Personal Data Processing and Protection Policy

Addressees:

All natural persons, other than the employees of Organo Tarım Teknolojileri Sanayi ve Ticaret A.Ş., whose Personal Data is processed by Organo Tarım Teknolojileri Sanayi ve Ticaret A.Ş.

Prepared by:

Organo Tarım Teknolojileri Sanayi ve Ticaret A.Ş. PDP Compliance Committee

Approved by:

Organo Tarım Teknolojileri Sanayi ve Ticaret A.Ş. Board of Directors

VERSION: 1.0

Effective Date: 06/08/2026

© Organo Tarım Teknolojileri Sanayi ve Ticaret A.Ş. 2026

This document may not be reproduced or distributed without the written permission of Organo Tarım Teknolojileri Sanayi ve Ticaret A.Ş.

1.INTRODUCTION

1.1Introduction

Organo Tarım Teknolojileri Sanayi ve Ticaret A.Ş. (the “Company”) attaches the utmost importance to protecting the fundamental rights and freedoms of individuals, primarily the privacy of private life regulated in Article 20 of the Constitution, in the protection and processing of personal data. Within this framework, it takes care to protect and process personal data lawfully pursuant to the Personal Data Protection Law No. 6698 (the “Law” or the “PDP Law”) and acts with this understanding in all its planning and activities.

Our Company does not consider the protection and processing of personal data, which is the basis of the privacy of private life, solely within the scope of compliance with the legislation; it places the value it attaches to people at the basis of its approach. Acting with this awareness, our Company takes all necessary administrative and technical measures for the lawful protection and processing of personal data.

1.2Purpose of the Policy

The purpose of the Personal Data Processing and Protection Policy (the “Policy”) is, in line with the purpose of the Law, to protect to the utmost extent the fundamental rights and freedoms of individuals, primarily the privacy of private life regulated in Article 20 of the Constitution, in the protection and processing of personal data processed wholly or partly by automated means or by non-automated means provided that they form part of a data recording system, and to inform personal data subjects (relevant persons) about our Company’s obligations and the procedures and principles it will comply with pursuant to the Law. In line with the purpose of the Policy, it is aimed to ensure full compliance with the legislation in the personal data protection and processing activities carried out by our Company and to protect the personal data subjects’ right to the privacy of private life and data security.

1.3Scope of the Policy

This Policy covers, provided that they are natural persons, Employee Candidates, Shareholders/Partners, Potential Product or Service Buyers, Interns, Supplier Employees, Supplier Officials, Product or Service Recipients, Reference Persons and Visitors, and will be applied to these persons. The Company informs these personal data subjects about the Law by publishing this Policy on its website. This Policy will not be applied to legal entities in whatever capacity. For our Company’s employees, the “Personal Data Processing and Protection Policy for Employees” will be applied.

This Policy will be applied to the relevant persons specified above where their personal data is processed by our Company wholly or partly by automated means or by non-automated means provided that they form part of a data recording system. This Policy will not be applied if the data does not fall within the scope of “Personal Data” as specified below or if the personal data processing activity carried out by our Company is not carried out by the means specified above.

1.4Definitions

The concepts used in the implementation of this Policy have the meanings given below:

1.5Entry into Force of the Policy

The Policy, issued by Organo Tarım Teknolojileri Sanayi ve Ticaret A.Ş. and entered into force on 06/08/2026, is published on the Company’s website (www.organotarim.com.tr) and made available to the relevant persons.

2.PROTECTION OF PERSONAL DATA

2.1Security of Personal Data

Pursuant to the Law, our Company takes all necessary administrative and technical measures to ensure an appropriate level of security in order to store personal data securely and to prevent the unlawful processing of and access to personal data. The administrative and technical measures taken regarding the security of personal data are regulated in detail in our Company’s Personal Data Retention and Destruction Policy.

In order to ensure that it acts in accordance with the regulations in the Law and other legislation, our Company has established the “Personal Data Protection Management System” and, within this scope, has formed a Personal Data Protection Committee within its organization to ensure the implementation of the Policy and other relevant policies.

2.2Audit

Our Company carries out, and has carried out, the necessary audits in order to establish the data security explained above and to ensure the regularity and continuity of the measures taken. The Personal Data Protection Committee audits the measures taken for the security of personal data.

