1. PURPOSE AND SCOPE The goal of this Personal Data Protection and Confidentiality Principles (“Principles”) is to regulate the principles adopted by …ERA Elektronik Sanayi ve Ticaret A.Ş.…………. (hereinafter referred to as the “Company” or the “Data Controller”) to protect the personal data as the data controller, in addition to determining the personal data processing principles regarding the processing of the personal data that belongs to Customers, Suppliers/Business Partner Authorities, Employee Candidates and Online Visitors (“Groups of People”) and to inform these related groups of people.

2. THE PRINCIPLES TO PROCESS THE PERSONAL DATA We process your personal data as a company, in scope of the belowmentioned principles, with the title of the Data Controller.

2.1 Processing with good faith based on laws We act according to the principles based on laws as well as general trust, good faith and integrity in processing your personal data.

2.2 Ensuring that the Personal Data is correct and up-to-date whenever Required We carry out periodic controls as well as updates and take the required precautions to ensure the processed data is correct and up-to-date by taking your legal interests into account. In this scope, the systems to control the correctness of the personal data and to carry out the required corrections are formed within the body of the Company.

2.3 Processing with specific, clear and legal purposes We process your personal data with clear, specific and legal data processing goals.

2.4 Being related, limited and moderate in scope of the processing purposes Your personal data is processed to carry out the stipulated goal(s) with moderation in a limited way in association with the goal and the personal data not required or related to the goal is avoided from being processed.

2.5 Storage during the period stated in the related legislation or as long as required for the processing goal Your personal data is stored as long as required by the processing goal or for a time period as stipulated by the related legislation. In this scope, firstly we determine whether a period is stipulated or not in scope of the related legislation; we obey if a period is determined, otherwise your personal data is stored as long as required for the processing goals. If the period ends or if the reasons exist no more, if there is no legal condition that allows longer processing time, your personal data is erased, deleted or anonymized based on the related legislation.

3. THE CONDITIONS TO PROCESS YOUR PERSONAL DATA Your personal data is processed by the company based on the conditions below.

3.1 Requirement to be clearly stipulated in the laws Your data can only be processed in scope of the conditions explicitly stipulated in the laws.

3.2 The conditions when the data subject’s explicit consent can not be obtained because of actual impossibilities The personal data can be processed in obligatory cases to save the life or bodily integrity of the data subject or another person, if that person cannot declare consent because of actual impossibilities or in scope of people whose consent cannot be accepted as valid.

3.3 Direct relation to draw up or perform the contract Your personal data can be processed if the personal data of the parties of the contract is required to be processed, on condition that the data is directly related for the preparation or performance of a contract.

3.4 Fulfillment of the legal liabilities by the Company Your personal data can be processed if the processing is compulsory to fulfill the legal responsibilities of the Data Controller.

3.5 When personal data is made public If your personal data is publicly disclosed by you, that data can be processed.

3.6 When it is compulsory to process the data to establish or protect a right Your personal data can be processed when it becomes compulsory to process data in order to establish, use or protect a right.

3.7 The processing of the data in scope of the legal interests Your personal data can be processed when it is required to do so for the legal interests of the Company.

3.8 The processing of the data based on your explicit consent Your personal data can be processed based on your explicit consent in cases where your data cannot be processed based on any other condition stated among these Principles.

4. THE PURPOSES OF PROCESSING THE PERSONAL DATA The personal data can be processed by the Company with the belowmentioned purposes in scope of the groups of people and based on the processing conditions stated in the 5th and 6th articles of 6698 no. Law.

4.1 THE CUSTOMER The Customers’ personal data is processed based on the processing conditions stated in the 5th and 6th articles of 6698 no. Law, in scope of the subjects for which you disclosed your personal data to us, which include the performance of the after-sale support services for the sold goods and services, to carry out the sales processes of the goods and services, to carry out the related production and operation processes, to carry out the ethical/audit activities, to carry out the activities based on legislation, to carry out the financial and accounting works, to carry out and to keep the track of the legal works, to carry out the internal audit/inquiry/intelligence activities, to track the complaints and demands, the perform and supervise the business activities to take precautions to improve the business processes and to assess them, to carry out activities to ensure business continuity, to carry out customer relations management processes, to carry out customer satisfaction activities, to carry out advertisement/campaign/promotion processes, to manage the contractual procedures as well as the communication activities.

4.2 EMPLOYEE CANDIDATES The personal data of the employee candidates is processed based on the personal data processing conditions stated in the 5th and 6th articles of 6698 no. Law, in order to carry out the processes to provide personnel, to plan and perform the human resources processes, to carry out the application processes of the employee candidates and to carry out the activities according to the legislation.

