WEBSITE PRIVACY AND PERSONAL DATA PROCESSING DISCLOSURE NOTICE

As Sonay Yatırım Anonim Şirketi (the “Company” or “Sonay Yatırım”), we take the utmost care to protect the personal data, privacy and security of the users, stakeholders, business partners and job candidates who visit our website at https://sonayyatirim.com/tr (the “Website”).

This Website Privacy and Personal Data Processing Disclosure Notice (the “Disclosure Notice”) has been prepared by Sonay Yatırım in its capacity as data controller, pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the Communiqué on the Principles and Procedures to be Followed in Fulfilling the Obligation to Inform, in order to inform you about the purposes for which your personal data are processed, the methods and legal grounds of collection, the parties to whom and the purposes for which they may be transferred, and the rights you hold under Article 11 of the KVKK.

Identity of the Data Controller

Under the KVKK, the data controller in respect of your personal data is Sonay Yatırım Anonim Şirketi, registered with the Istanbul Trade Registry Office.

• Company name: Sonay Yatırım Anonim Şirketi

• Address: Funda Sok. No:1 Levent Mah. Beşiktaş / İstanbul

• Phone: +90 312 481 00 00

• E-mail: info@sonayyatirim.com

• Website: https://sonayyatirim.com/tr

Categories of Personal Data Processed

The categories of personal data processed in connection with your visit and with the transactions you carry out through the Website are as follows:

• Identity data: Name, surname.

• Contact data: Telephone number, e-mail address, postal/notification address.

• Customer / visitor transaction and request data: Questions, opinions, suggestions, requests, complaints, messages and cooperation proposals submitted through contact forms, information request fields or directly by e-mail or telephone.

• Transaction security and traffic data: Internet protocol (IP) address, network connection and traffic logs, access dates and times, navigation and click activity, device and operating system information, and cookie records.

• Career / human resources application data: Curriculum vitae (CV), education details, professional experience, references, foreign language proficiency, certificates and other personal information provided through the “Career Opportunities” or open positions section of the Website.

Purposes of Processing Personal Data

Your personal data are processed in line with the fundamental principles set out in Article 4 of the KVKK, for the following purposes:

• Conducting corporate promotion, business relations and communication processes within the Company’s fields of activity, namely real estate, construction, infrastructure, energy, software/technology investments and the management of group companies,

• Responding to, concluding and following up on the questions, opinions, requests, suggestions and cooperation applications submitted to us through the Website,

• Fully complying with the statutory log retention and transaction security obligations under Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications and the related secondary legislation,

• Ensuring the technical functionality, information security and protection of the Website against cyber attacks,

• Evaluating job applications submitted through the Career Opportunities section or the contact channels, assessing candidate suitability for open positions and conducting human resources processes,

• Discharging the burden of proof in any future disputes and responding to information and document requests from judicial and administrative authorities and law enforcement in accordance with the legislation.

Methods of Collection and Legal Grounds

Your personal data are collected electronically, by wholly or partly automated means, when you visit the Website, complete the contact forms on the site, contact us by e-mail or telephone, send a CV, or through the operation of technical cookies.

Such personal data are processed on the following legal grounds under Article 5/2 of the KVKK:

• Article 5/2 (c) of the KVKK: Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of that contract (cooperation proposals, preliminary discussions regarding requested services and pre-contractual processes),

• Article 5/2 (ç) of the KVKK: Processing is mandatory for the data controller to fulfil its legal obligations (retention of traffic logs and the duty to inform the competent authorities under Law No. 5651),

• Article 5/2 (f) of the KVKK: Processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (ensuring Website security, technical optimisation, establishing corporate communication, and handling questions and requests).

In cases where the legislation requires consent — such as the long-term retention of a CV for roles that may arise in the future beyond the current open positions, or commercial electronic messages and marketing activities — your data will be processed on the basis of the explicit consent you give of your own free will, pursuant to Article 5/1 of the KVKK.

Transfer of Personal Data

Your personal data may be transferred, in line with the purposes set out in this Disclosure Notice and in strict compliance with Articles 8 and 9 of the KVKK, to:

• The software, hosting, server and cyber security service providers from which we receive services in respect of servers, databases and information technology infrastructure,

• Our affiliates and group companies (Enay-Cezayir, Hidroay Enerji, Global e-Aviation, SCADASU, TBM Endüstri, Spectrum, Suis Yazılım, TECHAY, Zeyver Otelcilik and other joint ventures), for the purpose of conducting joint cooperation, project and human resources processes within the group companies and investments,

• The lawyers, financial advisors, independent auditors and business partners from which the Company receives legal, financial and technical consultancy services,

• Public institutions and organisations authorised by law, and judicial and administrative authorities, within the limits required by the applicable legislation.

Where personal data are transferred abroad, the transfer conditions and safeguards set out in Article 9 of the KVKK and the related regulations are applied to the letter.

Rights of the Data Subject

Pursuant to Article 11 of the KVKK, as a data subject you may exercise the following rights by applying to Sonay Yatırım:

• To learn whether your personal data are processed,

• To request information if your personal data have been processed,

• To learn the purpose of processing and whether the data are used in accordance with that purpose,

• To know the third parties in Türkiye or abroad to whom the personal data are transferred,

• To request rectification of your personal data where they are processed incompletely or inaccurately,

• To request erasure or destruction of your personal data within the conditions set out in Article 7 of the KVKK,

• To request that rectification, erasure or destruction be notified to the third parties to whom the personal data have been transferred,

• To object to a result arising against you as a consequence of the analysis of the processed data exclusively by automated systems,

• To claim compensation where you suffer damage due to the unlawful processing of your personal data.

How to Apply to the Data Controller

You may submit your requests regarding the rights listed above, in accordance with the Communiqué on the Principles and Procedures for Applications to the Data Controller:

• In writing: By delivering your wet-signed application, together with documents evidencing your identity, in person or through a notary public to Funda Sok. No:1 Levent Mah. Beşiktaş / İstanbul,

• By e-mail: By sending your application to info@sonayyatirim.com using a secure electronic signature, a mobile signature, or the e-mail address previously notified to and registered in our systems,

• Through the Company’s registered electronic mail (KEP) address, if any.

It is a legal requirement that your application clearly states your name and surname, your wet signature if the application is in writing, your Turkish identity number (for foreign nationals, nationality, passport number or foreign identity number, if any), your residential or business address for notification, your e-mail address and telephone number for notification if any, and the subject of your request.

The Company will conclude your application free of charge as soon as possible and in any case within thirty (30) days, depending on the nature of the request. However, if the process requires an additional cost, the fee set out in the tariff determined by the Personal Data Protection Board may be charged.

Use of Cookies

Cookies are used on the Website to improve the user experience, deliver the essential functions of the site and measure its technical performance. Detailed information on cookie types, their purposes and how to manage your cookie settings is available in the Cookie Policy published on the Website.

Effectiveness and Updates

This Disclosure Notice enters into force on the date it is published on the Website. The Company reserves the right to update the text in line with legal regulations and changes in corporate policies. The updated text becomes effective as of the moment it is announced on the Website.

This English text is a courtesy translation. In the event of any inconsistency, the Turkish version shall prevail.

Sonay Yatırım Anonim Şirketi