BİMEKS ÇELİK TİCARET ANONİM ŞİRKETİ CLARIFICATION TEXT

Thank you for visiting bimekscelik.com.

The bimekscelik.com website belongs to BİMEKS ÇELİK TİCARET A.Ş., and the information security of our customers visiting this address is of great importance to BİMEKS ÇELİK. This text has been prepared to inform you about information security.

INFORMATION BY BİMEKS ÇELİK TİCARET ANONİM ŞİRKETİ REGARDING THE PERSONAL DATA PROTECTION LAW

As Bimeks Çelik Ticaret A.Ş. (the “Company”), we attach importance to protecting the privacy and security of your personal data. In this context, we would like to inform you about the Personal Data Protection Law No. 6698 (“PDPL”), which is in force to protect fundamental rights and freedoms, especially the privacy of private life, and to protect personal data. Detailed information regarding the processing of your personal data that you share with the Company can be found in the Bimeks Çelik Personal Data Retention and Destruction Policy (“PDPL Policy”) available at bimekscelik.com.

1.Purposes of Processing and Transferring Personal Data

Our Company, in its capacity as the data controller under the PDPL, may process your personal data collected in accordance with the legislation within the scope of the information and purposes set out below.

Personal data refers to any information relating to an identified or identifiable natural person. Data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dressing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometrics and genetics are special categories of personal data.

We would like to inform you that our Company may process your personal data for the purposes of enabling our customers to benefit from our services, recording your suggestions and complaints, planning and executing the Company's commercial and business strategies, ensuring that our relevant business units carry out the necessary work to realize the commercial activities conducted by the Company and managing the related business processes, and in any case, in accordance with the PDPL and relevant legislation.

As the Data Controller, we may process your personal data for the following purposes:

• Negotiation, conclusion, and execution of contracts,

• Provision of products and services,

• Customizing the offered products and services in accordance with demands; updating and developing them due to customer needs, legal and technical developments,

• Defining users in systems specific to the offered products and services,

• Providing call center and remote support services, tracking call numbers and content,

• Announcing new or existing products and services, conducting sales and marketing activities,

• Conducting market research,

• Creating statistics and analyzing usage,

• Paying and collecting product, service, and maintenance fees, selecting the collection method,

• Establishing contact/communication,

• Managing commercial relations with cooperating companies, suppliers, and service providers,

• Reporting within the scope of collaborations,

• Developing the Company's commercial strategies and making plans,

• Creating participant registration for events/trainings organized by the Company, issuing certificates/certificates of participation,

• Managing judicial/administrative processes, responding to requests from public institutions and organizations, fulfilling legal obligations dependent on legal regulations, resolving legal disputes,

• In the event of the Company merging with another company, being divided, or the whole or a part of it being transferred, ensuring the consequences arising from this legal transaction,

• Introducing Company employees, Customers, and Customer Contacts in social media posts,

• Conducting job interviews, evaluating job applications,

• Establishing, executing, and terminating the employment relationship/contract,

• Enabling Company employees to benefit from the principal and fringe benefits arising from their employment contracts, evaluating their performance and work,

• Organizing the transportation of Company employees, tracking company pool vehicles,

• Creating participant registration in case of participation in an organization on behalf of the Company,

• Creating records of employees' participation in trainings and certificates,

• Creating and tracking visitor records,

• Ensuring the internal and environmental security of the Company and the security of the website and applications,

• Usage analysis of the Website,

• Creating a personal data inventory,

• Evaluating and responding to all questions, requests, suggestions, complaints, and applications submitted in writing, orally, or electronically, including those relating to personal data.

Your personal data may be transferred within the scope of the PDPL and other legislation and for the purposes explained above;

• To companies and our representatives authorized by us and operating on behalf of and for the account of our Company,

• To supervisory and regulatory authorities, relevant public institutions and similar organizations, and persons or organizations permitted by the provisions of the Turkish Commercial Code and other relevant legislation, to legally authorized public and/or private law legal entities limited to the purpose requested within their legal authority,

• To business partnerships, supplier and contractor companies, banks, credit risk and financial institutions, and other natural or legal persons within the scope of the stated purposes,

• To third parties from whom we receive consultancy, including tax and similar consultants, mandatory persons, institutions, and organizations related to legal follow-up processes, and auditors, and without limitation to these, domestically and abroad, to business partners, third parties from whom services are received, and authorized persons and organizations for the purposes stated above.

2. Method and Legal Reason for Collecting Personal Data

Your personal data may be collected by our company verbally, in writing, or electronically, such as through the website or e-mail, and at events, promotional activities, and meetings organized by our Company, in order to operate more effectively and offer you the best experience.

Our data collection process may occur through: i) digital channels or software belonging to third parties, including the Website, e-mail, recruitment portals; ii) contracts, applications, forms, call center, remote support, sales and marketing unit, cookies on the Websites, business cards, telephone; or iii) face-to-face meetings with the Data Subject.

Your personal data may also be processed and shared within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the PDPL and in line with the legal reasons and purposes specified in Article 1 of this clarification text.

3. Your Rights Regarding the Processing of Personal Data

Within the scope of Article 11 of the PDPL, as a personal data subject, you are granted the following rights:

• To learn whether your personal data is processed or not,

• If your personal data has been processed, to request information regarding this,

• To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,

• To know the third parties to whom your personal data is transferred domestically or abroad,

• To request the rectification of the incomplete or inaccurate data, if any,

• To request the erasure or destruction of your personal data in the event that the reasons requiring its processing cease to exist, despite being processed in accordance with the provisions of the PDPL and other relevant laws, and to request notification of the transaction made in this context to the third parties to whom your personal data has been transferred,

• To object to the occurrence of a result against you by analyzing the processed data exclusively through automated systems,

• To claim compensation for the damage arising from the unlawful processing of your personal data.

4. Data Controller to Whom You Can Apply Under the Law

Trade Registry No: 440832

Mersis Number: 0175013912500015

Company: BİMEKS ÇELİK TİCARET A.Ş.

Address: Cevizli Mah. Tugay Yolu Cad. Ofisim İstanbul Plaza A-Blok Kat: 14/61 34846 Maltepe/Istanbul

Website: bimekscelik.com

Phone: 0216 593 04 74