WEBSITE PRIVACY POLICY

Effective Date: 14 September 2026

Last Updated: 14 September 2026

1. Purpose and Scope

This Website Privacy Policy (the "Policy") has been prepared to set out the rules on the processing, confidentiality and security of the data obtained during visits to and use of the website at https://sonayyatirim.com/tr (the "Website"), operated by Sonay Yatırım Anonim Şirketi (the "Company").

While operating in the fields of real estate, construction, infrastructure, energy, software/technology investments and the management of group companies, our Company adopts as a fundamental principle respect for the privacy rights of all visitors, customers, business partners and job candidates who interact with us through our digital platforms, and full compliance with the legislation in force on the protection of personal data. Every person who visits or uses the Website is deemed to have read, understood and accepted the terms set out in this Policy.

2. Information Collected and Data Types

The data collected in connection with visits to and transactions on the Website fall into two main groups:

Information provided directly — data submitted to the Company by visitors through the contact channels and application forms on the Website, or directly by e-mail or telephone:

• Identity and contact information: Name, surname, telephone number, e-mail address, notification or residential address.

• Request and correspondence content: Message texts, attached CV files and other details of the request shared in connection with contact forms, cooperation proposals, investment enquiries, information requests or career applications for open positions.

Technical information collected automatically — data obtained electronically by automated means in order to operate the Website, ensure its security and improve its performance:

• Traffic and log records: Internet protocol (IP) address, internet service provider (ISP), date and time stamps of access to the Website, referring/exit page links and click-stream data (including the records that must be kept under Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications).

• Device and browser information: Browser type and version used for the visit, operating system, language settings and hardware model.

• Cookie data: Information obtained through cookies placed in order to manage the Website session, remember user preferences and analyse visit traffic.

3. Purposes of Use

The technical and personal information collected is processed for the following legitimate and lawful purposes:

• Ensuring that the Website operates properly, without interruption and in an optimised manner,

• Reviewing and evaluating the questions, suggestions, requests and cooperation proposals submitted by visitors and contacting the relevant persons,

• Conducting corporate communication regarding the activities and services of our affiliates and group companies (infrastructure, real estate, energy, software/technology),

• Evaluating career and job applications received within the scope of human resources processes,

• Fully fulfilling the statutory log retention and data storage obligations under Law No. 5651 and the related secondary legislation,

• Ensuring the security of information systems and detecting and preventing unauthorised access, fraud attempts, cyber attacks and malicious use,

• Responding to information and document requests made within the framework of the legislation by authorised public institutions, judicial bodies and administrative authorities.

4. Cookies and Similar Technologies

Cookies (small text files saved on your device) are used on the Website in order to enrich the user experience, ensure security and measure page performance.

The main types of cookies used on the Website are:

• Strictly necessary cookies: Cookies that are technically essential for the Website to perform its basic functions, for secure pages to open and for navigation to work.

• Functional cookies: Cookies that personalise the user experience, such as the preferred language or region selection.

• Performance and analytics cookies: Cookies that anonymously measure how visitors use the Website, which pages are viewed most and whether errors occur.

Visitors always have the right to restrict or block the use of cookies, or to delete existing cookies, by changing their browser settings. Please note that if cookies are disabled entirely, some sections of the Website may not work at full performance. Detailed information on managing cookies is available in the Cookie Policy published on the Website.

5. Sharing Information with Third Parties

Our Company undertakes to keep the information obtained confidential and not to transfer or sell it to third parties for commercial purposes. Such information may be transferred to the following parties only to the extent necessary and solely in order to achieve the purposes set out in this Policy:

• Group companies and affiliates: The group companies and affiliates of Sonay Yatırım A.Ş., for the integrated conduct of investment, project, infrastructure, energy or technology activities and so that requests can be concluded by the relevant units,

• Service providers: Authorised information technology and technology suppliers that carry out the Website's hosting, data storage, cyber security, software infrastructure and technical maintenance operations,

• Legal and administrative authorities: Judicial authorities, law enforcement units and regulatory and supervisory public institutions to which information must be provided under Law No. 5651, the Personal Data Protection Law No. 6698 ("KVKK") and other applicable legislation.

6. External Links (Third Party Websites)

The Website may contain links to external websites belonging to third parties, such as corporate references, affiliate platforms or social media networks.

Our Company has no control or supervisory authority over the privacy policies, security mechanisms, data processing practices or content of such external websites. Our Company cannot be held liable for any damage arising from visiting or using these sites. Visitors are advised to review the privacy and usage terms of the external websites they access.

7. Data Security and Measures Taken

Our Company takes reasonable, necessary and proportionate technical and administrative measures within the framework of current technological means in order to prevent the unlawful processing of the collected data and its unauthorised access, alteration, loss or disclosure:

• All data traffic transmitted through the Website is protected by encryption with an SSL (Secure Sockets Layer) certificate.

• Servers and information systems are equipped with up-to-date firewalls, antivirus software and intrusion prevention systems.

• Access to data is limited to authorised Company personnel who must access it in order to perform their duties, and authorisation matrices and corporate confidentiality undertakings are applied.

• Periodic security audits and log reviews are carried out against potential cyber security risks and leak threats.

8. Visitors Under the Age of 18

The Website is not designed for individuals under the age of 18 or for children. Our Company does not knowingly collect personal information from persons under the age of 18 without the permission or consent of their legal representative. If it is determined that a minor has submitted information without permission, such data are immediately deleted from our systems.

9. Changes to the Policy and Effectiveness

Our Company reserves the right to unilaterally update, amend or repeal this Website Privacy Policy in line with changes in legal regulations, technological developments, sectoral requirements or corporate practice.

Changes to the Policy take effect immediately as of the date the current text is published at https://sonayyatirim.com/tr. Visitors are strongly advised to review the Policy at regular intervals.

10. Contact Information

You may submit any questions, opinions, suggestions or requests regarding the application of this Policy, our privacy practices or your personal data through the following contact channels:

• Data controller / company name: Sonay Yatırım Anonim Şirketi

• Address for notification: Funda Sok. No:1 Levent Mah. Beşiktaş / İstanbul

• Phone: +90 312 481 00 00

• E-mail: info@sonayyatirim.com

• Website: https://sonayyatirim.com/tr

This English text is a courtesy translation. In the event of any inconsistency, the Turkish version shall prevail.

Sonay Yatırım Anonim Şirketi