Clarification Text on The Processing of Personal Data

This clarification text is shared as a part of our legal obligations according to the Article 10 (Obligation of giving information for data controllers) of the Personal Data Protection Law no.6698 (“PDPL” or “the Law”) and “Communiqué On Principles And Procedures To Be Followed In Fullfillment Of The Obligation To Inform”. As data controller [Nanografi Nano Teknoloji A.Ş. (“Nanografi”)] with this information document we’d like to inform you about the personal data you share with us, the purposes of processing this personal data, potential recipients of this data, the way we collect them, the legal basis of collection and your rights on your personal data in scope of the Law.

Hereby, the clarification text and other texts/policies about personal data protection are always reachable on the web address https://www.nanossr.com (“website").

Nanossr takes all necessary technical and administrative precautions in order to protect and legally process its customers’, visitors’, workers’ and other related data subjects’ personal data.

A. The Personal Data Processed and Purposes of Data Processing

Your personal data is gathered through the forms located on “Talent Management” and “Supply Chain Management” tabs under “Human Resources” and “Suppliers” main tabs and through the form located on “Contact us” tab at Nanografi website. https://nanossr.com/contact-us/

General Processing

• Providing services to the Data Subject or improving the services provided,

• Customizing the products and services offered by our Company according to the preferences and needs of the Data Subject,

• Planning and/or executing the activities for the sale and marketing of products and services,

• Planning the relevant processes to obtain the highest benefits from the products or services provided,

• Managing customer services and relationships,

• Fulfilling legal and operational requirements within the scope of the commercial relationships conducted by our Company and the cooperation established with the Data Subject,

• Ensuring access to statistical information for our Company to manage its economic and administrative affairs more efficiently and to receive advertisements/accurate technical analysis/reporting.

• Your personal data specified in this Clarification/Information Text may be processed for the above-mentioned purposes, only within the scope of the explicit consent that you grant by approving this Clarification Text.

Categorized Processing

• Talent Management:

• Nanossr Career Portal https://nanossr.com/career/: In order to evaluate the applications, the identification, contact information, and the personal data included in applicants’ resumes, especially education, work experience, military obligation status, is gathered.

• Visionary Young: In order to evaluate the applications, the identification, contact information, the personal data included in applicants’ resumes, especially education, work experience, military obligation status and according to the applicants’ status the personal data included in applicants’ transcript and obligatory internship document is gathered.

• Supply Chain Management:

• In order to improve the communication and traceability with our present/future suppliers, name, surname, email, mobile phone number, internal phone number, address, and department name of suppliers’ authorized personnel is gathered.

• The Application of Data Subject:

• In order to evaluate the applications according to the Article 11 of the Law that states the rights of data subject; name, surname, TCKN, passport number, notification address, phone number, email, relationship with our company, work period, company information, and signature of applicants is gathered.

B. Transferring Personal Data

For the purposes of planning and execution of the commercial and business strategies of our Company, execution of the necessary works by our relevant business units for the realization of the commercial activities conducted by the Company and the execution of the associated business processes in accordance with the Article 5(2)(1) of the Personal Data Protection Law and based on your explicit consent; your personal data can be processed and disclosed to the individuals/companies from which we receive services or with which we cooperate to ensure legal, technical, and commercial occupational safety of our Company and the relevant individuals who are in commercial relationship with our Company, including tax and IT companies, independent audit companies, our shareholders residing inland and abroad, companies from which we receive advertisements, as well as group companies, our business partners in the field of telecommunications and electronic communications, our inland/overseas storage, retention, and archive service providers, databases, server hosting service providers, data centers, cloud platforms, official institutions that are legally authorized to request customer information, legally-authorized public organizations and private individuals pursuant to the personal data processing conditions and purposes described in the Articles 8 and 9 of the Personal Data Protection Law, and your personal data can be sent or transferred inland and/or abroad in line with the above-mentioned purposes and reasons.

Your personal data can be transferred to 3rd parties in scope of the purposes stated below and according to the provisions of the Law that regulates the national and international personal data transfer:

• In order to fulfill our legal obligations, personal data can be transferred to the authorized public institutions in scope of the related regulatory basis.

• In order to meet their demands, your personal data can be transferred to supervisory and regulatory bodies.

• In order to execute the legal processes, your personal data can be transferred to legal authorities and legal offices that have been authorized to process personal data in the name of Nanografi.

• For talent management purposes, your data can be transferred to the talent management companies that have been authorized by Nanografi.

• Due to the fact that social media sites and servers are based abroad, personal data of data subjects, such as audio, video recordings, photographs, membership information (phone number, e-mail address, residential address etc.) may be transferred abroad by using the sites/by sharing them, if necessary.

C. Methods of Gathering Data and Legal Basis

Primarily, your personal data is collected upon the marking by you of the following box “I grant consent for the use of my personal data as specified in the clarification and explicit consent text“, confirming that you grant explicit consent for the collection and processing of your personal data, which you choose to fill in with your explicit consent or which you are obliged to fill in prior to the provision by our Company of internet access to users, for the purposes specified in this clarification and explicit consent text, so that our Company can fulfill its legal obligations prescribed in the Law No. 5651 on the Regulation of Publications Made on the Internet and Combating the Crimes Committed Through These Publications, the Regulation on the Providers of Internet Services for Collective Use as published in the Official Journal on 11.04.2017 and the relevant legislation.

