This is an English courtesy translation. In case of any discrepancy, the Turkish version is the binding text.

Privacy Notice on the Protection and Processing of Personal Data

This privacy notice has been prepared by Kosa Group Ambalaj Sanayi ve Ticaret Limited Şirketi (“KOSAPACK” or the “Company”), in its capacity as data controller, pursuant to Article 10 of Turkey’s Personal Data Protection Law No. 6698 (the “KVKK”).

1. Personal Data We Process

The following personal data may be processed during quote request, communication and order processes:

• Identity: full name and, if applicable, company representative information
• Contact: phone, email, WhatsApp number, address
• Customer Transaction / Request: brand/company name, industry, requested packaging type, quantity, reference visuals, message/request content
• Transaction Security: IP address, cookie and log records (website usage)

2. Purposes of Processing Personal Data

• Receiving and evaluating quote requests and preparing quotes
• Responding to requests, questions and complaints; carrying out communication activities
• Providing products and services and carrying out order and contract processes
• Fulfilling legal obligations and managing legal processes
• Promotional, campaign and commercial electronic message activities based on your explicit consent

3. Legal Grounds for Processing (KVKK Art. 5)

• Being directly related to the conclusion or performance of a contract (Art. 5/2-c)
• The Company’s fulfillment of its legal obligation (Art. 5/2-ç)
• Legitimate interest, provided it does not harm the fundamental rights and freedoms of the data subject (Art. 5/2-f)
• Your explicit consent where none of the above grounds apply (Art. 5/1)

4. Method of Collection

Your personal data is collected electronically through the website’s quote/contact forms, WhatsApp, email and phone.

5. Transfer of Personal Data

Limited to the purposes above, your data may be transferred to authorized public institutions and organizations within the framework of legal obligations, and to the suppliers/business partners from whom services are received (e.g. hosting, email, accounting and communication service providers). Since some service providers’ servers may be located abroad, transfers abroad are, where necessary, carried out in accordance with the conditions set out in Article 9 of the KVKK.

6. Retention Period

Your personal data is retained for the period required by the processing purpose and for the legal retention periods stipulated in the relevant legislation; upon expiry of these periods or when the purpose ceases to exist, it is deleted, destroyed or anonymized.

7. Your Rights as a Data Subject (KVKK Art. 11)

By applying to the data controller, you have the following rights:

• To learn whether your personal data is being processed,
• To request information if it has been processed,
• To learn the purpose of processing and whether it is used in accordance with that purpose,
• To know the third parties to whom it is transferred domestically or abroad,
• To request correction if it has been processed incompletely or inaccurately,
• To request its deletion or destruction,
• To request that correction/deletion actions be notified to the third parties to whom the data was transferred,
• To object to an outcome against you resulting from analysis solely by automated systems,
• To request compensation for damages in the event you suffer loss due to unlawful processing.

8. Application Method

In accordance with the “Communiqué on the Procedures and Principles of Application to the Data Controller,” you may submit your requests regarding your rights in writing to the address above or to the email address info@kosapack.com, together with information verifying your identity. Your requests are concluded within 30 days at the latest.