2.3Confidentiality

Our Company takes all necessary administrative and technical measures, according to technological possibilities and implementation costs, so that the relevant data controllers and data processors do not disclose the personal data in their possession to others in breach of the provisions of the Law and the Policy and do not use it for purposes other than the purpose of processing. In this context, information and training activities about the Law and the Policy are carried out for company employees, and the relevant employees are made to sign confidentiality agreements as part of their recruitment processes.

2.4Unauthorized Disclosure of Personal Data

If the personal data processed by our Company is obtained by others through unlawful means, our Company carries out the necessary procedures for this situation to be notified to the relevant person and to the PDP Board within the periods determined by the PDP Board. If deemed necessary by the PDP Board, this situation is announced on the PDP Board’s website or by another method deemed appropriate by the PDP Board.

2.5Observing the Legal Rights of Relevant Persons

Our Company observes all legal rights of relevant persons relating to the implementation of the Policy and the Law and takes all necessary measures to protect these rights.

2.6Protection of Special Categories of Personal Data

Data relating to persons’ race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data, are special categories of personal data. Our Company is aware that special categories of personal data are data of a nature that may cause the relevant person to be victimized or subjected to discrimination if learned by others, and for this reason it carefully takes the adequate measures determined by the Board to protect such personal data processed lawfully. Within this framework, it has a separate policy (Policy on the Security of Special Categories of Personal Data) and procedure that is systematic, with clearly defined rules, manageable and sustainable.

3.PROCESSING AND TRANSFER OF PERSONAL DATA

3.1General Principles in the Processing and Transfer of Personal Data

Personal data is processed by our Company in accordance with the procedures and principles stipulated in the Law and in this Policy. Our Company complies with the following principles when processing personal data.

3.1.1Compliance with the Law and the Rules of Good Faith

Our Company processes personal data in accordance with the relevant legislation and the requirements of the rule of good faith and uses it within these limits. Pursuant to the principle of compliance with the rule of good faith, our Company takes into account the interests and reasonable expectations of the relevant persons while trying to achieve its objectives in data processing. It acts in a way that prevents the occurrence of results that the relevant person does not expect and should not be expected to expect. Pursuant to the principle, it also ensures that the data processing activity in question is transparent for the relevant person and acts in accordance with its obligations to inform and warn.

3.1.2Being Accurate and, Where Necessary, Up to Date

Taking into account the fundamental rights and legitimate interests of the relevant persons, our Company ensures that the personal data it processes is accurate and up to date. In this context, it carefully considers matters such as the sources from which the data is obtained being specific, the accuracy of the data being verified and whether the data needs to be updated being assessed. Pursuant to its active duty of care, our Company always keeps open the channels that will ensure that the personal data subject’s information is accurate and up to date. Keeping personal data accurate and up to date is necessary not only to protect our Company’s interests but also to protect the fundamental rights and freedoms of the relevant person.

3.1.3Processing for Specific, Explicit and Legitimate Purposes

Our Company determines the purpose of data processing clearly and precisely and ensures that this purpose is legitimate. The purpose being legitimate means that the personal data processed by our Company is connected with and necessary for the work it carries out or the service it provides. Our Company does not process data for purposes other than these stated purposes. Accordingly, it is meticulous in complying with the principle of specificity and clarity in the legal transactions and texts in which the purposes of processing personal data are explained.

3.1.4Being Relevant, Limited and Proportionate to the Purposes for Which They Are Processed

Our Company ensures that the personal data processed is suitable for achieving the determined purposes and avoids processing data that is not related to or not needed for achieving the purpose. Our Company does not collect or process personal data for purposes that do not currently exist and are expected to arise later. In order to process data to meet needs that are likely to arise later, it fulfils the processing conditions regulated in the Law as if it were starting processing for the first time. In addition, it limits the processed data only to what is necessary for achieving the purpose. Within the scope of the principle of proportionality, it establishes a reasonable balance between data processing and the purpose intended to be achieved.

3.1.5Being Retained for the Period Stipulated in the Relevant Legislation or Necessary for the Purpose for Which They Are Processed

If there is a period stipulated in the relevant legislation for the retention of data, our Company complies with these periods; otherwise, it retains personal data only for the period necessary for the purpose for which they are processed. If there is no valid reason for a personal data to be stored further by our Company, the data in question is erased, destroyed or anonymized. The procedures for the retention and destruction of personal data are regulated in detail in our Company’s Personal Data Retention and Destruction Policy.

