds.

Special category personal data may be processed by İLERİ TRAFİK under the following circumstances, provided that adequate measures determined by the PDPL Board are taken:

1. Processing of Personal Health Data
   Personal health data may be processed by İLERİ TRAFİK in the presence of one of the following conditions:
   a. For the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing, insurance procedures, law enforcement and judicial processes, by persons under an obligation of confidentiality or authorized institutions and organizations; or
   b. With the explicit consent of the data subject.

2. Processing of Special Category Personal Data Other Than Health and Sexual Life
   Special category personal data other than health and sexual life (such as race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, association, foundation or union membership, criminal convictions and security measures, biometric and genetic data) may be processed by İLERİ TRAFİK with the explicit consent of the data subject or in cases stipulated by law.

6.1.4. Compliance with Personal Data Transfer Conditions

İLERİ TRAFİK acts in compliance with the personal data transfer conditions regulated under Articles 8 and 9 of the PDPL in all personal data transfer activities.

1. Transfer of Personal Data Within the Country
   Pursuant to Article 8 of the PDPL, personal data transfers within the country are carried out in compliance with personal data processing conditions.

2. Transfer of Personal Data Abroad
   Pursuant to Article 9 of the PDPL, personal data may be transferred abroad provided that personal data processing conditions are met and the recipient country has adequate protection as declared by the PDPL Board, or where adequate protection is not available, provided that the data controllers in Türkiye and the relevant foreign country undertake in writing to ensure adequate protection.

3. Groups of Persons to Whom Personal Data Are Transferred by İLERİ TRAFİK
   In accordance with Articles 8 and 9 of the PDPL, İLERİ TRAFİK may transfer personal data of data subjects within the scope of this Policy to the following groups, limited to the stated purposes:
   i. To İLERİ TRAFİK Group Companies, limited to the execution of commercial activities requiring group participation,
   ii. To İLERİ TRAFİK Business Partners, limited to the establishment and continuation of business partnerships,
   iii. To İLERİ TRAFİK Suppliers, limited to the provision of services required for the execution of commercial activities,
   iv. To authorized public institutions and organizations and authorized private legal entities, limited to the purpose requested within their legal authority,
   v. To third parties, in compliance with personal data transfer conditions.

6.2. INFORMING DATA SUBJECTS BY İLERİ TRAFİK

İLERİ TRAFİK carries out the necessary processes to ensure that data subjects are informed during the collection of personal data, in accordance with Article 10 of the PDPL and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform.

The information provided in the clarification texts presented to data subjects includes the following:

1. The title of the Company,

2. The purposes for which personal data will be processed,

3. To whom and for what purposes processed personal data may be transferred,

4. The method and legal grounds for collecting personal data,

5. The rights of the data subject, including:
   a. Learning whether personal data are processed,
   b. Requesting information if personal data have been processed,
   c. Learning the purpose of processing and whether data are used in accordance with such purpose,
   d. Knowing the third parties to whom personal data are transferred domestically or abroad,
   e. Requesting correction of incomplete or inaccurate personal data,
   f. Requesting deletion, destruction, or anonymization of personal data under the stipulated conditions,
   g. Requesting notification of the transactions carried out pursuant to (e) and (f) to third parties to whom data are transferred,
   h. Objecting to the occurrence of a result against the person through analysis of processed data exclusively by automated systems,
   i. Requesting compensation for damages arising from unlawful processing of personal data.

6.3. FINALIZATION OF DATA SUBJECT REQUESTS BY İLERİ TRAFİK

If data subjects submit their requests regarding personal data to the Company in writing or through other methods determined by the PDPL Board, İLERİ TRAFİK, as the data controller, carries out the necessary processes to finalize such requests as soon as possible and no later than thirty (30) days, in accordance with Article 13 of the PDPL.

For the purpose of ensuring data security, İLERİ TRAFİK may request information to verify whether the applicant is the data subject concerned. The Company may also ask questions to the data subject regarding their application to ensure proper handling of the request.

Requests may be rejected with justification in cases where fulfilling the request may prevent the rights and freedoms of others, require disproportionate effort, or where the information is publicly available.

6.3.1. Rights of Personal Data Subjects

Pursuant to Article 11 of the PDPL, by applying to our Company, data subjects may submit requests regarding the following matters:

1. Learning whether their personal data are processed,

2. Requesting information if their personal data have been processed,

3. Learning the purpose of processing their personal data and whether they are used in accordance with such purpose,

4. Learning the third parties to whom their personal data are transferred domestically or abroad,

5. Requesting correction of incomplete or inaccurate personal data and requesting notification of such correction to third parties to whom personal data have been transferred,

6. Requesting deletion, destruction, or anonymization of their personal data, despite being processed in accordance with the PDPL and other relevant laws, if the reasons requiring processing no longer exist, and requesting notification of such transactions to third parties to whom personal data have been transferred,

7. Objecting to the occurrence of a result against the data subject through analysis of processed data exclusively by automated systems,

8. Requesting compensation for damages in case of unlawful processing of personal data.

6.3.2. Cases Where the Rights of Personal Data Subjects Cannot Be Exercised Due to Legal Regulations

Pursuant to Article 28 of the PDPL, since the following cases fall outside the scope of the PDPL, personal data subjects may not assert their rights regarding the matters listed below:

1. Processing of personal data for artistic, historical, literary, or scientific purposes or within the scope of freedom of expression, provided that national defense, national security, public security, public order, economic security, privacy of private life, or personal rights are not violated and that no crime is committed.

2. Processing of personal data for research, planning, and statistical purposes by rendering them anonymous in the form of official statistics.

3. Processing of personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public security, public order, or economic security.

4. Processing of personal data by judicial authorities or enforcement offices in relation to investigation, prosecution, trial, or execution proceedings.

Pursuant to Article 28/2 of the PDPL, except for the right to claim compensation for damages, data subjects may not assert their rights in the following cases:

1. Processing of personal data is necessary for the prevention of crime or for criminal investigation.

2. Processing of personal data that have been made public by the data subject themselves.

3. Processing of personal data is necessary for supervisory or regulatory duties and for disciplinary investigation or prosecution carried out by authorized public institutions and organizations or professional organizations having the status of public institutions, based on the authority granted by law.

4. Processing of personal data is necessary for the protection of the economic and financial interests of the state regarding budgetary, tax, and financial matters.

6.4. PERSONAL DATA CATEGORIES PROCESSED AND CATEGORIES OF PARTIES WITH WHOM DATA ARE SHARED WITHIN THE SCOPE OF PERSONAL DATA PROCESSING ACTIVITIES CARRIED OUT BY İLERİ TRAFİK

6.4.1. Personal Data Categories

The personal data categories processed by İLERİ TRAFİK within the scope of personal data processing activities and their descriptions are set forth below:

Identity Information:
Personal data containing information related to a person’s identity, including name and surname, Turkish ID number, nationality information, mother’s and father’s name, place and date of birth, gender, driver’s license, identity card and passport, tax number, social security number, signature information, vehicle plate number, and similar data.

Contact Information:
Personal data such as phone number, address, e-mail address, and fax number.

Location Data:
Personal data determining the location of the place where the individual is located while using İLERİ TRAFİK vehicles and devices, such as GPS location and travel data.

Family Members and Relatives Information:
Personal data of the data subject’s family members (e.g., spouse, mother, father, children) and relatives, processed within the scope of operations carried out by İLERİ TRAFİK business units for the purpose of protecting the legal interests of both İLERİ TRAFİK and the data subject.

Physical Space Security Information:
Personal data relating to records and documents obtained during entry to physical premises and stay within such premises, such as camera records and fingerprint records.