INFORMATION FORM ON THE COLLECTION AND PROCESSING OF PERSONAL DATA

As Burboya, Bursa Boya Kimya San. ve Tic A.Ş., in the capacity of Data Controller under Law No. 6698 on the Protection of Personal Data (“KVKK”) and related legislation, your personal data may be processed within the scope explained below and in accordance with other relevant legislation.

1. DEFINITIONS

Explicit Consent: Consent on a specific matter, based on information, and declared with free will.

Relevant User: Persons who process personal data within the data controller organization or in line with the authorization and instructions received from the data controller, excluding the person or unit responsible for the technical storage, protection and backup of the data.

Anonymization of Personal Data: Rendering personal data unable to be associated with an identified or identifiable natural person under any circumstances, even by matching with other data.

Personal Data: Any information relating to an identified or identifiable natural person.

Processing of Personal Data: Any operation performed on data such as collection, recording, storage, preservation, alteration, rearrangement, disclosure, transfer, takeover, making available, classification or preventing the use thereof, by fully or partially automatic means or by non-automatic means, provided that it is part of a data recording system.

Destruction of Personal Data: The deletion, destruction or anonymization of personal data.

Deletion of Personal Data: Rendering personal data inaccessible and reusable in any way for relevant users.

Data Processor: The natural or legal person who processes personal data on behalf of the data controller based on the authority given.

Data Recording System: A recording system in which personal data is processed by being structured according to specific criteria.

Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

2. BASIC PRINCIPLES IN THE PROCESSING OF PERSONAL DATA

Article 4 of the KVKK contains the principles that must be followed in the processing of personal data. These principles are as follows:

a. Compliance with the law and the rule of good faith: Our Company processes Personal Data in accordance with the applicable legislation and the requirements of the rule of good faith and uses it within these limits.

b. Being accurate and up-to-date when necessary: Our Company ensures that the Personal Data it processes is accurate and up-to-date, taking into account the fundamental rights and legitimate interests of Personal Data Owners. In this context, it carefully considers matters such as the sources from which the data is obtained being specific, verifying its accuracy, and evaluating whether it needs to be updated.

c. Processing for specific, explicit and legitimate purposes: The KVKK requires data processing activities to be carried out for specific, explicit and legitimate purposes. Within this framework, our Company conducts personal data processing activities for specific, explicit and legitimate purposes required by our commercial activities.

ç. Being related, limited and proportionate to the purposes for which they are processed: Our Company processes personal data to the extent necessary to realize the purposes determined within the scope of its commercial activities. Our Company does not process your personal data for areas other than the business it performs and the service it provides.

d. Retention for the period stipulated in the relevant legislation or required for the purpose for which they are processed: Burboya, Bursa Boya Kimya San. ve Tic A.Ş. retains Personal Data only for the period necessary for the purpose for which it is processed. If there is no valid reason to retain Personal Data any longer, it is deleted, destroyed or anonymized.

3. CONDITIONS FOR PROCESSING PERSONAL DATA

Burboya, Bursa Boya Kimya San. ve Tic A.Ş. does not process your personal data in any way without the explicit consent of the data subject. However, in the presence of any of the conditions set out in Article 5 of the KVKK below, it is possible to process the personal data of the relevant person without seeking their explicit consent. These conditions are:

* Existence of the explicit consent of the relevant person,

* Being explicitly stipulated in laws,

* It is mandatory for the protection of the life or bodily integrity of the person who cannot express consent due to actual impossibility or whose consent is not legally valid, or of another person,

* It is necessary to process personal data of the parties to a contract, provided that it is directly related to the establishment or performance of that contract,

* It is mandatory for the data controller to fulfill its legal obligation,

* Data made public by the data subject,

* Data processing is mandatory for the establishment, exercise or protection of a right,

* Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Our Company does not process Special Category Personal Data without the explicit consent of the person concerned. However, in cases stipulated by law, it may be processed without seeking the explicit consent of the relevant person.

4. COLLECTION AND PROCESSING OF PERSONAL DATA AND PURPOSES OF PROCESSING

Your personal data is processed in accordance with the basic principles set out in the KVKK, for the purposes of conducting our Company operational business processes, business relationships and human resources processes; meeting the demands of relevant persons and continuing technical processes; ensuring the commercial security of the Company; carrying out our work; and being used as evidence in legal disputes that may arise in the future. It is stored securely in a physical or electronic environment for an appropriate period. Burboya, Bursa Boya Kimya San. ve Tic A.Ş. acts in accordance with the obligations stipulated in all relevant legislation, primarily the KVKK.

