Digital Services Disclosure Notice

1. Purpose and Scope

As Elektra Software (hereinafter referred to as the "Organisation"), we would like to state that we work diligently to keep the personal data you share with us secure and protected. The Organisation is a "data controller" in the situations set out in this text and in the Privacy Policy. We process your personal data in accordance with Law No. 6698 on the Protection of Personal Data ("KVK") and take proportionate and adequate administrative and technical measures to protect it.

Within this framework, the personal data of video conference participants, of those who contact us through instant messaging applications and of the persons with whom we share files over the internet is processed under the conditions explained below and within the limits set out in the legislation. For more detailed information on how your personal data is processed, you may review our Privacy Policy, which forms part of our disclosure obligation.

ELEKTRA SOFTWARE is not responsible for data security and the protection of personal data in relation to websites and social media accounts that do not belong to us, even if we link to them from our website. We recommend that you review the policies and documents of the organisation that owns the relevant site or account.

2. Some Key Definitions

• Personal data: Any information relating to an identified or identifiable natural person.
• Explicit consent: Consent relating to a specific subject, based on information and expressed by free will.
• Data controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.
• Data processor: The natural or legal person who processes personal data on behalf of the data controller, based on the authority granted by the data controller.
• Sub-processor: The natural or legal person who processes the data subject's data together with the data controller but for its own purposes and by its own means, and is responsible for establishing and managing its own data recording system.
• Data subject: The natural person whose personal data is processed.
• Processing of personal data: Any operation performed on data, such as obtaining, recording, storing, retaining, altering, reorganising, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, by wholly or partly automated means, or by non-automated means provided that it forms part of a data recording system.

3. Identity of the Data Controller

ELEKTRA SOFTWARE processes your personal data in the capacity of "Data Controller" as defined in Article 3 of Law No. 6698 on the Protection of Personal Data. Its contact details are as follows:

• Trade name: Elektra Software Ltd. (operating under the OPEX brand)
• Address: 68 Tyrrells Way, Sutton Courtenay, Abingdon, OX14 4DH, London, England
• E-mail: opex@opex.app

4. Legal Nature and Scope

Article 10 of Law No. 6698 imposes on data controllers the obligation to inform the persons whose personal data is processed. The disclosure obligation requires that you be informed about matters such as the rights listed in Article 11 of the KVK Law, the identity of the data controller, the purposes of processing personal data, the persons to whom it is transferred, the purposes and methods of transfer, the legal grounds for collecting personal data, and how you can apply as a data subject.

Through this "Disclosure Notice" and our "Privacy Policy", Elektra Software aims to inform you that your personal data is processed within the limits and conditions set out in the legislation.

5. Purposes of Processing Your Personal Data — Management Processes

Your personal data is processed for the following purposes, in line with the principles of the KVK Law:

• Conducting commercial activities
• Ensuring business continuity and providing legal and administrative business security
• Planning and executing business and application strategies
• Managing occupational health and safety processes
• Presenting, promoting and providing information about the organisation, its services and products
• Using electronic and other social media tools and printed, periodical and non-periodical publications
• Conducting dealership processes
• Establishing and maintaining communication with members of the press and with press and broadcasting organisations
• Informing the public about our activities
• Conducting business meetings in a timely and effective manner
• Completing work in a timely and appropriate manner
• Planning and conducting activities at local, national and international level
• Maintaining relations with business partners and group companies in Türkiye and abroad
• Conducting operations relating to intellectual and industrial property
• Promoting, marketing and providing information about the organisation, its products and services
• Obtaining feedback and responses from customers and potential customers
• Providing technical support to customers
• Answering questions from customers and potential customers
• Participating in events such as trade fairs and seminars

5. Purposes of Processing Your Personal Data — Employee-Related Purposes

Your personal data is additionally processed for the following purposes in relation to employees:

• Establishing and performing employment contracts
• Delivering and implementing the services offered to employees
• Providing socio-economic benefits to employees
• Conducting processes relating to domestic and international assignments, travel and accommodation
• Planning and conducting human resources processes
• Recruitment, management of the employment relationship and performance evaluation processes
• Conducting performance and audit activities

5. Purposes of Processing Your Personal Data — IT Processes

Your personal data is processed for the following purposes within the scope of IT processes, and for these purposes we process it within the conditions for processing personal data set out in Articles 5 and 6 of the KVK Law:

• Establishing and updating the IT and communication infrastructure
• Managing the users of IT tools and systems
• Managing corporate social media accounts
• Conducting operations relating to mobile application users
• Ensuring data security and archiving data
• Tracking the organisation's vehicles and their users
• Protecting and managing customers' digital assets and rights

6. How Your Personal Data Is Processed

We process your data in accordance with the principles listed in Article 4 of the Law and by obtaining your explicit consent.

6.1. Video Conferencing Applications

The use of video conferencing applications such as Skype for business purposes results in the processing of your personal data in categories such as identity, contact, location, visual and audio recordings, and transaction security.

6.2. Instant Messaging Applications

Through the instant messaging applications we use for business purposes, your personal data is processed in categories such as identity, contact, location, and visual and audio recordings.

