Personal Data Protection (KVKK) Clarification Text

1. Data Controller

Pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data ("KVKK"), your personal data is processed, within the scope and on the terms described below, by ACK Soğutma Sistemleri Sanayi Ticaret Limited Şirketi (the "Company") acting as the data controller. This Clarification Text has been prepared to fulfil the data controller's obligation to inform data subjects regarding the processing of personal data obtained from natural persons through the Company's website, and complements the Privacy Policy page; it is the text that shall prevail for the purposes of Article 10 of KVKK.

• Company name: ACK Soğutma Sistemleri Sanayi Ticaret Limited Şirketi
• Address: Kazım Karabekir Mah. 951. Sk. Uğurluoğlu Apt. No:19 A, Gaziosmanpaşa / İstanbul
• Tax Office / No: Küçükköy Tax Office — 0051505948
• Email: [email protected]
• Phone: +90 532 384 71 28

2. Categories of Personal Data Processed

The Company processes the following categories of personal data through its website and related communication channels:

• Identity data: full name,
• Contact data: email address, phone number, address,
• Customer transaction data: records relating to quote requests and order processes,
• Transaction security data: IP address, server/access logs, and cookie records,
• Financial data: information relating to invoicing and payment records (payment instrument data such as card number, expiry date and security code is not included in this category and is never recorded or stored on the Company's systems under any circumstances; where online payment through the website is introduced in the future, such data will be processed only in the systems of the relevant bank or payment institution).

3. Purposes of Processing Personal Data

The categories of personal data stated above are processed for the following purposes:

• the establishment and performance of a contract and responding to quote requests,
• fulfilling legal obligations arising from applicable legislation (invoicing, statutory retention periods, tax and commercial legislation, etc.),
• ensuring the security of the website, preventing misuse, and operating the technical infrastructure, within the scope of the Company's legitimate interests.

4. Legal Grounds for Processing Personal Data

Your personal data is processed based on the following legal grounds set out in the second paragraph of Article 5 of KVKK:

• (c) it is necessary to process personal data belonging to the parties of a contract, provided that it is directly related to the establishment or performance of the contract,
• (ç) it is mandatory for the data controller to fulfil its legal obligation,
• (e) it is mandatory for the establishment, exercise or protection of a right,
• (f) it is mandatory for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject.

In cases where none of the above legal grounds can be relied upon — in particular in cases such as the use of marketing cookies — the processing activity is carried out only where the explicit consent of the data subject has been obtained. Detailed information on cookies requiring explicit consent is available on the Cookie Policy page.

5. Transfer of Personal Data

Your personal data may be transferred, in accordance with the conditions set out in Articles 8 and 9 of KVKK, and limited to and proportionate with the purpose, to the following categories of recipients:

• hosting and database infrastructure service providers with which the Company has a contractual relationship, for the purposes of hosting the website and storing data (these providers have limited access solely for the performance of the technical infrastructure service and in accordance with the Company's instructions),
• where online payment through the website is introduced in the future, the relevant banks and payment institutions, for the purpose of carrying out payment transactions during the payment process (payment instrument data such as card number, expiry date and security code is never recorded or stored on the Company's systems under any circumstances),
• in the event of a legal request, and limited strictly to the scope of that request, the administrative or judicial authorities and other competent public institutions and organizations authorized by legislation.

Your personal data is not transferred to third parties other than in the cases listed above, without your explicit consent or unless one of the exceptions set out in KVKK applies.

6. Method of Collecting Personal Data

Your personal data is collected, partly through automated and partly through non-automated means, via electronic channels such as the contact and quote request forms on the website, the creation of a membership account, cookies (collected automatically), and direct communication established by email/phone.

7. Rights of the Data Subject (Article 11 of KVKK)

Pursuant to Article 11 of KVKK, a data subject whose personal data is processed has the right to apply to the Company and:

• learn whether their personal data is being processed;
• request information about it, if it has been processed;
• learn the purpose of processing and whether the data is used in accordance with that purpose;
• know the third parties to whom the personal data is transferred, domestically or abroad;
• request correction of personal data if it has been processed incompletely or incorrectly;
• request the erasure or destruction of personal data within the conditions set out in Article 7 of KVKK;
• request that the actions taken pursuant to correction, erasure or destruction requests be notified to third parties to whom the personal data has been transferred;
• object to the emergence of a result against the data subject through the exclusive analysis of the processed data via automated systems;
• request compensation for damage arising from the unlawful processing of personal data.

8. Method of Application

You may submit requests relating to the rights listed above, in accordance with the procedure set out in the Communiqué on the Procedures and Principles of Application to the Data Controller, together with information and documents verifying your identity, in writing to [email protected] or to Kazım Karabekir Mah. 951. Sk. Uğurluoğlu Apt. No:19 A, Gaziosmanpaşa / İstanbul. Your request will be concluded, depending on its nature, as soon as possible and within thirty (30) days at the latest, free of charge, or at the tariff determined by the Personal Data Protection Board where applicable.