SUNPET PACKAGING IND. TRADE. A.(hereinafter referred to as Sunpet Ambalaj) personal data processing activities conducted at building and facility entrances and within the premises are carried out in accordance with the Constitution of the Republic of Turkey, the Personal Data Protection Law ("KVK Law"), and other relevant legislation.In order to ensure security by Sunpet Ambalaj as the data controller in accordance with the KVK Law, personal data processing activities are carried out in order to monitor the entry and exit of guests, subcontractors and vehicles belonging to them with security camera monitoring activities in the buildings, factories and facilities of our Company.

SUNPET AMBALAJ processes personal data through the use of closed-circuit camera systems to record footage within the Company premises for the purpose of ensuring legal, technical, and commercial business security.

The camera monitoring and recording activity conducted by SUNPET AMBALAJ is carried out in accordance with Law No. 5188 on Private Security Services and the regulation governing its implementation, and is based on a legal reason rooted in our Company's legitimate interests.

Personal data is collected electronically through closed-circuit camera systems for the purpose of ensuring the security of the SUNPET AMBALAJ enterprise, within the framework of the personal data processing conditions specified in Articles 5 and 6 of the Personal Data Protection Law.

SUNPET AMBALAJ carries out security camera monitoring activities at its facilities in order to ensure security, for the purposes stipulated in the applicable legislation, and in accordance with the personal data processing conditions listed in the Personal Data Protection Law.

By SUNPET AMBALAJ, the personal data subject is informed in accordance with Article 10 of the Personal Data Protection Law.

SUNPET AMBALAJ provides notification regarding its general disclosures regarding camera surveillance through multiple methods. This is intended to prevent harm to the fundamental rights and freedoms of the personal data owner, ensure transparency, and provide adequate information to the personal data owner.

Regarding the camera monitoring activity conducted by SUNPET AMBALAJ, a notice stating that monitoring will be conducted is posted at the entrances of the monitored areas.

SUNPET AMBALAJ processes personal data in a manner that is limited to and proportionate to the purpose for which it is processed, in accordance with Article 4 of the Personal Data Protection Law.

The purpose of maintaining the closed-circuit camera monitoring activity by SUNPET AMBALAJ is limited to the purposes listed in this privacy notice.

Accordingly, the monitoring areas, number, and timing of security camera operations are implemented in a manner sufficient to achieve the security objective and limited to that purpose.

The individual is not subject to monitoring in areas that may result in an intrusion into their privacy beyond security purposes (e.g., prayer rooms, restrooms, etc.)

SUNPET AMBALAJ takes the necessary technical and administrative measures to ensure the security of personal data obtained through camera surveillance in accordance with Article 12 of the Personal Data Protection Law, as required by the KVK Law.

SUNPET AMBALAJ, the retention period for personal data obtained through cameras is 25 days.

The information obtained as a result of monitoring is accessible to a limited number of employees. Camera footage is shared with authorized public institutions in accordance with legislation for the purpose of ensuring our company's security, in accordance with Articles 8 and 9 of the Personal Data Protection Law. It may be transferred within the framework of the personal data processing conditions and purposes specified in the relevant articles. (For example, upon a written request from the prosecution or a judge during the investigation of an incident) As a result of the confidentiality agreement made between our company and the limited number of individuals with access to the records, these individuals undertake to protect the confidentiality of the data they access.

By SUNPET AMBALAJ; as the data controller pursuant to the Personal Data Protection Law, personal data processing activities are carried out for the purpose of ensuring security and for the purposes specified in this clarification text, regarding the tracking of guest entrances and exits at SUNPET AMBALAJ facilities.

When obtaining the names and surnames of individuals visiting SUNPET AMBALAJ premises as guests, or through texts posted within SUNPET AMBALAJ premises or made available to guests in other ways, the personal data owners in question are informed accordingly. The data obtained for the purpose of tracking guest entry and exit is processed solely for this purpose, and the relevant personal data is collected using physical methods during visits to the SUNPET AMBALAJ premises in the physical environment, in accordance with Articles 5 and 6 of the Personal Data Protection Law.It is collected based on the legal reason related to our Company's legitimate interest within the framework of the personal data processing conditions specified in the relevant articles and recorded in the data recording system.

Personal data collected during visits to SUNPET AMBALAJ premises is shared with authorized public institutions in accordance with legislation for the purpose of ensuring the security of SUNPET AMBALAJ premises, in accordance with Articles 8 and 9 of the Personal Data Protection Law. It may be transferred within the framework of the personal data processing conditions and purposes specified in the relevant articles.

SUNPET PACKAGING Section 10 of the Personal Data Protection Law in accordance with the article, it informs the personal data owner which personal data owner groups process which personal data, the purposes of processing the personal data of the personal data owner and the storage periods within the scope of the obligation to clarify.

SUNPET AMBALAJ processes the personal data discussed in this clarification text in accordance with Article 138 of the Turkish Penal Code and Article 7 of the Personal Data Protection Law. although it has been processed in accordance with the provisions of the relevant law as regulated in the article, if the reasons requiring its processing disappear, the personal data will be deleted, destroyed or anonymized in accordance with SUNPET AMBALAJ's own decision or upon the request of the personal data owner.

We hereby inform personal data owners that they have the following rights pursuant to Article 11 of the KVK Law:

• To learn whether their personal data have been processed,
• To request information about it if their personal data have been processed,
• To learn the purpose of processing their personal data and whether they have been used in accordance with their purpose,
• To know the third parties to whom their personal data have been transferred,
• To request correction of their personal data if their personal data have been processed incomplete or incorrectly, and to request notification of the transaction made in this context to the third parties to whom their personal data have been transferred,
• To ensure that they have been processed in accordance with the provisions of the Law and other relevant laws despite this, requesting the deletion or destruction of personal data if the reasons requiring its processing disappear, and requesting notification of transactions made in this context and in case of incomplete or incorrect processing of personal data to third parties to whom personal data are transferred,
• Objecting to the occurrence of a result against it by analyzing the processed data exclusively through automated systems,
• Requesting compensation for damage if personal data is damaged due to illegal processing.

You may submit your requests regarding your rights listed above to our Company by filling out the Application Form, which you can access via our general disclosure statement at www.sunpet.com.tr. Depending on the nature of your request, your application will be concluded as soon as possible and within thirty days at the latest, free of charge; however, if the process requires additional costs, a fee may be charged to you according to the tariff to be determined by the Personal Data Protection Board.