4.3 THIRD PARTIES The personal data of the third parties is processed based on the personal data processing conditions stated in the 5th and 6th articles of 6698 no. Law, in order to carry out the personnel procurement processes, service and sales processes, to perform the activities according to the legislation, to track and manage the legal affairs, to carry out the contractual processes, to track the complaints and demands, to carry out and audit the business activities, to carry out activities to ensure business continuity, to carry out customer relations management processes, to carry out advertisement/campaign/promotion processes as well as the communication activities.

4.4 SUPPLIERS/BUSINESS PARTNER AUTHORITIES The personal data of the suppliers/business partner authorities is processed based on the personal data processing conditions stated in the 5th and 6th articles of 6698 no. Law, in order to carry out the processes to purchase the goods and services, to carry out the activities according to the legislation, to carry out the financing and accounting works, to carry out and audit the business activities, to carry out the management processes as well as the communication activities in addition to providing the authorized people, organizations and institutions with information.

4.5 ONLINE VISITORS The personal data of the online visitors can be processed in scope of the data processing conditions stated in the 5th and 6th articles of 6698 no. law, in order to carry out the marketing analysis studies, the processes of advertisement/campaign/promotion as well as the communication activities, to carry out studies to improve the products and services in addition to fulfilling the legal responsibilities.

5. THE PERSONAL DATA TRANSFER Your personal data can be transferred to our business partners, suppliers, legally authorized governmental bodies and private persons which are located within the country or abroad, in scope of the limits, purposes and conditions to process personal data as stated in the 8th and 9th articles of 6698 no. law, in addition to the principles and goals stated in the 3rd and 5th articles of the Principles on Protection of the Personal Data and Confidentiality.

6. THE METHOD AND LEGAL REASON TO COLLECT THE PERSONAL DATA You personal data which is digitally submitted to the Company is processed as below, in scope of the related groups of people.

6.1 THE CUSTOMERS The personal data of the customers is processed in physical and electronic environments, by being obtained directly from the person or the third parties as part of a data recording system with the help of the written or verbal data transfer devices, in a completely or partially automatic way or through non-automatic means on condition of being a part of any data recording system, based on the legal reasons stated in the 5th article of 6698 no. law, which includes the “explicit consent of the data subject”, “being clearly stipulated in the laws", “being required to fulfill the legal responsibility of the data controller”, “being compulsory to process the personal data of the contractual parties on condition of being directly related to draw up or perform a contract”, “being required to establish, use or protect a right”, “being compulsory to process the personal data for the legal interests of the data controller on condition that the data subject’s main rights and freedoms are not harmed”.

6.2 EMPLOYEE CANDIDATE The personal data of the employee candidates is processed in physical and electronic environments, by being obtained directly from the person or the third parties as part of a data recording system with the help of the written or verbal data transfer devices, in a completely or partially automatic way or through non-automatic means on condition of being a part of any data recording system, based on the legal reasons stated in the 5th article of 6698 no. law, which includes the conditions of “being required to fulfill the legal responsibility of the data controller”, “being compulsory to process the personal data of the contractual parties on condition of being directly related to draw up or perform a contract”, being compulsory to process the personal data for the legal interests of the data controller on condition that the data subject’s main rights and freedoms are not harmed”.

6.3 THE THIRD PARTIES The personal data of the third parties is processed in physical and electronic environments, by being obtained directly from the person or the third parties as part of a data recording system with the help of the written or verbal data transfer devices, in a completely or partially automatic way or through non-automatic means on condition of being a part of any data recording system, based on the legal reasons stated in the 5th article of 6698 no. law, which includes the “explicit consent of the data subject”, “being required to fulfill the legal responsibility of the data controller”, “being required to establish, use or protect a right”, “being compulsory to process the personal data for the legal interests of the data controller on condition that the data subject’s main rights and freedoms are not harmed”.

6.4 THE SUPPLIERS / BUSINESS PARTNER AUTHORITIES The personal data of the suppliers/business partner authorities is processed in physical and electronic environments, by being obtained directly from the person or the third parties as part of a data recording system with the help of the written or verbal data transfer devices, in a completely or partially automatic way or through non-automatic means on condition of being a part of any data recording system, based on the legal reasons stated in the 5th article of 6698 no. law, which includes the “explicit consent of the data subject”, “being required to fulfill the legal responsibility of the data controller”, “being compulsory to process the personal data of the contractual parties on condition of being directly related to draw up or perform a contract”.

6.5 ONLINE VISITORS The personal data of the online visitors is automatically processed based on the legal reasons stated in the 5th article of 6698 no. law, which includes the conditions of “being required to fulfill the legal responsibility of the data controller” and “being compulsory to process the personal data for the legal interests of the data controller on condition that the data subject’s main rights and freedoms are not harmed” as well as the 5651 No. Law on the Regulation of Online Publications to Fight Against the Crimes Which Are Committed By Using Them.

