Personal Data Protection and Processing Policy

PERSONAL DATA PROTECTION AND PROCESSING POLICY

Document No: KVKK_11 · Publication Date: 2 October 2026

1. INTRODUCTION

As Oredata Yazılım Anonim Şirketi (“Oredata” or the “Company”), we regard the protection of personal data as an integral part of our activities and as a fundamental element of our trustworthiness in the eyes of our customers, employees and business partners.

This Personal Data Protection and Processing Policy (the “Policy”) is the umbrella document that sets out the fundamental principles and rules to be observed in the personal data processing activities carried out by the Company within the scope of Law No. 6698 on the Protection of Personal Data (the “Law”) and the relevant secondary legislation. All other policies, procedures, forms and texts of the Company relating to the protection of personal data shall be interpreted and applied together with this Policy.

1.1. Purpose

The purpose of the Policy is to ensure that the Company’s personal data processing activities are carried out in compliance with the Law and the relevant legislation, to inform data subjects about the Company’s approach in this field, and to guide the Company’s employees in practice.

1.2. Scope

The Policy covers all activities relating to the processing of personal data belonging to the Company’s employees, former employees, employee candidates and the persons they have named as references, interns, employees’ relatives, customers and customers’ authorised representatives and employees, potential customers, suppliers, business partners, consultants, event participants, visitors, the Company’s shareholders and authorised representatives, and website users.

With respect to the activities the Company carries out on behalf of its customers in its capacity as a data processor, the Policy applies to the Company’s obligations under Article 12 of the Law, without prejudice to the contract concluded with the customer and the customer’s instructions.

1.3. Relationship of the Policy with other documents

The Policy forms an integral whole with the following documents of the Company:

• Personal Data Retention and Destruction Policy (KVKK_12) and the annexed destruction procedures,
• Data Breach Management and Response Plan Policy (KVKK_16),
• Policy on the Protection of Special Categories of Personal Data (KVKK_18),
• Policy on the Monitoring of Employee Devices, Systems and Communications (KVKK_19),
• Procedure for the Management of Data Subject Applications (KVKK_20),
• Access Authorisation and Authorisation Matrix Procedure (KVKK_21),
• Guide to the Use of Standard Contracts for Cross-Border Transfers (KVKK_38),
• Procedure for Personal Data Processing in Customer Projects in the Capacity of Data Processor (KVKK_22),
• The Company’s privacy notices, explicit consent statements and personal data transfer/data processor agreements.

2. DEFINITIONS

3. GENERAL PRINCIPLES OBSERVED IN THE PROCESSING OF PERSONAL DATA

The Company processes personal data in accordance with the following general principles set out in Article 4 of the Law. These principles apply in all cases, irrespective of whether a processing activity is based on one of the conditions in Article 5 or Article 6 of the Law.

3.1. Lawfulness and fairness

Personal data are processed with due regard to the reasonable expectations of data subjects and in accordance with the principle of transparency. No covert processing is carried out in a manner that the data subject could not foresee or would not expect.

3.2. Accuracy and, where necessary, being kept up to date

The Company takes reasonable measures to ensure the accuracy and currency of the personal data it processes and provides data subjects with the opportunity to request that their data be updated.

Documents containing personal data are sent to the contact address notified to the Company by the data subject; the fact that the address belongs to the data subject is verified by methods such as the person activating their account or confirmation through a known channel.

3.3. Processing for specified, explicit and legitimate purposes

Personal data are processed for purposes that are determined before the processing activity, clearly set out and legitimate. Privacy notices do not contain expressions such as “for various purposes” or similar vague wording; each purpose is stated separately.

3.4. Being relevant, limited and proportionate to the purposes for which they are processed

Personal data that are not necessary for achieving the purpose are not collected. In accordance with this principle, the Company:

• Does not retain criminal record certificates upon recruitment; the certificate is requested only where required by law, is examined, and is returned or destroyed.
• Does not keep the content of employees’ sick leave reports with Human Resources; only the date range and the number of days of the report are processed.
• Where candidate or employee CVs need to be provided to customers, prefers, to the extent possible, the use of CVs in which identity information has been redacted.
• In customer projects, works with the minimum data required by the project and, where possible, adopts the use of masked or anonymised data as the rule.

3.5. Being retained for the period stipulated in the relevant legislation or required for the purpose for which they are processed

Retention periods are determined on an activity basis in the Personal Data Retention and Destruction Policy. At the end of the period, the data are destroyed ex officio or upon request. No indefinite retention is carried out.

