Our company carries out the processing of personal data of our customers, potential customers and their employees, partners and representatives for the following purposes. These data processing activities include all natural person personal data owners who are processed automatically or by non-automatic means, provided that they are part of any data recording system.

Our company acts in accordance with the Constitution and the "Personal Data Protection Law" numbered 6698 in the processing and storage of your personal data and takes the highest level of security measures by showing the utmost sensitivity to ensure the security of your personal data.

With this text, it is aimed to fulfill our obligation to inform you about the purposes of processing your personal data, legal grounds and your rights arising from Article 10 of the "Personal Data Protection Law" numbered 6698.

1. DATA CONTROLLER AND REPRESENTATIVE

In accordance with the Law on the Protection of Personal Data No. 6698 ("PDPL"), your personal data will be processed by ARTAŞ ENERJİ YATIRIMLARI SANAYİ VE TİCARET ANONİM ŞİRKETİ ("Company" or "Artaş Enerji") as the data controller, as described below and within the limits set by the legislation, including the Artaş Enerji website or Artaş Enerji mobile application.

2. PURPOSE OF PROCESSING PERSONAL DATA AND LEGAL REASON

During your use of the products and services offered by our company, your personal data described in detail below are processed in accordance with the basic principles in Article 4 of the Law.

In order for our company to carry out its activities in the best way possible, the collection, use and processing of some of your personal data is of high importance. Your personal data are processed for the following legal reasons;

• a. Ensuring legal and commercial security,
• b. Regulation and compliance and management of legal processes,
• c. Maintaining relations with public institutions and other organizations,
• d. Execution and conduct of the processes of determining human resources policies,
• e. Carrying out support services and obligations, corporate communication activities,
• f. Planning and execution of corporate sustainability, corporate governance, strategic planning and information security processes,
• g. Preparation of applications,
• h. Follow-up of financial issues,
• i. Conducting litigation and enforcement proceedings to which our company is a party,
• j. Establishing, operating and backing up the IT and network operating system infrastructure,
• k. Ensuring the security and supervision of our company's locations,
• l. Execution of purchase-sale, tender and sales transactions
• m. Carrying out the necessary processes for you to benefit from the products and services offered by the company
• n. Performance of the contract and execution of customer complaints and requests processes
• o. Carrying out analysis processes in order to provide special services for your requests related to our products and services
• p. Ensuring healthy communication by managing customer relations and ensuring customer satisfaction
• q. Carrying out the performance processes of the Charging Service
• r. Carrying out support services activities after Charging Service
• s. Execution of transfer processes related to the performance of the Charging Service
• t. Execution of marketing processes related to the services provided
• u. Execution, control and reporting of financial operations
• v. Execution of commitment processes to products and services
• w. Conducting business activities in compliance with legislation.

Your data shall be processed limited to the above specified purposes. Thus, the processing activity of our Company is carried out based on the legal reasons stated in Article 5 of the Law, "It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract", "It is mandatory for the legitimate interest of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject" and "It is mandatory for the data controller to fulfill its legal obligation". Personal data specified in Article 6 of the PDP Law are processed within the framework of the processing conditions and purposes specified in Article 6.

Your personal data is used and processed by our Company within the framework of and under the supervision of the PDP Law for the purpose of serving you in a serious confidentiality. While processing your data by our company, we pay attention to the accuracy of the data by complying with the law and the rule of honesty, not to use it outside the scope of the processing, to process it for legitimate purposes, to keep the data up-to-date and to keep it for a reasonable period of time required for the intended purpose.

3. WHAT PERSONAL DATA WE COLLECT?

4. METHOD AND LEGAL REASON FOR PERSONAL DATA COLLECTION

Your personal data is obtained through Artaş Enerji Mobile Application, Website Call Center, WhatsApp, ChatBot, E-mail and Social Media in line with the above-mentioned legal reasons within the scope of fulfilling the purposes under the first heading of this Clarification Text.

5. PARTIES TO WHOM YOUR PERSONAL DATA IS TRANSFERRED

Your personal data may be transferred to the following persons for the specified purposes in accordance with the conditions specified in the article of the Law on the transfer of personal data.

• a. Within the scope of our legal obligations, legally authorized public institutions, legally authorized private institutions and our business partners from whom we receive legal support
• b. Our group companies, Artaş İnşaat San. ve Tic. A.Ş., Doruk Ticaret Yatırımlar ve İnşaat A.Ş., Avrupaakent Gayrimenkul Yatırım Ortaklığı Anonim Şirketi, Vadistanbul Konaklama Hizmetleri A.Ş., Vadistanbul Sağlık Hizmetleri A.Ş., Vadistanbul Turizm Otelcilik A.Ş., Artaş Holding A.Ş., Bemay İnşaat San. ve Tic. A.Ş., Artaş Enerji Yatırımları San. ve Tic. A.Ş., Avrupaakent Aksoylar Adi Ortaklığı, Çamlıvadi Adi Ortaklığı, Esentepe Adi Ortaklığı, Pantur Turizm ve Tic. A.Ş., Pantur Otelcilik ve Turizm Hizmetleri A.Ş., our main shareholders, affiliated companies, group companies, subsidiaries, service provider companies that we receive support to perform the service we provide to you, our business partners, dealers, suppliers, legally authorized public institutions, organizations from which we receive services, domestic and international service(s) we use, domestic/foreign institutions from which we receive cloud services, persons and organizations that process data on behalf of the data controller, provide measurement, targeting, profiling support, audit companies, advertising and promotion agencies and private persons based on your explicit consent within the framework of the personal data processing conditions specified in Articles 8 and 9 of the Law.

6. PURPOSE OF PERSONAL DATA TRANSFER

Your personal data may be transferred in accordance with the conditions specified in the article of the Law on the transfer of personal data, for the following reasons and compulsorily.

• a. Data processing is mandatory for the legitimate interests of the data controller.
• b. In the event that it is obligatory for the data controller to fulfil its legal obligations.
• c. In the event data processing is required for the establishment, exercise or protection of a right.

7. YOUR RIGHTS AS A DATA SUBJECT

We hereby declare that you have the following rights as the data subject under Article 11 of the Act:

• ● To learn whether personal data has been processed or not,
• ● Requesting related information in case your personal data is processed,
• ● Learning the purpose of processing of your personal data and whether data are used in accordance with their purpose,
• ● Be informed about the third parties to whom personal data are transferred domestically or abroad,
• ● To request the correction of incomplete or incorrect processing of Personal Data;
• ● To request the deletion or destruction of your personal data in accordance with the provisions of Article 7 of the Law,
• ● To request notification to third parties to whom your personal data has been transferred that your personal data has been corrected, which has been processed incompletely or inaccurately,
• ● To request notification of the deletion or destruction of your personal data to third parties to whom your personal data has been transferred,
• ● To object to the emergence of a result against you by analyzing your processed data exclusively through automated systems,
• ● To request compensation for damages in case you suffer damage due to unlawful processing of your personal data.

In accordance with the provisions of the Communiqué on the Procedures and Principles of Application to the Data Controller, if you submit your requests regarding your rights in writing to Ataköy 7-8-9-10.Kısım Mah. Çobançeşme E-5 Yanyol Cad. No:8/2/1-5 Bakırköy İstanbul address in writing, artasenerji@hs01.kep.tr kep address via secure electronic signature, mobile signature or, via the e-mail address you have previously notified to our Company and registered in our Company's systems, if any, to info@artasenergy.com address, your applications will be finalized free of charge within thirty days at the latest; however, if the transaction requires an additional cost, you may be charged a fee according to the tariff to be determined by the Personal Data Protection Board.