Data Subject Application

PRIVACY NOTICE FOR THE DATA SUBJECT APPLICATION PROCESS

Document No: KVKK_35 · Publication Date: 2 October 2026

As Oredata Yazılım Anonim Şirketi (“Oredata” or the “Company”), the applications you submit to our Company in order to exercise your rights under Law No. 6698 on the Protection of Personal Data (“KVKK”) themselves constitute a personal data processing activity. By means of this Privacy Notice, we would like to inform you about your personal data processed within the scope of your application.

1) DATA CONTROLLER

Under the KVKK, your personal data within the scope of your application are processed by Oredata in its capacity as data controller, limited to the purposes set out in this Privacy Notice.

2) YOUR PERSONAL DATA PROCESSED

The following personal data of yours are processed within the scope of your application:

• Identity Information: Name, surname, Turkish Republic identity number; if you are a foreign national, your nationality, passport number or identity number, if any, signature,
• Contact Information: Place of residence or workplace address for notification purposes, mobile telephone number, e-mail address, fax number, if any,
• Legal Transaction Information: Your application request and its content, the application channel and date, information and documents submitted by you in relation to your request, the response given by our Company and its grounds, power of attorney information, if any,
• Other Information: Information showing the relationship between you and our Company (employee, employee candidate, customer representative, visitor, etc.) and other information submitted by you depending on the nature of your request.

If, due to the nature of your request, you submit special categories of personal data, such data will also be processed solely for the purpose of concluding your request, on the legal ground that processing is necessary for the establishment, exercise or protection of a right pursuant to Article 6/3 (d) of the KVKK, and under additional security measures. We recommend that you do not submit to our Company personal data that are not necessary for concluding your request.

3) PURPOSE AND LEGAL GROUND OF THE PROCESSING OF YOUR PERSONAL DATA

Your personal data are processed within the scope of the legal grounds listed in Article 5 of the KVKK, as explained below:

• Receiving your application, verifying your identity, examining and concluding your request and responding to you

For this purpose, your identity, contact and legal transaction information are processed on the legal ground that processing is necessary for the data controller to fulfil its legal obligation pursuant to Article 5/2 (ç) of the KVKK (Article 13 of the KVKK and the Communiqué on the Procedures and Principles of Application to the Data Controller).

• Recording your application and the response given, being able to demonstrate compliance with the legislation and being able to use them as evidence in a potential dispute

For this purpose, your identity, contact and legal transaction information are processed on the legal ground that data processing is necessary for the establishment, exercise or protection of a right pursuant to Article 5/2 (e) of the KVKK.

• Conducting correspondence with the Personal Data Protection Authority in connection with complaints filed with the Authority and implementing the decisions of the Board

For this purpose, your identity, contact and legal transaction information are processed on the legal ground that processing is necessary for the data controller to fulfil its legal obligation pursuant to Article 5/2 (ç) of the KVKK.

4) METHOD OF COLLECTION OF PERSONAL DATA

Your personal data are collected by automated means, and by non-automated means provided that they form part of a data filing system, through your filling in the Data Subject Application Form available on our website and submitting it to our Company address by post or in person, sending it to our registered electronic mail (KEP) address, signing it with a secure electronic signature or mobile signature or using your e-mail address registered in our Company’s system and sending it to our e-mail address designated for applications, or sending it through a notary public.

5) TRANSFER OF YOUR PERSONAL DATA

Your personal data within the scope of your application are shared within our Company with the units involved in concluding your application so that your request can be concluded; apart from this, they are transferred to the following recipient groups:

• to our Company’s legal advisers, where your request requires legal assessment, on the legal ground that data processing is necessary for the establishment, exercise or protection of a right pursuant to Article 5/2 (e) of the KVKK,
• where your request relates to a customer project in which our Company acts in the capacity of data processor, to the relevant customer of ours, which holds the capacity of data controller, so that the request can be concluded by that customer, on the legal ground that data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject, pursuant to Article 5/2 (f) of the KVKK,
• to the Personal Data Protection Authority, if you file a complaint with the Authority or the Authority requests information and documents from our Company; and to courts, enforcement offices and other authorised public institutions and organisations, if your request is brought before the judiciary, on the legal ground that processing is necessary for the data controller to fulfil its legal obligation pursuant to Article 5/2 (ç) of the KVKK,
• where your request for rectification, erasure or destruction is accepted, to third parties to whom this operation must be notified, within the scope of Article 11/1 (f) of the KVKK, on the legal ground that processing is necessary for the data controller to fulfil its legal obligation pursuant to Article 5/2 (ç) of the KVKK.