4. CONDITIONS FOR THE PROCESSING OF PERSONAL DATA

4.1. Personal data of a general nature

Personal data may not be processed without the explicit consent of the data subject. However, processing may be carried out without seeking explicit consent where one of the conditions listed in the second paragraph of Article 5 of the Law exists:

• It is expressly provided for by law,
• It is necessary for the protection of the life or physical integrity of the person, or of another person, who is unable to express their consent due to actual impossibility or whose consent is not legally valid,
• Processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract,
• It is necessary for the data controller to fulfil its legal obligation,
• The data have been made public by the data subject themselves,
• Data processing is necessary for the establishment, exercise or protection of a right,
• Data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

The Company, as a rule, primarily bases a processing activity on one of the conditions in the second paragraph of Article 5 of the Law. Explicit consent is a legal ground relied upon only where no other processing condition exists. This approach aims to prevent processing from becoming dependent on the withdrawal of consent.

4.2. Special categories of personal data

Special categories of personal data may be processed only where one of the conditions listed in the third paragraph of Article 6 of the Law exists. Pursuant to the amendment introduced by Law No. 7499, which entered into force on 1 June 2024, these conditions are as follows:

• The data subject has given explicit consent,
• It is expressly provided for by law,
• It is necessary for the protection of the life or physical integrity of the person, or of another person, who is unable to express their consent due to actual impossibility or whose consent is not legally valid,
• It relates to personal data made public by the data subject and is in line with the data subject’s will to make them public,
• It is necessary for the establishment, exercise or protection of a right,
• It is necessary, by persons under a duty of confidentiality or by authorised institutions and organisations, for the purposes of protecting public health, preventive medicine, medical diagnosis, the conduct of treatment and care services, and the planning, management and financing of healthcare services,
• It is necessary for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance,
• It concerns current or former members and affiliates of foundations, associations and other non-profit organisations or bodies established for political, philosophical, religious or trade union purposes, or persons in regular contact with such organisations and bodies, provided that it is in compliance with the legislation to which they are subject and their purposes, is limited to their field of activity and is not disclosed to third parties.

In the processing of special categories of personal data, adequate measures are additionally taken in accordance with the Board’s decision dated 31.01.2018 and numbered 2018/10. Detailed rules are set out in the Policy on the Protection of Special Categories of Personal Data.

4.3. Principles for obtaining explicit consent

• Explicit consent is obtained after the obligation to inform has been fulfilled and by means of a text separate from the privacy notice. Pursuant to the Board’s Principle Decision dated 18.02.2026 and numbered 2026/347, presenting the explicit consent text and the privacy notice intertwined with each other is unlawful.
• It is ensured that a separate choice can be made for each processing purpose; collective consent for more than one purpose is not obtained by means of a single tick box.
• Consent boxes are not presented pre-ticked.
• Since the burden of proving that explicit consent has been obtained lies with the Company, consent records are kept in such a way that the date, the data subject and the version of the text presented at the time of approval can be identified.
• The provision of a service is not made conditional upon the granting of explicit consent.
• In cases where there is an imbalance of power between the parties, such as an employer–employee relationship, reliance on explicit consent is avoided as far as possible; if another processing condition exists, that condition is relied upon.

5. OBLIGATION TO INFORM

The Company informs data subjects at the time personal data are obtained, in accordance with Article 10 of the Law and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform.

Privacy notices include, at a minimum, the following matters: the identity of the data controller and of its representative, if any; the purpose for which the personal data will be processed; to whom and for what purpose the processed personal data may be transferred; the method of and legal ground for collecting personal data; and the rights listed in Article 11 of the Law.

Principles observed with respect to the obligation to inform:

• Informing is carried out for every processing activity, irrespective of whether explicit consent is relied upon.
• Where the processing purpose changes, data subjects are informed again before the new activity.
• Since the burden of proving that the obligation to inform has been fulfilled lies with the Company, the fact that the notice has been presented to the data subject is recorded.
• Privacy notices are kept consistent with the information the Company has notified to the Data Controllers’ Registry (VERBİS).
• The language of the notices is kept comprehensible, clear and plain.

The current versions of the Company’s privacy notices in force are published on the Company’s website or in the channel through which the relevant process is conducted.