Your Identity, Contact Information, Data Traffic Information, and Other Information obtained are processed in electronic and physical environment based on your explicit consent, by taking necessary administrative and technical measures in accordance with the Article 5(1) of the Personal Data Protection Law.

Your personal data is gathered automatically through the forms on our website in scope of purposes listed above and processed on the legal basis stated below:

• Through your explicit consent.

• In case the personal data processing is an obligation stated on the regulations listed below:

• Defense Industry Security Law (Law no. 5202)

• Labor Law (Law no. 4857)

• Turkish Commercial Code (Code no. 6102)

• Turkish Code of Obligations (Code no. 6098)

• In case it is necessary to process personal data of parties to a contract in order for establishment and performance of that contract.

• When it is obligatory in order to fulfill our legal obligations.

• If the personal data is revealed to the public by the data subject herself/himself.

• When personal data processing is obligatory for establishment, usage and protection of a right.

• In case personal data processing is necessary for Nanografi’s legitimate interests, provided that the fundamental rights and freedoms of the data subjects are not harmed.

• When it is necessary in order to protect the life or physical integrity of the data subject or another person where the data subject is physically or legally incapable of giving consent.

D. Application to Data Controller

According to the Article 11 that states the rights of data subject, you have the rights to::

• Learn whether your personal data has been processed or not,

• Get information if your data has been processed,

• Learn the purpose of data processing and whether your personal data has been processed in scope of these purposes or not.

• Know the domestic and international 3rd part recipients of your personal data,

• Demand correction for your personal data that has been processed incorrectly,

• Demand destruction of your personal data in scope of the statements in Article 7 of Law,

• Demand to inform 3rd part recipients of your personal data about destruction and correction activities stated above,

• Object to the unfavorable results of processing your personal data through automatic systems,

• Demand for compensation in case your personal data has been processed illegally.

If you wish to exercise these rights, you should fill the application form named as “Nanografi Nano Teknoloji Anonim Şirketi Application Form For Data Subjects” on "https://www.nanossr.com.tr/tr/iletisim" web site according to the “Communique on procedures and principles of application to data controller” in order us to verify that the application belongs to you and

• Send your application form to “Serhat Mah. Melih Gökçek Bulvarı, 1364. Sk. No:47 Yenimahalle/ANKARA” address through notary channel,

• Or send the form (can be reached from the website) filled by data subject via e-mail with the form filled by data subject to marknanossr@gmail.com

• Or mail to marknanossr@gmail.com address via secure electronic signature, mobile signature.

Your application will be replied ASAP and at least in 30 days’ time for free of charge according to its scope. In case your application requires extra cost, we may charge you a fee according to the regarding regulation of Personal Data Protection Authority.

Important Note: The application process of Data Subjects’ Rights just includes the rights stated above in scope of the Law. The demands and questions about job, internship etc. applications are out of scope of this process.

Personal datas listed above, they are collected automatically and non-automatically through closed circuit systems and stored for legal periods required by the purpose.

In case of any conflict that may arise, the data controller will be able to store your data during the prescription according to legislation due to make the necessary defenses or can share with authorized institutions and organizations upon request.

E. Period of Processing Your Personal Data

Your Personal Data is processed for the period which is prescribed in the relevant legislation for the retention of such data, or is processed for the period required for the purpose that they are processed, if there is no period prescribed in the relevant legislation. Upon the expiration of the relevant periods, your Personal Data will be deleted, destroyed or anonymized automatically or immediately upon your request in accordance with the provisions of the “Regulation on the Deletion, Destruction or Anonymization of Personal Data”.

You can notify your request to exercise these rights, together with your identification documents, by delivering the documents that contain original wet signature by hand to the address of Serhat Mah. Melih Gökçek Bulvarı, 1364. Sk. No:47 Yenimahalle/ANKARA or send a legal notification to our Company at the address of Serhat Mah. Melih Gökçek Bulvarı, 1364. Sk. No:47 Yenimahalle/ANKARA notary public.

F. Your rights in scope of Data Protection Regulations

Personal datas listed above, they are collected automatically and non-automatically through closed circuit systems and stored for legal periods required by the purpose.

In case of any conflict that may arise, the data controller will be able to store your data during the prescription according to legislation due to make the necessary defenses or can share with authorized institutions and organizations upon request.

The last but not the least, you can send your demands to Nanografi by the methods stated in “the clarification text” in scope of the article 11 of the Law that regulates the rights of data subject.

Any data subject is free to exercise any right of Article 11 of the Law by applying with “data subject form”. You can notify your request with that form to exercise these rights, together with your identification documents, by delivering the documents that contain original wet signature by hand to the address of Serhat Mah. Melih Gökçek Bulvarı, 1364. Sk. No:47 Yenimahalle/ANKARA or send a legal notification to our Company at the address of Serhat Mah. Melih Gökçek Bulvarı, 1364. Sk. No:47 Yenimahalle/ANKARA notary public. Also these rights are exercised too by sending the form (can be reached from the website) filled by data subject via e-mail with the form filled by data subject to marknanossr@gmail.com

If your application also requires a cost, the fee in the tariff determined by the Personal Data Protection Authority, may be charged.

Nanossr Nano Teknoloji Anonim Şirketi