3.2Conditions for Processing Personal Data

Our Company does not process personal data without the explicit consent of the relevant person. Personal data may be processed without seeking the explicit consent of the relevant person only if one of the following conditions exists:

3.2.1Being Expressly Stipulated in the Laws

Our Company may process personal data without seeking the explicit consent of the relevant person in cases expressly stipulated by law.

3.2.2Being Mandatory for the Protection of the Life or Physical Integrity of the Person Himself/Herself or of Another Person, Where the Person Is Unable to Express His/Her Consent Due to Actual Impossibility or Whose Consent Is Not Deemed Legally Valid

In cases where consent cannot be expressed or is not valid, our Company may process personal data without seeking explicit consent in order to protect the life or physical integrity of persons.

3.2.3Processing of Personal Data Belonging to the Parties of a Contract Being Necessary, Provided That It Is Directly Related to the Establishment or Performance of the Contract

Where it is mandatory to process the personal data of the parties to a contract in direct relation to the establishment or performance of the contract, our Company may, in accordance with the ordinary course of life, process the personal data of the relevant persons without seeking explicit consent, limited to this purpose.

3.2.4Being Mandatory for Our Company to Fulfil Its Legal Obligation

As a data controller, our Company may process the personal data of the relevant person without seeking explicit consent in cases where it is mandatory in order to fulfil its legal obligations.

3.2.5Having Been Made Public by the Relevant Person Himself/Herself

Our Company may process the personal data that has been made public by the relevant persons themselves, in other words disclosed to the public in any way, limited to the purpose of making it public, since it is accepted that the legal interest that needs to be protected in the processing of such data, which has been made public by the relevant persons and has thus become knowable by everyone, has ceased to exist.

3.2.6Data Processing Being Mandatory for the Establishment, Exercise or Protection of a Right

Our Company may process the personal data of the relevant persons without seeking explicit consent in cases where data processing is mandatory for the exercise or protection of a legally legitimate right.

3.2.7Data Processing Being Mandatory for the Legitimate Interests of Our Company, Provided That It Does Not Harm the Fundamental Rights and Freedoms of the Relevant Persons

Our Company may process the personal data of the relevant persons in cases where the processing of personal data is mandatory to ensure its legitimate interests, provided that it does not harm the fundamental rights and freedoms of the relevant persons protected under the Law and the Policy. Our Company shows the necessary care in complying with the basic principles regarding the protection of personal data and in observing the balance of interests between our Company and personal data subjects. Legitimate interest means an interest that is legitimate, effective at a level that can compete with the fundamental right and freedom of the relevant person, specific and currently existing. Our Company takes additional protective measures so that the rights of the relevant person are not harmed. A reasonable balance is ensured between the interest of our Company and the fundamental rights and freedoms of the relevant person.

3.3Conditions for Processing Special Categories of Personal Data

Our Company processes special categories of personal data in the presence of the cases listed below;

a) The explicit consent of the relevant person,

b) Being expressly stipulated in the laws,

c) Being mandatory for the protection of the life or physical integrity of the person himself/herself or of another person, where the person is unable to express his/her consent due to actual impossibility or whose consent is not deemed legally valid,

ç) Relating to personal data made public by the relevant person and being in accordance with the will to make it public,

d) Being mandatory for the establishment, exercise or protection of a right,

e) Being necessary, by persons under the obligation of confidentiality or by authorized institutions and organizations, for the purposes of protecting public health, preventive medicine, conducting medical diagnosis, treatment and care services, and planning, managing and financing health services,

f) Being mandatory for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance,

g) Being directed at current or former members and affiliates of foundations, associations and other non-profit organizations or formations established for political, philosophical, religious or trade union purposes, or at persons in regular contact with these organizations and formations, provided that it is in accordance with the legislation to which they are subject and their purposes, limited to their fields of activity and not disclosed to third parties.