7. THE SECURITY OF THE PERSONAL DATA The company takes all the required precautions to ensure the security of the personal data, to prevent their illegal processing, to prevent unauthorized access risks, accidental data losses, accidental erasure or damage of the data. Every kind of technical and physical precautions are taken to prevent the access of unauthorized people to the personal data. In this scope, especially the authorization system is designed in such a way to ensure people or systems cannot access to personal data more than they need. The company carries out the required audits (or have them carried out by other parties) to ensure the provisions of 6698 No. Law are applied in scope of its own organization or institution.

8. THE COMMITMENTS FOR THE PERSONAL DATA OF THE THIRD PARTIES The personal data regarding the third parties submitted by the People Groups are accepted by the People Group where they can be processed by the Company, and consent is given. The related Person Group undertakes to provide the required information according to 6698 No. Personal Data Protection Law about the transmitted people and information and to obtain the related approvals. Otherwise the related People Group shall be responsible from any harm.

9. THE APPLICATION METHOD AND PRINCIPLES As the data subject, you can submit your requests in scope of the 11th article of 6698 No. Law, according to the methods and principles stated in the Data Subject Application Form at our era-elektronic.com web address, by filling the related form and by sending a message to our eraelektronik@hs03.kep.tr KEP address which fulfills the minimum conditions stipulated by the Notice on the Method and Principles to Submit Application to the Data Controller, or by sending a message to our system at eraelektronik@hs03.kep.tr address with your registered e-mail or with your secure e-signature, or personally at our Dudullu OSB, 4. Cad. 11, Umraniye, 34776 Istanbul address in written form or through an application sent via the public notary. We are going to conclude your application as the Company within thirty days at the latest depending on the nature of your request, and for free. But, if the process requires additional costs, the Company shall request the fee that is determined by the Personal Data Protection Board. As the data subject, you have the belowmentioned rights in this scope:

• To learn whether the personal data is processed or not,

• To demand information if personal data is processed,

• To learn the purpose of processing the personal data and if they are used according to the related purposes,

• To know the third parties to whom the personal data is transferred (domestic or abroad),

• To demand correction if the personal data is processed with errors or missing points,

• To demand the erasure or destruction of the personal data in scope of the conditions stipulated in the related legislation,

• To request notification about the third parties to whom the personal data is transferred,

• To make objections to the results that emerged through the analysis of the processed data which is carried out exclusively by automatic systems, when the results are against the data subject, and

• To demand compensation for the damages, when exposed to losses because of the illegal processing of the personal data.

10. COOKIE POLICY • Cookie Notifications

• 1. Cookies • When you visit this web site we may store some information on your computer or mobile device in the form of “cookies” which allow us to automatically recognize you when you visit again (when we read the cookie again) .

• Cookies can be helpful in many ways. For example they can help us to adapt this web site in a way that suits your needs better, or they can remember your password so that you would not need to re-enter it each time you visit the web site.

• A general explanation on the cookies used on this website will be provided. You will learn about the purpose, expiry date and type of such cookies.

• You can choose to accept or reject the cookies. Your options to manage which of our cookies can be stored or read on your computer or mobile device, are stated below. When you do not accept the cookies designated as ‘Absolutely Necessary’ it will be impossible to visit this website. If you reject other cookies, some properties, resources or offers of our web site may become dysfunctional, and you may lose some functions or convenience possibilities because of that.

• 2. Types of the Cookies

• The belowmentioned types of cookies can be used when you visit this web site.

• 2.1.Storage Period

• -Session: It becomes deleted automatically when you close your browser.

• -Permanent: It will be stored on your terminal device until it reaches its expiry date as defined.

• 2.2.The Responsible Party

• -The First Party: They are generally defined by the URL displayed on the address bar of the browser and stored by the data controller that runs the visited web site (or any of the data processors) (in other words, placed by us)

• -The Third Party: They are stored by the data controllers which do not run this website that is visited at the moment (in other words: not placed by us)

• 3. Cookie Categories

• 3.1.Types of Cookies

• -Absolutely Necessary- if you deactivate such cookies, this web site will become impossible to be visited.

• -Functional- If you deactivate such cookies, we may not provide the functions clearly requested by you.

• -Social add-on tracking – These are third party (social network) cookies which are not related to the functions; they are used by the social add-on modules which are integrated to the web site by us, and they are used to track the individuals with purposes such as behavioral marketing, analytical or market study etc. purposes.

• -Third party advertising - These are third party cookies used for purposes such as advertising, behavioral advertising, frequency limits, financial records, advertisement links, click fraud detection, study and market analysis, product development and debugging etc.

• -First party analysis–the cookies created by this web site to obtain statistics about the visitors of this web site (for example the number of unique visitors, web site navigation problem detection, frequently used search engine key word detection etc. …)

•3.2.Management Options

• If you prefer to deactivate, you can review the settings of your browser and choose one of the belowmentioned options: 

• Remove the cookies immediately from the computer or mobile device; 

• Prevent the cookies;

• Warn before storing a cookie.

•If you remove or deactivate such cookies, it will be impossible for you to visit this web site.