· Your identity information: Your name, surname, T.R. Identity Number, passport number or temporary T.R. Identity Number, place and date of birth, marital status, gender, insurance number, and other identity data that may identify you;

· Your contact information: Your address, phone number, email address and other contact data; personal data obtained when you contact us via email, letter or other means;

· Your financial information: Financial data such as your bank account number, IBAN number, credit card information, billing and invoice information;

All kinds of personal data (including but not limited to Special Category Personal Data) obtained by Burboya, Bursa Boya Kimya San. ve Tic A.Ş. may be processed for the following purposes:

· Verifying your identity,

· Performance of risk management and quality improvement activities,

· Fulfillment of legal and regulatory requirements,

· Invoicing for our services,

· Sharing requested information with relevant public institutions in accordance with applicable legislation,

· Development and improvement of the services provided to you and ensuring customer satisfaction,

· Providing necessary information in line with requests and audits of regulatory and supervisory institutions and official authorities,

· Preserving information that must be kept under relevant legislation.

Your Personal Data obtained and processed in accordance with relevant legislation may be transferred to the physical archives and/or information systems of Burboya, Bursa Boya Kimya San. ve Tic A.Ş. and kept under protection both in digital and physical environments.

5. TRANSFER OF PERSONAL DATA

Your personal data may, within the scope of the Law and other relevant legislation and for the purposes stated above, be shared by Burboya, Bursa Boya Kimya San. ve Tic A.Ş. with: group companies of Burboya, Bursa Boya Kimya San. ve Tic A.Ş., our partners, our shareholders, the Social Security Institution, the General Directorate of Security and other law enforcement agencies, the General Directorate of Population, courts and any other judicial authority, central and other third parties, your authorized representatives, third parties from whom we receive consultancy including lawyers, tax and financial advisors, regulatory and supervisory institutions, official authorities, our business partners with whom we cooperate to develop or carry out our commercial activities for the purposes stated above, and other third parties.

6. METHOD AND LEGAL BASIS OF OBTAINING PERSONAL DATA

Your personal data is collected by Burboya, Bursa Boya Kimya San. ve Tic A.Ş. through different channels and based on the legal reasons stated above, in order to carry out our activities, to develop the services we provide and to carry out our commercial activities. In this framework, your personal data may be processed and transferred in the light of the principles stipulated in Article 4(2) of the KVKK by obtaining explicit consent, or, where the conditions set out in Articles 5(2) and 6(3) are met, without the need to obtain explicit consent.

7. YOUR RIGHTS REGARDING THE PROTECTION OF PERSONAL DATA

Your rights as a data subject under Article 11 of the KVKK are as follows.

Burboya, Bursa Boya Kimya San. ve Tic A.Ş. will conclude your request, depending on its nature, as soon as possible and at the latest within thirty (30) days, free of charge. However, if the process requires an additional cost, the fee set in the tariff determined by the Board may be charged.

• To learn whether personal data is processed,

• To request information about processed personal data,

• To learn the purpose of processing personal data and whether it is used for its intended purpose,

• To know the third parties to whom personal data is transferred at home or abroad,

• To request correction of personal data processed incompletely or incorrectly,

• To request the deletion or destruction of personal data within the framework of Article 7,

• To request that corrections, deletions or destructions be notified to third parties to whom the data has been transferred,

• To object to the emergence of a result against you as a result of the analysis of the processed data exclusively through automated systems,

• To claim compensation for damages suffered due to unlawful processing of personal data.

8. DATA SECURITY

Burboya, Bursa Boya Kimya San. ve Tic A.Ş. protects your personal data at an appropriate level against possible risks, in full compliance with all technical and administrative security controls required by information security standards and procedures.

9. CONDITIONS FOR DELETION, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA

Although personal data has been processed in accordance with the provisions of legislation, where the reasons requiring its processing disappear, or the mandatory retention periods stipulated by legislation expire, personal data is deleted, destroyed or anonymized by our Company ex officio or upon the request of the personal data owner.

In this context, our Company has developed the necessary technical and administrative measures within the Company to fulfill its relevant obligations and has developed the necessary operating mechanisms. Our Company trains, assigns and raises awareness of relevant business units to act in accordance with these obligations.

10. COMPLAINTS AND CONTACT

If you have rights you wish to exercise or requests within the scope of the articles above, you can send an email signed with your secure electronic signature to kvkk@burboya.com.tr, or you can send a “word or pdf.” file addressed to our company and signed with a secure e-signature to kvkk@burboya.com.tr. You can also apply in writing by post with a petition bearing your wet signature.