Our company carries out the processing of personal data of our customers, potential customers and their employees, partners and representatives for the following purposes. These data processing activities include all natural person personal data owners who are processed automatically or by non-automatic means, provided that they are part of any data recording system.

Our company acts in accordance with the Constitution and the "Personal Data Protection Law" numbered 6698 in the processing and storage of your personal data and takes the highest level of security measures by showing the utmost sensitivity to ensure the security of your personal data.

With this text, it is aimed to fulfill our obligation to inform you about the purposes of processing your personal data, legal grounds and your rights arising from Article 10 of the "Personal Data Protection Law" numbered 6698.

1. DATA CONTROLLER AND REPRESENTATIVE

In accordance with the Law on the Protection of Personal Data No. 6698 ("PDPL"), your personal data will be processed by ARTAŞ ENERJİ YATIRIMLARI SANAYİ VE TİCARET ANONİM ŞİRKETİ ("Company" or "Artaş Enerji") as the data controller, as described below and within the limits set by the legislation, including the Artaş Enerji website or Artaş Enerji mobile application.

2. PURPOSE OF PROCESSING PERSONAL DATA AND LEGAL REASON

During your use of the products and services offered by our company, your personal data described in detail below are processed in accordance with the basic principles in Article 4 of the Law.

In order for our company to carry out its activities in the best way possible, the collection, use and processing of some of your personal data is of high importance. Your personal data are processed for the following legal reasons;

• a. Ensuring legal and commercial security,
• b. Regulation and compliance and management of legal processes,
• c. Maintaining relations with public institutions and other organizations,
• d. Execution and conduct of the processes of determining human resources policies,
• e. Carrying out support services and obligations, corporate communication activities,
• f. Planning and execution of corporate sustainability, corporate governance, strategic planning and information security processes,
• g. Preparation of applications,
• h. Follow-up of financial issues,
• i. Conducting litigation and enforcement proceedings to which our company is a party,
• j. Establishing, operating and backing up the IT and network operating system infrastructure,
• k. Ensuring the security and supervision of our company's locations,
• l. Execution of purchase-sale, tender and sales transactions
• m. Carrying out the necessary processes for you to benefit from the products and services offered by the company
• n. Performance of the contract and execution of customer complaints and requests processes
• o. Carrying out analysis processes in order to provide special services for your requests related to our products and services
• p. Ensuring healthy communication by managing customer relations and ensuring customer satisfaction
• q. Carrying out the performance processes of the Charging Service
• r. Carrying out support services activities after Charging Service
• s. Execution of transfer processes related to the performance of the Charging Service
• t. Execution of marketing processes related to the services provided
• u. Execution, control and reporting of financial operations
• v. Execution of commitment processes to products and services
• w. Conducting business activities in compliance with legislation.

Personal data is processed solely for the purposes specified above. Accordingly, our Company's personal data processing activities are based on the legal grounds set forth in Article 5 of the Personal Data Protection Law, namely: “Processing of personal data is necessary, provided that it is directly related to the establishment or performance of a contract and concerns the parties to that contract,” “Processing of personal data is necessary for the legitimate interests of the data controller, provided that such processing does not violate the fundamental rights and freedoms of the data subject,” “Processing of personal data is necessary for the data controller to fulfill its legal obligations,” “Processing of personal data is necessary for the establishment, exercise, or protection of a right,” and “The explicit consent of the data subject has been obtained for advertising, campaign, promotional, and marketing activities.” Special categories of personal data specified in Article 6 of the Personal Data Protection Law are processed in accordance with the conditions and purposes of processing stipulated in that Article.

Your personal data is used and processed by our Company within the framework of and under the supervision of the PDP Law for the purpose of serving you in a serious confidentiality. While processing your data by our company, we pay attention to the accuracy of the data by complying with the law and the rule of honesty, not to use it outside the scope of the processing, to process it for legitimate purposes, to keep the data up-to-date and to keep it for a reasonable period of time required for the intended purpose.

3. WHAT PERSONAL DATA WE COLLECT?

4. METHOD AND LEGAL REASON FOR PERSONAL DATA COLLECTION

Your personal data is obtained through Artaş Enerji Mobile Application, Website Call Center, WhatsApp, ChatBot, E-mail and Social Media in line with the above-mentioned legal reasons within the scope of fulfilling the purposes under the first heading of this Clarification Text.