If your application is submitted by e-mail, since our Company’s e-mail infrastructure is obtained from a service provider established abroad, your personal data may be transferred abroad on the basis of the standard contract announced by the Personal Data Protection Board within the scope of Article 9 of the KVKK. Upon your request, a copy of the provisions of the said standard contract will be sent to you free of charge.

6) YOUR RIGHTS REGARDING YOUR PERSONAL DATA

Our Company hereby informs you that, pursuant to Article 11 of the KVKK, by applying to our Company you have the right to: (a) learn whether your personal data are processed, (b) request information if they have been processed, (c) learn the purpose of processing and whether they are used in accordance with their purpose, (ç) know the third parties in Turkey or abroad to whom they are transferred, (d) request rectification if they are processed incompletely / inaccurately, (e) request their erasure or destruction within the framework of the conditions set out in Article 7 of the KVKK, (f) request notification of the operations carried out pursuant to sub-paragraphs (d) and (e) above to third parties to whom they have been transferred, (g) object to the occurrence of a result to your detriment by means of analysis exclusively through automated systems, and (ğ) claim compensation for damages in the event that you suffer damage due to their unlawful processing.

In this context, you may send your requests regarding your rights by filling in the Personal Data Protection Law Data Subject Application Form available on our website (https://oredata.com/en/data-subject-application/), or by preparing your own request in a manner that meets the conditions determined by the Personal Data Protection Authority, to our addresses given below, by the methods determined by the Personal Data Protection Authority. Oredata will conclude the request free of charge as soon as possible, depending on the nature of the request, and within the period stipulated in the KVKK.

• Our Application Address: Çiftehavuzlar Mah. Eski Londra Asfaltı Cad. Kuluçka Mrk. C1 Blok No: 151/1E İç Kapı No: 303 Esenler / İstanbul PK: 34220
• Our Registered Electronic Mail Address: oredatayazilim@hs01.kep.tr
• Our E-mail Address Designated for Applications: info@oredata.com

DATA SUBJECT APPLICATION FORM

Document No: KVKK_36 · Publication Date: 2 October 2026

You may submit your requests regarding your rights under Article 11 of Law No. 6698 on the Protection of Personal Data (the “Law”) to Oredata Yazılım Anonim Şirketi (“Oredata” or the “Company”) by means of this form, pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller. Filling in the form completely is important so that your request can be concluded as soon as possible.

You may submit the form, bearing a wet signature, in person, by post or through a notary public to the address Çiftehavuzlar Mah. Eski Londra Asfaltı Cad. Kuluçka Mrk. C1 Blok No: 151/1E İç Kapı No: 303 Esenler / İstanbul PK: 34220; via your registered electronic mail (KEP) address to oredatayazilim@hs01.kep.tr; or, signed with a secure electronic signature or mobile signature or using your e-mail address registered in our Company’s system, to info@oredata.com.

1. INFORMATION ON THE APPLICANT

2. YOUR RELATIONSHIP WITH OUR COMPANY

Please mark the relationship between you and our Company:

□ Employee

□ Former employee — Period of employment: ………………………………..

□ Employee candidate / intern

□ Employee’s relative (spouse / child / emergency contact person)

□ Customer or customer representative / employee

□ Potential customer

□ Representative / employee of a supplier, business partner or consultant

□ Event participant

□ Website visitor

□ Other: …………………………………………………………….

Unit or person within our Company with whom you are in contact (if known): ……………………………………….

3. YOUR REQUEST

Please mark your request(s) under Article 11 of the Law:

Your explanations regarding your request (making your request as specific as possible and stating which data and which process it relates to will enable the request to be concluded more quickly):

…………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………

…………………………………………………………………………………………………………………

Information and documents supporting your request (please attach, if any): ……………………………………………………..

4. METHOD OF NOTIFYING YOU OF THE RESPONSE

□ I would like it to be sent to my address.

□ I would like it to be sent to my e-mail address.

□ I would like to collect it by hand. (If collected by proxy, a notarised power of attorney or a document of authority must be presented.)

5. DECLARATION

I hereby accept, declare and undertake that I have filled in this application form in order to exercise my rights under Article 11 of Law No. 6698; that the information I have stated in the form is accurate and up to date; that Oredata may request additional information and documents to verify my identity in order to conclude my application; and that liability arising from an unlawful, untrue or unauthorised application rests with me.

Applicant Name-Surname : ______________

Application Date : __/__/20__

Signature : ______________