INFORMATION NOTICE REGARDING THE COLLECTION, PROCESSING, AND PROTECTION OF PERSONAL DATA; 1- GENERAL EXPLANATION AND DEFINITIONS This information notice is prepared by Yakup UDÜL – MOXİMU (“Moximu”) as the “data controller” within the scope of Article 10 of the Personal Data Protection Law No. 6698 (“Law”) for the purpose of fulfilling the “obligation to inform.” The meanings of the terms in this information notice are as defined in Law No. 6698, the regulations issued in connection with this Law, and the notifications, as follows: Personal data: Any kind of information related to a identified or identifiable real person, Processing of personal data: Any operation performed on personal data, whether fully or partially automated or non-automated, such as collecting, recording, storing, preserving, altering, rearranging, disclosing, transferring, taking over, making obtainable, classifying, or using data, Concerned person: The real person whose personal data is processed, Explicit consent: Consent based on information about a specific subject and declared with free will, Anonymization: Making personal data unidentifiable or non-associable with a real person by matching it with other data, Data controller: The real or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system, Data processor: The real or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller, Data recording system: The recording system in which personal data is processed in a structured manner according to certain criteria, Contact person: A real person declared by the data controller during registration to the Data Registry Agency for communication with the Authority, concerning the obligations of legal entities residing in Turkey and legal entity data controllers representatives not residing in Turkey, as per the Law and secondary regulations to be issued based on this Law. Personal data storage and destruction policy: The policy used by data controllers as a basis for determining the maximum period necessary for the purposes for which personal data are processed, and for deleting, destroying, or anonymizing the data. 2- INFORMATION ABOUT THE DATA CONTROLLER In legal entities, the data controller is the legal entity itself. The obligations of legal entity data controllers under Law No. 6698 in Turkey are fulfilled through the authorized body/person or persons representing the legal entity. The authorized body to represent in the implementation of obligations related to Law No. 6698 may appoint one or more persons regarding the obligations to be fulfilled by the legal entity, in accordance with the provisions of the Law. This appointment does not eliminate the responsibility of the legal entity under the Law. Moximu operates as a sole proprietorship, based in Turkey. Information about Moximu as the data controller is as follows: Information about the Data Controller: 3- OBLIGATIONS OF THE DATA CONTROLLER Moximu is obliged to inform the concerned persons within the scope of the obligation to inform in terms of the following:

• The identity of the data controller and, if any, its representative,
• The purposes of processing personal data,
• To whom and for what purposes personal data may be transferred,
• The method of personal data collection and its legal basis,
• The rights of individuals whose personal data is processed,

Moximu also, regarding data security:

• Takes necessary security measures to prevent the unlawful processing of personal data,
• Prevents unauthorized access to personal data,
• Ensures the preservation of personal data.

Moximu does not disclose the personal data it has obtained through the necessary inspections to ensure compliance with the provisions of Law No. 6698 to others and does not use it for purposes other than processing purposes. 4- PROCESSED PERSONAL DATA The personal data processed by Moximu is as follows, and new ones may be added or changes may be made to this information in cases required by laws and/or regulations: Personal data processed:

• Name, Surname, ID Number, Date of Birth, etc., identification information,
• Contact information such as Address, Phone, Fax, Email, etc.,
• Tax Office and Tax Number information,
• Information about employees such as salary, social security, bank account number, and information about family members,
• Information about profession and education status,
• Recordings from cameras, fingerprints, etc.

5- METHODS OF OBTAINING PERSONAL DATA Personal data can be obtained directly from the individuals themselves, and data obtained from various sources such as online sales platforms, camera recordings, dealers, solution partner institutions and organizations may be obtained indirectly. 6- PURPOSE OF PROCESSING PERSONAL DATA Moximu processes personal data for the following purposes:

• Fulfillment of obligations related to tax and other public receivables within the scope of tax laws, Turkish Commercial Code No. 6102, and other legal regulations,
• Taking measures to protect consumer rights, and taking necessary actions for disputes that may arise,
• Carrying out human resources policies,
• Ensuring the security of life and property of individuals within the scope of physical security and control processes,
• Ensuring the security of the workplace, business processes, and employees by monitoring with camera systems,
• Ensuring the security of information and system integrity by monitoring with camera systems,
• Planning and execution of corporate communication processes,
• Conducting marketing and advertising activities, planning and executing corporate communication processes,
• Ensuring the security of employees and company assets,
• Fulfilling the requirements of contracts with employees and business partners,
• Ensuring the legal, technical, and commercial-business security of the data controller and parties with whom the data controller has a business relationship,
• Ensuring the legal, technical, and commercial-business security of the data controller and parties with whom the data controller has a business relationship,
• Informing authorized institutions and organizations and other relevant persons, upon request, within the framework of legal obligations,
• Ensuring compliance with information storage, reporting, and information retention obligations determined by the relevant legislation,
• Responding to legal requests and fulfilling legal obligations in case of disputes or investigations,
• Ensuring the safety of the business environment by controlling physical security and digital security systems in business areas,
• Providing goods and services offered by the data controller to real persons,
• Ensuring the safety of the workplace and business operations by monitoring with camera systems,
• Ensuring the safety of the workplace and business operations by monitoring with camera systems,
• Responding to requests and complaints of individuals whose personal data is processed,
• Ensuring the security of business operations and employees by monitoring with camera systems,
• Carrying out operational activities related to the fulfillment of commercial activities,
• Ensuring business and operational continuity and communication,
• Fulfilling the obligations arising from the contracts we have concluded or being a party to,
• Ensuring the legal, technical, and commercial-business security of the data controller and parties with whom the data controller has a business relationship,
• Carrying out activities for the purpose of establishing and/or protecting the rights of the data controller.

7- TRANSFER OF PERSONAL DATA Moximu may transfer personal data to domestic or foreign third parties within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law No. 6698. 8- RIGHTS OF THE CONCERNED PERSONS Concerned persons, upon request, have the right to:

• Learn whether personal data is processed,
• Request information if personal data has been processed,
• Learn the purpose of processing personal data and whether they are used appropriately for their purpose,
• Know the third parties to whom personal data is transferred domestically or abroad,
• Request correction of personal data in case of incomplete or incorrect processing,
• Request the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the Law,
• Request notification of the transactions made pursuant to subparagraphs (e) and (f) to third parties to whom personal data has been transferred,
• Object to the occurrence of a result against the person by analyzing the processed data exclusively through automated systems,
• Request compensation for the damage in case of damage due to unlawful processing of personal data.

9- DATA STORAGE AND DESTRUCTION POLICY Moximu has determined its Personal Data Storage and Destruction Policy in accordance with Article 4 of the Law. Accordingly, personal data is processed only for the purposes specified in Article 5 of the Law and in a manner that complies with the law and honesty rules. Personal data is kept accurate and up-to-date when necessary. Moximu destroys personal data in accordance with the terms stipulated in the legislation and its Personal Data Storage and Destruction Policy. In this context, personal data is destroyed when the purpose of processing is eliminated, and the periods specified in the relevant legislation have expired. 10- CONTACT INFORMATION Concerned persons can contact Moximu for their requests regarding their rights under Article 11 of the Law No. 6698 or for any questions, requests, or comments regarding the personal data processing activities carried out by Moximu: Moximu