5. PARTIES TO WHOM YOUR PERSONAL DATA IS TRANSFERRED

Your personal data may be transferred to the following persons for the specified purposes in accordance with the conditions specified in the article of the Law on the transfer of personal data.

• a. Within the scope of our legal obligations, legally authorized public institutions, legally authorized private institutions and our business partners from whom we receive legal support
• b. Your personal data may be transferred to our group companies, namely Artaş İnşaat San. ve Tic. A.Ş., Doruk Ticari Yatırımlar ve İnşaat A.Ş., Avrupakent Gayrimenkul Yatırım Ortaklığı Anonim Şirketi, Vadistanbul Konaklama Hizmetleri A.Ş., Vadistanbul Sağlık Hizmetleri A.Ş., Vadistanbul Turizm Otelcilik A.Ş., Artaş Holding A.Ş., Bemay İnşaat San. ve Tic. A.Ş., Artaş Enerji Yatırımları San. ve Tic. A.Ş., Avrupakent Aksoylar Adi Ortaklığı, Çamlıvadi Adi Ortaklığı, Esentepe Adi Ortaklığı, Pantur Turizm ve Tic. A.Ş., and Pantur Otelcilik ve Turizm Hizmetleri A.Ş., as well as to our principal shareholders, affiliated companies, group companies, subsidiaries, service providers from whom we receive support in delivering our services to you, business partners, dealers, suppliers, legally authorized public institutions, organizations from which we procure services, domestic and international servers used by our Company, domestic and international cloud service providers, individuals and organizations processing personal data on behalf of the data controller or providing measurement, targeting, and profiling services, auditing firms, advertising and promotional agencies, and private individuals, in accordance with the conditions for transferring personal data stipulated in Article 8 of the Personal Data Protection Law. With respect to international transfers of personal data, such transfers may only be carried out provided that an adequacy decision, appropriate safeguards, or exceptional transfer conditions specified by law are in place, as stipulated in Article 9 of the Personal Data Protection Law.

6. PURPOSE OF PERSONAL DATA TRANSFER

Your personal data may be transferred in accordance with the conditions specified in the article of the Law on the transfer of personal data, for the following reasons and compulsorily.

• a. Data processing is mandatory for the legitimate interests of the data controller.
• b. In the event that it is obligatory for the data controller to fulfil its legal obligations.
• c. In the event data processing is required for the establishment, exercise or protection of a right.

7. YOUR RIGHTS AS A DATA SUBJECT

We hereby declare that you have the following rights as the data subject under Article 11 of the Act:

• ● To learn whether personal data has been processed or not,
• ● Requesting related information in case your personal data is processed,
• ● Learning the purpose of processing of your personal data and whether data are used in accordance with their purpose,
• ● Be informed about the third parties to whom personal data are transferred domestically or abroad,
• ● To request the correction of incomplete or incorrect processing of Personal Data;
• ● To request the deletion or destruction of your personal data in accordance with the provisions of Article 7 of the Law,
• ● To request notification to third parties to whom your personal data has been transferred that your personal data has been corrected, which has been processed incompletely or inaccurately,
• ● To request notification of the deletion or destruction of your personal data to third parties to whom your personal data has been transferred,
• ● To object to the emergence of a result against you by analyzing your processed data exclusively through automated systems,
• ● To request compensation for damages in case you suffer damage due to unlawful processing of your personal data.

In accordance with the provisions of the Communiqué on the Procedures and Principles of Application to the Data Controller, if you submit your requests regarding your rights in writing to Ataköy 7-8-9-10.Kısım Mah. Çobançeşme E-5 Yanyol Cad. No:8/2/1-5 Bakırköy İstanbul address in writing, artasenerji@hs01.kep.tr kep address via secure electronic signature, mobile signature or, via the e-mail address you have previously notified to our Company and registered in our Company's systems, if any, to info@artasenergy.com address, your applications will be finalized free of charge within thirty days at the latest; however, if the transaction requires an additional cost, you may be charged a fee according to the tariff to be determined by the Personal Data Protection Board.