3.4Conditions for Transferring Personal Data

By taking the necessary security measures, our Company may transfer personal data to third parties pursuant to Article 8 of the Law, based on and limited to one or more of the personal data processing conditions specified below:

• The explicit consent of the relevant person,
• There being an explicit provision in the laws regarding the transfer of personal data,
• The transfer of personal data being mandatory for the protection of the life or physical integrity of the relevant person or of another person, and the relevant person being unable to express his/her consent due to actual impossibility or his/her consent not being deemed legally valid,
• The transfer of personal data belonging to the parties of a contract being necessary, provided that it is directly related to the establishment or performance of the contract,
• The transfer of personal data being mandatory for our Company to fulfil its legal obligation,
• The personal data having been made public by the relevant person,
• The transfer of personal data being mandatory for the establishment, exercise or protection of a right,
• The transfer of personal data being mandatory for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the relevant person.

As for special categories of personal data, our Company may transfer them, taking adequate measures, if the personal data subject has given explicit consent, or by taking the necessary security measures, provided that it is based on and limited to one of the conditions listed in Article 8 of the Law.

4.PERSONAL DATA CATEGORIES AND DATA SUBJECT GROUPS

4.1Personal Data Categories

Personal data is processed by our Company by being categorized as follows:

4.2Data Subject Groups

Only natural persons can benefit from the protection of this Policy and the Law. The personal data subjects within this scope are grouped as follows:

5.METHOD OF COLLECTING PERSONAL DATA AND LEGAL GROUND

5.1Method of Collecting Personal Data

In line with the purposes specified in article 6.1, our Company collects personal data wholly or partly by automated or non-automated means; in any verbal, written or electronic environment; through the following channels, but without being limited to them:

• Job application forms,
• Customer information forms,
• Various documents submitted to the Company,
• Mail and e-mails sent to the Company,
• In-house documents (Interview Evaluation Reports, Human Resources Forms, General Assembly/Board of Directors Documents, Signature Circulars, Forms Specified in Company Regulations, etc.)
• Call centre,
• Company website,
• Social media tools,
• Third parties such as persons and companies to which the Company provides services or from which it receives services, business partners, subcontractors, firms from which it procures services/products and group companies,
• Employment agencies and job search portals,
• Corporate communication accounts and devices,
• Software and information systems and devices used by the Company,
• Security cameras,
• Systems such as GPS, OGS and vehicle recognition. (For Company Shareholders/Partners, Business Partner Officials, Business Partner Employees, Company Officials)

5.2Legal Ground for Collecting Personal Data

Our Company collects personal data based on one of the legal grounds specified below pursuant to Articles 5 and 6 of the Law:

• The explicit consent of the relevant person,
• Being expressly stipulated in the laws;
• The personal data having been made public by the relevant person himself/herself,
• The processing of personal data belonging to the parties of a contract being necessary, provided that it is directly related to the establishment or performance of the contract,
• Being mandatory for our Company to fulfil its legal obligation,
• Data processing being mandatory for the establishment, exercise or protection of a right,
• Data processing being mandatory for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the relevant persons.

6.PURPOSES OF PROCESSING PERSONAL DATA

6.1Matching the Personal Data Categories of the Data Subject Groups With the Purposes of Processing

The matching of the personal data categories of the data subject groups, whose definitions and scopes are given above, with the purposes of processing is presented below: (Natural persons can be included in only one group of persons.)

Employee Candidate

Data Categories: Identity, Contact, Personnel, Professional Experience, Health, Criminal Conviction and Security Measures, Visual and Audio Records,

Purposes of Processing: Conducting Employee Candidate/Intern Selection and Placement Processes, Conducting the Application Processes of Employee Candidates, Conducting Communication Activities, Conducting Audit/Ethics Activities

Company Shareholder/Partner

Data Categories: Identity, Contact, Location, Personnel, Legal Transaction, Physical Premises Security, Transaction Security, Finance, Professional Experience, Visual and Audio Records, Health Information

Purposes of Processing: Conducting Finance and Accounting Affairs, Conducting Activities in Accordance with the Legislation, Conducting Fringe Benefits and Interests Processes, Conducting Investment Processes, Providing Information to Authorized Persons/Institutions and Organizations, Following Up and Conducting Legal Affairs, Conducting Communication Activities, Conducting Emergency Management Processes, Conducting / Auditing Business Activities, Conducting Contract Processes, Conducting Audit/Ethics Activities, Conducting Assignment Processes, Planning Human Resources Processes, Conducting Occupational Health/Safety Activities, Conducting Emergency Management Processes, Conducting Management Activities, Ensuring Physical Premises Security

