DATA CONTROLLER APPLICATION FORM - PRIVACY NOTICE

This Clarification Text has been prepared by SICPA TURKEY Ürün Güvenliği Sanayi ve Ticaret Anonim Şirketi acting in the capacity of data controller, within the framework of Article 10 of the Law on the Protection of Personal Data No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, for the purpose of informing you regarding the purposes of processing your personal data, legal reasons, methods of collection, to whom it may be transferred, and your rights under the KVKK.

The following personal data you share through the "Data Controller Application Form" below:

Data Categories	Examples of Data Types Processed in This Category
Identity Data	Your name, surname, Turkish ID Number or Passport
Contact Data	Your phone number, e-mail address, residence

are processed to:

Conduct the necessary evaluation and work on your application,
Conduct the relevant business processes and contact you regarding the subject.

Additionally, we do not have absolute control over the information you share through this form. We recommend that you do not share with us any personal data or special categories of personal data that you do not want us to know.

The personal data in question is processed through automated or non-automated means based on the legal grounds stipulated in Article 5 of KVKK, namely that processing is mandatory for the data controller to fulfill its legal obligation and for the establishment, exercise, or protection of a right. If you provide any special categories of personal data to us through this form, such data will be processed based on the legal ground stipulated in Article 6 of KVKK, namely that processing is mandatory for the establishment, exercise, or protection of a right, and will be shared only with the relevant judicial authorities in case of legal disputes.

You may submit your requests under Article 11 of the Law, which regulates the rights of the data subject, through the form below to our contact channels specified in the form, in accordance with the "Communiqué on Application Procedures and Principles to the Data Controller".

SICPA TURKEY
DATA CONTROLLER APPLICATION FORM

1. General Explanations

Under Law No. 6698 on the Protection of Personal Data ("KVKK"), personal data owners defined as the data subject ("Applicant") are granted the right to submit requests regarding the processing of their personal data pursuant to Article 11 of KVKK.

The application form has been prepared to determine your relationship with SICPA TURKEY Ürün Güvenliği Sanayi ve Ticaret Anonim Şirketi ("SICPA TURKEY") and to identify your personal data processed by SICPA TURKEY, if any, in full, so that a correct and legal response can be provided to your relevant application. In order to ensure the security of your personal data and prevent unlawful data transfer, additional information for identity and authorization verification may be requested by SICPA TURKEY. If the information provided by the Applicant is not accurate and/or up-to-date, or if the requests are unauthorized, the responsibility regarding this matter belongs to the Applicant.

In accordance with Article 7 of the Communiqué on the Procedures and Principles for Application to the Data Controller, if the Applicant's request is to be answered in writing, no fee is charged for up to ten pages. A processing fee of 1 Turkish Lira may be charged for each page over ten pages. If the response to the application is provided in a recording medium such as a CD or flash drive, a fee equal to the cost of the recording medium may be requested.

2. Scope of the Right to Apply Under Article 11 of KVKK

The Applicant may submit a request to SICPA TURKEY regarding the following matters:

To learn whether their personal data is being processed,
To request information if their personal data has been processed,
To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
To learn the third parties to whom their personal data is transferred domestically or abroad,
To request the correction of incomplete or incorrectly processed personal data and to request notification of this correction to third parties to whom personal data has been transferred,
To request the deletion, destruction, or anonymization of their personal data if the reasons requiring their processing no longer exist, even though they have been processed in accordance with KVKK and other relevant legal provisions, and to request notification of this action to third parties to whom personal data has been transferred,
To object to a result arising against them through the analysis of processed data exclusively through automated systems,
To request compensation for damages if they suffer damage due to unlawful processing of their personal data.

3. Application Method

Pursuant to the first paragraph of Article 13 of KVKK, applications regarding these rights must be submitted to us in writing, signed, or by other methods determined by the Personal Data Protection Board ("Board").

In this context, written applications can be submitted by printing this form:

Through in-person application by the Applicant,
Through a notary,
Through registered electronic mail (KEP) address, secure electronic signature, mobile signature, or
Through e-mail sent from the electronic mail address previously notified to us by the Applicant and registered in our system.

Application Method	Information to be Specified when Sending Application	Address for Application
1. In-Person Application (The applicant applies in person with an identity verification document)	The envelope should be marked: "Request for Information within the Scope of the Law on the Protection of Personal Data".	Burhaniye Mah. Kanuni Sultan Süleyman Sk. Mabeyın Konakları Sitesi D No: 4D İç Kapı No: 1 Üsküdar / İstanbul
2. Notification through notary	The notification envelope should be marked: "Request for Information within the Scope of the Law on the Protection of Personal Data".	Burhaniye Mah. Kanuni Sultan Süleyman Sk. Mabeyın Konakları Sitesi D No: 4D İç Kapı No: 1 Üsküdar / İstanbul
3. Via Registered Electronic Mail (KEP) (Signed with a "secure electronic signature")	The subject line of the email should read "Personal Data Protection Law Information Request."	sicpaturkey@hs02.kep.tr
4. Application via Electronic Mail Address Registered in Our System (Via Mobile Signature or E-mail)	Please write "Law on the Protection of Personal Data – Information Request" in the subject line of the e-mail.	kvkk@sicpa.com.tr

SICPA TURKEY may request additional information and take necessary measures to verify the identity of the Applicant in applications made via e-mail.

Pursuant to the second paragraph of Article 13 of KVKK, your applications submitted to us will be responded to in writing or electronically within thirty (30) days from the date your request is notified to us or received by us, depending on the nature of the request.

4. Your Identity and Contact Information

A. Applicant Contact Information

Name
Surname
Turkish ID No / Passport No (if foreign)
Phone
E-mail
Residence or Business Address

B. Please indicate your relationship with SICPA TURKEY.

(Visitor, Product or Service Recipient, Business Partner Employee, Job Candidate, Former Employee, Third-Party Company Employee, Shareholder, etc.)

5. Please select the method for notifying you of our response to your application:

☐ I want it sent to my address.
☐ I want it sent to my e-mail address. (If you choose the e-mail method, we can respond to you faster.)
☐ I want to pick it up in person. (In case of collection by proxy, a notarized power of attorney or authorization document is required.)

6. Subject of Request

Please specify your request under KVKK in detail below.

.............................................................................................................................................................................

Applicant
Name / Surname:
Signature (if written application)