Protection of Personal Data

As GÜLLÜOĞLU GIDA SAN. VE TİC. A.Ş., we attach great importance to the processing and preservation of your personal data in accordance with the Personal Data Protection Law No. 6698 (“Law”). We would like to inform our customers about our purpose and methods of collecting, processing and transferring personal data and, accordingly, your rights arising from the Law.

1. Methods for collecting personal data

As GÜLLÜOĞLU GIDA SAN. VE TİC. A.Ş., as the data controller, within the framework of our legal obligations arising from the legislation; we collect your personal data verbally, in writing or electronically through websites, social media channels, mobile applications and similar means, for purposes such as for you to benefit from the services of our brands, to inform you about our campaigns upon your approval, to record your suggestions and complaints, to create better service standards for you, to determine and implement commercial and business strategies of GÜLLÜOĞLU GIDA SAN. VE TİC. A.Ş.

2. Processing of personal data and processing purposes

As GÜLLÜOĞLU GIDA SAN. VE TİC. A.Ş., as the data controller, through our call centers, written communication channels, social media pages, mobile communication channels, in-store communication channels and/or all kinds of channels, including but not limited to these; your personal and/or special personal data that we have obtained with your consent, in whole or in part, may be obtained, recorded, retained, stored, changed, updated, periodically checked, rearranged, classified, preserved for as long as necessary for the purpose for which they are processed or as stipulated in the relevant law, in case of legal or service-related actual requirements, shared/transferred with private or legal persons with whom GÜLLÜOĞLU GIDA SAN. VE TİC. A.Ş. works, or with public institutions and organizations to which it is legally obliged, and/or with relevant third party real persons/legal persons residing in Turkey or abroad, transferred abroad in case of actual necessity legally or service-related.

We would like to inform you that we may process your personal data for purposes such as to enable GÜLLÜOĞLU GIDA SAN. VE TİC. A.Ş. customers to benefit from the services of our brands, to inform you about our campaigns upon your approval, to record your suggestions and complaints, to create better service standards for you, to determine and implement commercial and business strategies of GÜLLÜOĞLU GIDA SAN. VE TİC. A.Ş. and in any case in accordance with the Personal Data Protection Law No. 6698 and relevant legislation.

3. Transfer of Personal Data

GÜLLÜOĞLU GIDA SAN. VE TİC. A.Ş. may only share your personal data in question, based on your explicit consent or within the country, provided that adequate precautions are taken within the framework of the security and confidentiality principles specified in the Law, and abroad, provided that the necessary security measures are taken, to carry out the Company's activities, to ensure the business relationship between data owners and our customers and/or or in order to conduct negotiations for this purpose, to offer services and opportunities and to increase the quality of service, with our group companies, business partners, customers, suppliers, audit companies with whom we have agreements and to which we provide services as part of our activities, or public institutions or organizations authorized to request this data in accordance with a legal obligation and with other relevant authorities not limited to these.

4. Personal Data Owner's Rights Listed in Article 11 of the Personal Data Protection Law (“Law”)

GÜLLÜOĞLU GIDA SAN. VE TİC. A.Ş. will respond to the following requests of relevant persons:

a) Being informed about whether GÜLLÜOĞLU GIDA SAN. VE TİC. A.Ş. processes their personal data and which personal data it processes,

b) Receiving information regarding the purposes of the processing activity,

c) Knowing the third parties to whom GÜLLÜOĞLU GIDA SAN. VE TİC. A.Ş. transfers personal data at home or abroad,

d) Requesting correction of personal data if they are incomplete or incorrectly processed,

e) Requesting the deletion or destruction of personal data in accordance with the law,

f) In case of request for correction, deletion or destruction of personal data, requesting that the transactions carried out be notified to third parties to whom personal data is transferred,

g) To object to the emergence of a result against the person by analyzing the processed data exclusively through automatic systems, and

h) Receiving a copy of their personal data.

You can contact us with your comments and questions.

Title: GÜLLÜOĞLU GIDA SAN. VE TİC. A.Ş.

Phone: 0 850 308 45 45

Mersis Number: 0420003622700013

Tax Office: BOĞAZİÇİ KURUMLAR

Tax Number: 4200036827

Address: Kemankeş Karamustafa Paşa Mah. Kemankes Cad. No:67 34425

Mail: [email protected]

APPLICATION FORM TO THE DATA CONTROLLER UNDER THE PERSONAL DATA PROTECTION LAW

1. General Remarks

Personal data owners (Applicants) defined as relevant persons in the Personal Data Protection Law No. 6698 ("PDPL") are granted the right to make certain requests regarding the processing of personal data in Article 11 of the PDPL.

In accordance with the 1st paragraph of Article 13 of PDPL; applications regarding these rights must be forwarded to our company, which is the data controller, can be made in writing (with wet signature) or by other methods determined by the Personal Data Protection Board ("Board") (via the applicant's registered e-mail "KEP" address, secure electronic signature, mobile signature, by using the e-mail address previously notified to the data controller by the relevant person and registered in the data controller's system, or through a software or application developed for the purpose of application).