Potential Product or Service Buyers

Data Categories: Identity, Contact, Physical Premises Security, Visual and Audio Records

Purposes of Processing: Conducting goods/services sales processes, Conducting customer relationship management processes, Conducting marketing analysis studies, Conducting product/service marketing processes, Conducting/auditing business activities, Conducting communication activities, Conducting contract processes,

Intern

Data Categories: Identity, Contact, Personnel, Health, Criminal Conviction and Security Measures Visual and Audio Records, Finance, Location, Physical Premises Security

Purposes of Processing: Conducting Employee Candidate/Intern Selection and Placement Processes, Conducting Communication Activities, Conducting Emergency Management Processes, Conducting / Auditing Business Activities, Conducting Activities in Accordance with the Legislation, Conducting Performance Evaluation Processes, Conducting Audit/Ethics Activities, Ensuring Physical Premises Security, Conducting Finance and Accounting Affairs, Fulfilling Obligations Arising from the Employment Contract/Legislation for Employees, Conducting Information Security Processes, Conducting access authorizations, Following Up and Conducting Legal Affairs, Providing Information to Authorized Persons/Institutions and Organizations

Supplier Official

Data Categories: Identity, Contact, Finance, Physical Premises Security, Legal Transaction, Visual and Audio Records

Purposes of Processing: Conducting Activities in Accordance with the Legislation, Conducting Contract Processes, Conducting / Auditing Business Activities, Conducting Communication Activities, Conducting Finance and Accounting Affairs, Ensuring Physical Premises Security, Conducting Audit/Ethics Activities, Following Up Requests/Complaints, Following Up and Conducting Legal Affairs, Providing Information to Authorized Persons/Institutions and Organizations

Supplier Employee

Data Categories: Identity, Contact, Physical Premises Security, Visual and Audio Records

Purposes of Processing: Conducting / Auditing Business Activities, Conducting Goods/Services Procurement Processes, Conducting Goods/Services/Production and Operation Processes, Conducting Communication Activities, Ensuring Physical Premises Security, Conducting Audit/Ethics Activities, Following Up Requests/Complaints, Following Up and Conducting Legal Affairs, Conducting Activities in Accordance with the Legislation, Providing Information to Authorized Persons/Institutions and Organizations, Conducting Contract Processes

Product or Service Recipient

Data Categories: Identity, Contact, Legal Transaction, Customer Transaction, Physical Premises Security, Finance, Visual and Audio Records

Purposes of Processing: Conducting Finance and Accounting Affairs, Conducting Activities in Accordance with the Legislation, Conducting Communication Activities, Conducting / Auditing Business Activities, Conducting Contract Processes, Conducting Goods / Services Sales Processes, Conducting Goods / Services After-Sales Support Services, Conducting Customer Relationship Processes, Conducting Activities Related to Customer Satisfaction, Conducting Loyalty Processes for the Company/Products/Services, Following Up Requests/Complaints, Conducting Goods/Services/Production and Operation Processes, Conducting Audit/Ethics Activities, Following Up and Conducting Legal Affairs, Providing Information to Authorized Persons/Institutions and Organizations

Visitor

Data Categories: Identity, Contact, Physical Premises Security, Transaction Security, Visual and Audio Records

Purposes of Processing: Ensuring Physical Premises Security, Creating and Following Up Visitor Records, Conducting Audit/Ethics Activities, Conducting Information Security Processes, Conducting Activities in Accordance with the Legislation

Reference Persons

Data Categories: Identity, Contact, Personnel (title information)

Purposes of Processing: Conducting Employee Candidate/Intern Selection and Placement Processes, Conducting the Application Processes of Employee Candidates, Conducting Communication Activities, Conducting Audit/Ethics Activities

6.2Personal Data Processing Activities Carried Out in Physical Premises

Camera monitoring is carried out in order to ensure security in our Company’s work areas. There are notices regarding this in the areas where camera monitoring is carried out.

Records relating to the internet access provided at our Company are recorded pursuant to the Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed Through Such Publications and other legislation; these records may be shared with authorized public institutions and organizations upon request and, where necessary, may be used in audit activities to fulfil the relevant legal obligation.