6.3. Internet-Based File Sharing Applications

Through the file sharing applications we use for business purposes, your personal data is processed in categories such as identity and contact.

6.4. Mobile Applications

Through our mobile applications, your personal data is processed in categories such as identity and contact.

6.5. Social Media Applications

We process the personal data of data subjects on social media applications such as Facebook, Instagram, Twitter and LinkedIn in order to communicate with customers, potential customers and the general public for promotional and informational purposes about our organisation, products and services, and to receive the opinions and suggestions of those we engage with.

7.1. For Which Purposes Personal Data Is Shared

As ELEKTRA SOFTWARE, we transfer the personal data we collect and process in accordance with the KVK Law — for the purposes of business continuity and the performance of services and accompanied by confidentiality agreements — to official institutions/organisations, to our suppliers in Türkiye and abroad with which we have a commercial or sectoral relationship, to companies and services in Türkiye and abroad from which administrative and technical services are procured, to the organisation's solution partners, and to companies in Türkiye and abroad acting as performance assistants. You can find detailed information about with whom and how we share data in our Privacy Policy.

7.2. Transfer Abroad

For the purpose of providing services through cloud, instant messaging or online communication channels that are widely and unavoidably used today, your personal data is shared with the following parties established abroad:

• With Microsoft, based in the USA, for office work and operations
• With Facebook, based in the USA, through the WhatsApp application used as an instant messaging tool between employees and in relationships with customers for business purposes
• With Google, WeTransfer and Microsoft, based in the USA, for sharing large files for business purposes
• With Ammy, based in the USA, and AnyDesk and TeamViewer, based in Germany, which provide remote access in order to give technical support to customers
• With Microsoft, based in the USA, through the Skype application for video conferencing services
• With Apple, Microsoft and Google, based in the USA, which provide the mobile and desktop operating systems used to carry out daily business activities
• With Facebook, Twitter, Instagram and LinkedIn, based in the USA, which provide social media services from abroad

Privacy Policies of Service Providers

You can access the privacy policy of each service provider through the links below:

• Microsoft: https://privacy.microsoft.com/en-us/privacystatement
• WhatsApp: https://www.whatsapp.com/legal/client
• Google: https://policies.google.com/privacy?hl=en-US
• WeTransfer: https://wetransfer.com/legal/privacy
• Ammy: https://www.ammyy.com/en/priv_policy.html
• AnyDesk: https://anydesk.com/en/privacy
• TeamViewer: https://www.teamviewer.com/en/privacy-policy/
• Skype: https://support.skype.com/en/skype/all/privacy-security/
• Apple: https://www.apple.com/legal/privacy/en-ww/
• Facebook: https://www.facebook.com/policy.php
• Twitter: https://twitter.com/en/privacy
• Instagram: https://help.instagram.com/519522125107875
• LinkedIn: https://www.linkedin.com/legal/privacy-policy

8. How Do We Protect Your Personal Data?

All necessary technical and administrative measures are taken to protect the personal data collected by ELEKTRA SOFTWARE, to prevent it from falling into the hands of unauthorised persons, and to ensure that our customers and prospective customers are not harmed. In this context, we take care that the software we use complies with the applicable standards, that data transfer agreements are signed with the data processors and third parties with whom data is shared, and that our Privacy Policy is observed within the organisation.

9. Sharing and Publication of Meeting Recordings

The contents of meetings held by video conference are service-specific and confidential; we may share them with our employees and, limited to the purpose of the meeting, with our business partners.

We may also share and publish the meeting and its content on social media and/or other widely used channels, provided that we inform you at the beginning of the meeting and additionally obtain your verbal and written permission. If you do not consent to this, you may object following the verbal notification and leave the meeting.

10. Your Rights as a Data Subject

As data subjects, you have the following rights as listed in Article 11 of the KVK Law:

• a) To learn whether your personal data is being processed
• b) To request information if your personal data has been processed
• c) To learn the purpose of processing personal data and whether it is used in accordance with that purpose
• d) To know the third parties to whom personal data is transferred in Türkiye or abroad
• e) To request rectification of personal data that has been processed incompletely or inaccurately, and to request that the operation carried out in this respect be notified to the third parties to whom the personal data has been transferred
• f) To request erasure or destruction of personal data where the reasons requiring its processing have ceased to exist, even though it has been processed in accordance with the KVK Law and other applicable legislation, and to request that the operation carried out in this respect be notified to the third parties to whom the personal data has been transferred
• g) To object to an adverse outcome concerning the person arising from the analysis of the processed data exclusively by automated systems
• h) To claim compensation for damage suffered as a result of the unlawful processing of personal data

11. Operations of Third Parties

This Disclosure Notice and the explicit consent statement apply only to the applications operated by ELEKTRA SOFTWARE and under our control. Any data processing activities that other parties participating in these applications may carry out without our knowledge, with or without the permission of other participants, are the responsibility of those persons.

12. Your Right to Information About Your Personal Data and the Application Process

You can obtain detailed information about your rights under Article 11 of the Law, which governs the rights of the data subject, and about the method of application from our Personal Data Subject Applications page, and apply to us by following the process described there.

Language of This Text

This is an English translation provided for convenience. In case of any discrepancy between the Turkish and English versions, the Turkish version prevails.