For applications to be made to our company in writing in this regard, you can apply to us by printing out this form;

• With the Applicant's personal, written and wet signed application.

or

• Through a notary.
• The Applicant may apply by submitting this form or a form prepared by him/herself, containing the mandatory information requested in this form, in a digital environment

1. Via their registered e-mail address (KEP)
2. By signing with a secure electronic signature
3. By signing with mobile signature
4. Via the e-mail address previously notified to us by them and registered in our system.
5. Through the application app on the GÜLLÜOĞLU GIDA SAN. VE TİC. A.Ş. website.

A digital example of this form is available at www.karakoygulluoglu.com.

The table below contains information specific to written application channels regarding how written applications will be delivered to us.

Application Method	Requested Document	Application Address	Application Description
Personal Written Application (Themselves)	Photocopy of identity Card	Kemankeş Karamustafa Paşa, Mumhane Cd. No:63, 34425 Beyoğlu/Istanbul, Turkey	“Application Under the Personal Data Protection Law” will be written on the envelope.
Personal Application (Authorized)	Photocopy of identity card, special power of attorney issued through a notary or an official document showing that they are the parent of the applicant.	Kemankeş Karamustafa Paşa, Mumhane Cd. No:63, 34425 Beyoğlu/Istanbul, Turkey	“Application Under the Personal Data Protection Law” will be written on the envelope.
Notification via Notary Public		Hürriyet Mah. Atatürk Cad. Şehit Ali Yılmaz Sok. No.1 Güneşli, Bağcılar / ISTANBUL	“Application Under the Personal Data Protection Law” will be written on the envelope.
By e-mail sent from the applicant's Registered Electronic Mail (KEP) address (To the e-mail address of the data controller company with KEP extension)		[email protected]	“Application under the Personal Data Protection Law” will be written in the subject line of the e-mail.
By emailing a digital document signed with a Secure Electronic Signature		[email protected]	“Application under the Personal Data Protection Law” will be written in the subject line of the e-mail.
By emailing a digital document signed with mobile signature		[email protected]	“Application under the Personal Data Protection Law” will be written in the subject line of the e-mail.
By using the e-mail address previously notified to GÜLLÜOĞLU GIDA SAN. VE TİC. A.Ş. company by the applicant and registered in the GÜLLÜOĞLU GIDA SAN. VE TİC. A.Ş. company's system.		[email protected]	“Application under the Personal Data Protection Law” will be written in the subject line of the e-mail.
Via the application form on the website of GIDA SAN. TİC. A.Ş company		www.karakoygulluoglu.com

In addition, after the other methods determined by the Board are announced, our company will announce how applications will be received through these methods.

Your applications submitted to us will be answered within 30 days from the date your request reaches us, depending on the nature of the request, in accordance with the 2nd paragraph of Article 13 of the PDPL. Our answers will be delivered to you in writing or electronically in accordance with the provision of Article 13 of the relevant PDPL.

GÜLLÜOĞLU GIDA SAN. VE TİC. A.Ş COMPANY

APPLICATION FORM TO THE DATA CONTROLLER UNDER THE PERSONAL DATA PROTECTION LAW

Relevant Person Making the Application:

*Name and Surname
* T.R. ID Number (Nationality and passport number/ID number for foreigners)
* Address to be the Basis for Notification
Date of Birth
Phone Number
E-mail
*Subject of Request

IT IS MANDATORY TO FILL IN THE FIELDS MARKED WITH AN ASTERISK (*) IN REQUIREMENT OF "NOTIFICATION TO THE DATA CONTROLLER ABOUT THE APPLICATION PROCEDURES AND PRINCIPLES".

Relationship with Our Company

☐Customer/Supplier                   ☐ Employee/Former Employee/Employee Candidate         ☐Third person

Answer Notification Form

☐ I want it to be sent to my address.

☐ I want it to be sent to my e-mail address.

☐ I want to receive it by hand.

(In case of receipt by proxy, a special power of attorney issued by a notary is required.)

This application form has been prepared to determine your relationship with our company and to determine your personal data processed by our company, if any, in order to respond to your application correctly and within the legal period. In order to eliminate legal risks that may arise from illegal and unfair data sharing and especially to ensure the security of your personal data, our company reserves the right to request additional documents and information (copy of identity card or driver's license, etc.) for identification and authorization determination. In case the information regarding your requests submitted within the scope of the form is not accurate and up-to-date or an unauthorized application is made, our company does not accept liability for requests arising from such incorrect information or unauthorized application. If the action to be taken as per your request requires an additional cost, a fee may be charged as stated in the NOTIFICATION ON APPLICATION PROCEDURES AND PRINCIPLES TO THE DATA CONTROLLER. A processing fee of 1 Turkish Lira may be charged for each page over ten pages. If the answer to your application must be given on a recording medium such as a CD or flash memory, you may be asked for a fee equivalent to the cost of this recording medium.