6.3Personal Data Processing Activities Carried Out on the Website

The traffic information of online visitors visiting our website is processed automatically for the purpose of conducting information security processes. On the other hand, pursuant to the Law No. 5651 and other legislation, hosting providers are obliged to record and retain website traffic information.

Detailed explanations regarding personal data processed through the website are available on the relevant website.

6.4Personal Data Processing Activities Carried Out Through Communication Channels

Communications made through channels such as the call centre, mail and e-mail are monitored and recorded by our Company for the purposes of conducting/auditing business activities and following up requests/complaints.

Relevant persons must use these channels only within the scope of business activities.

7.PURPOSES OF TRANSFERRING PERSONAL DATA AND PERSONS/ORGANIZATIONS TO WHICH IT IS TRANSFERRED

7.1Purposes of Transferring Personal Data

Our Company transfers personal data within the framework of the conditions specified in Articles 8 and 9 of the Law, limited to the following purposes:

• Conducting Emergency Management Processes
• Conducting Information Security Processes
• Conducting Audit / Ethics Activities
• Organizing Training Activities
• Conducting Activities in Accordance with the Legislation
• Conducting Finance and Accounting Activities
• Conducting Assignment Processes
• Following Up and Conducting Legal Affairs
• Conducting Communication Activities
• Fulfilling Obligations Arising from the Employment Contract/Legislation
• Conducting/Auditing Business Activities
• Conducting Occupational Health/Safety Activities
• Carrying Out Quality Control Activities
• Conducting Logistics Activities
• Conducting Loyalty Processes for the Company / Products / Services
• Conducting Goods / Services Sales Processes
• Conducting Goods/Services Production and Operation Processes
• Conducting Customer Relationship Management Processes
• Conducting Activities Aimed at Customer Satisfaction
• Responding to Customer Complaints/Requests
• Organization and Event Management
• Conducting Retention and Archive Activities
• Conducting Contract Processes
• Conducting Marketing Processes of Products / Services
• Following Up Requests / Complaints
• Ensuring the Security of Movable Property and Resources
• Conducting Supply Chain Management Processes
• Ensuring the Security of Data Controller Operations
• Conducting Fringe Benefits and Interests Processes
• Conducting Investment Processes
• Providing Information to Authorized Persons/Institutions and Organizations
• Conducting Management Activities

7.2Persons/Organizations to Which Personal Data Is Transferred

Our Company may transfer personal data to the persons and organizations specified below, limited to the data subject groups and data required by the purpose of the transfer:

• Shareholders,
• Business Partners,
• Suppliers,
• Authorized public institutions and organizations
• Natural persons or private-law legal entities (Organizations with which the Company cooperates in order to fulfil its contractual or legal obligations: Independent audit firms, insurance companies, law firms and banks, etc.)

8.DESTRUCTION OF PERSONAL DATA AND RETENTION PERIODS

8.1Destruction of Personal Data

Without prejudice to the provisions on the destruction of personal data in other laws, our Company erases, destroys or anonymizes the personal data it has processed in accordance with the provisions of this Law and other laws, ex officio or upon the request of the relevant person, in accordance with the Personal Data Retention and Destruction Policy, if the reasons requiring its processing cease to exist.

Erasure of personal data refers to the process of making personal data inaccessible and non-reusable in any way for the relevant users.

Destruction of data refers to the process of making personal data inaccessible, irretrievable and non-reusable in any way by anyone.

Anonymization of data refers to the process of making personal data impossible to associate in any way with an identified or identifiable natural person, even if matched with other data, through techniques such as masking, variable removal and generalization.

8.2Retention Periods of Personal Data

Our Company retains personal data in accordance with the periods stipulated in the laws and other legislation. If there is no retention period stipulated in the laws and other legislation, personal data is retained, in accordance with our Company’s Personal Data Retention and Destruction Policy, for the period necessary to achieve the purpose of processing that personal data, and is then erased, destroyed or anonymized within the framework of periodic destruction periods.

9.INFORMING THE PERSONAL DATA SUBJECT AND HIS/HER RIGHTS UNDER THE PDP LAW

9.1Informing the Relevant Person

In accordance with Article 10 of the PDP Law, our Company informs the relevant persons at the time personal data is obtained. In this context, it clarifies the identity of the Company representative, if any, the purpose for which personal data will be processed, to whom and for what purpose the processed personal data may be transferred, the method and legal ground of collecting personal data, and the rights of the relevant person.

9.2Cases in Which the Policy and the Law Will Not Be Applied Wholly or Partly

The provisions of this Policy and the Law will not be applied in the following cases:

• Processing of personal data by natural persons within the scope of activities relating exclusively to themselves or to family members living in the same household, provided that the data is not disclosed to third parties and the obligations regarding data security are complied with,
• Processing of personal data for purposes such as research, planning and statistics by anonymizing it through official statistics,
• Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defence, national security, public safety, public order, economic security, the privacy of private life or personal rights, or constitute a crime,
• Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations assigned and authorized by law to ensure national defence, national security, public safety, public order or economic security,
• Processing of personal data by judicial authorities or enforcement authorities in relation to investigation, prosecution, trial or enforcement proceedings.

Provided that it is in accordance with and proportionate to the purpose and basic principles of this Policy and the Law, Article 10 regulating the data controller’s obligation to inform, Article 11 regulating the rights of the relevant person, except for the right to request compensation for damage, and Article 16 regulating the obligation to register with the Data Controllers Registry will not be applied in the following cases:

• Where processing of personal data is necessary for the prevention of crime or for a criminal investigation,
• Processing of personal data that has been made public by the relevant person himself/herself,
• Where processing of personal data is necessary, based on the authority granted by law, for the performance of supervisory or regulatory duties or for disciplinary investigation or prosecution by the competent and authorized public institutions and organizations and by professional organizations having the status of public institutions,
• Where processing of personal data is necessary for the protection of the State’s economic and financial interests in relation to budgetary, tax and financial matters.

9.3Rights of the Relevant Person Under the PDP Law

Pursuant to Article 10 of the Law, our Company notifies the relevant persons of their rights, guides them on how to exercise these rights and makes the necessary internal operations and administrative and technical arrangements for all of these. The rights that persons whose personal data is processed have pursuant to Article 11 of the Law are listed below:

• To learn whether their personal data is processed,
• To request information in this regard if their personal data has been processed,
• To learn the purpose of processing the personal data and whether it is used in accordance with its purpose,
• To know the third parties in Türkiye or abroad to whom the personal data is transferred,
• To request the rectification of personal data if it is incomplete or inaccurately processed,
• To request the erasure or destruction of personal data within the framework of the conditions stipulated in Article 7 of the Law,
• To request that the transactions carried out pursuant to subparagraphs (d) and (e) of Article 11 of the Law (rectification and destruction) be notified to the third parties to whom the personal data has been transferred,
• To object to the occurrence of a result against the person himself/herself through the analysis of the processed data exclusively by means of automated systems,
• To request compensation for the damage in the event that he/she suffers damage due to the unlawful processing of personal data.

Requests and applications within the scope of Article 11 of the Law, which regulates the rights of the relevant person, may be made by filling in the application form available on our website (www.organotarim.com.tr) and delivered in person in writing to the address “Doğanca Köyü 3. Sokak No.17 İç Kapı No. 1 Sivas” or sent through a notary public, or forwarded via KEP (registered electronic mail) to the address [email protected].

In requests and applications,

• Name, surname and, if the application is in writing, signature,
• For citizens of the Republic of Türkiye, Turkish ID number; for foreigners, nationality, passport number or, if any, identity number,
• Residential or business address for notification,
• If any, e-mail address, telephone and fax number for notification,
• Subject of the request

must be included.

Information and documents relating to the subject must be attached to the application

Our Company concludes the requests in the application free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the transaction in question requires an additional cost, the fee in the tariff determined by the Board may be charged.

Our Company may accept the request submitted to it or reject it by explaining its reasons, and notifies its response to the relevant person in writing or electronically. If the request in the application is accepted, our Company fulfils what is necessary as soon as possible and informs the relevant person. If the application is caused by our Company’s error, the fee charged is refunded to the relevant person.

In cases where the application is rejected, the response given is found insufficient or the application is not responded to in time, the relevant person has the right to file a complaint with the Board within thirty days from the date he/she learns of the response and in any case within sixty days from the date of application.