6. TRANSFER OF PERSONAL DATA

6.1. Domestic transfer

Pursuant to Article 8 of the Law, personal data may be transferred to third parties within the country where one of the conditions provided for in the second paragraph of Article 5 of the Law or, provided that adequate measures are taken, in the third paragraph of Article 6 of the Law exists, or with the explicit consent of the data subject. Since a transfer is in itself a processing activity, a separate legal ground is determined for each transfer.

The Company concludes a written personal data transfer agreement or data processor agreement with all parties to which it transfers personal data — service providers, suppliers, customers, business partners, consultants and the like. If the existing commercial contract contains provisions covering these matters, no separate agreement needs to be concluded; this assessment is made by the KVKK Compliance Officer.

6.2. Cross-border transfer

Cross-border transfers are carried out in accordance with Article 9 of the Law, as amended by Law No. 7499, and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad, observing the following order:

• The existence of one of the conditions in Articles 5 and 6 of the Law and of an adequacy decision regarding the country, sector or international organisation to which the transfer is to be made,
• In the absence of an adequacy decision, the existence of one of the conditions in Articles 5 and 6 of the Law and the provision of one of the appropriate safeguards (a written undertaking and Board authorisation, binding corporate rules, a standard contract, an agreement not qualifying as an international agreement and Board authorisation), provided that the data subject has the opportunity to exercise their rights and to seek effective legal remedies in the country to which the transfer is to be made,
• Where none of the above can be satisfied, the existence of the cases in the sixth paragraph of Article 9 of the Law, provided that the transfer is only incidental.

Owing to the extensive use of cloud-based software and infrastructure services, the Company’s activities involve a significant amount of cross-border data transfer. Each recipient to which data are transferred, the mechanism used and the date of the notification made to the Authority are tracked in the Cross-Border Transfer Register within the KVKK Registers. The implementation principles are set out in the Guide to the Use of Standard Contracts for Cross-Border Transfers.

7. DATA SECURITY MEASURES

Pursuant to Article 12 of the Law, the Company takes all necessary technical and administrative measures to ensure an appropriate level of security for the purposes of preventing the unlawful processing of personal data and unlawful access to personal data and ensuring the safeguarding of personal data.

7.1. Technical measures

• The information security management system has been established and certified in accordance with the TS EN ISO/IEC 27001 standard.
• Access rights are defined on a role basis; the principle of least privilege required by the role is applied, and access rights are reviewed periodically.
• A strong password policy and multi-factor authentication are applied to user accounts.
• EDR/antivirus and data leakage prevention solutions are used on endpoints.
• Mobile devices are managed through centralised device management.
• Network traffic is protected by a firewall; logs are kept and reviewed.
• Data are backed up regularly and backups are stored in a secure environment.
• Special categories of personal data are protected in separate, access-restricted environments and by appropriate cryptographic methods.
• Vulnerability scans and patch management are carried out on systems.

7.2. Administrative measures

• A personal data processing inventory has been prepared and is kept up to date.
• Employees receive personal data protection training upon recruitment and at regular intervals.
• Confidentiality undertakings and information security declarations are signed with employees; a Personal Data Protection Undertaking is obtained from those granted access to personal data beyond the standard authorisation set, and a Special Categories of Personal Data Access Undertaking is additionally obtained from those with access to special categories of personal data.
• Written agreements are concluded with the parties to which data are transferred.
• Compliance with policies and procedures is reviewed as necessary.
• In the event of changes in authorisation and departures from employment, access rights are revoked without delay.

7.3. Relations with data processors

Where personal data are processed by another natural or legal person on behalf of the Company, the Company is jointly responsible with the data processor for taking these measures pursuant to the second paragraph of Article 12 of the Law. For this reason, agreements concluded with data processors regulate, at a minimum: that processing will be carried out only on the Company’s instructions; the confidentiality obligation; that the use of sub-processors is subject to the Company’s permission; security measures; notification without delay in the event of a data breach; the right of audit; and the obligation to return or destroy the data at the end of the agreement.

8. ACTIONS TO BE TAKEN IN THE EVENT OF A DATA BREACH

Where processed personal data are obtained by others through unlawful means, the Company notifies the data subject concerned and the Board of this situation as soon as possible. Notification to the Board is made within the period stipulated in the Board’s decision dated 24.01.2019 and numbered 2019/10. The process is regulated in detail in the Data Breach Management and Response Plan Policy.

9. RIGHTS OF THE DATA SUBJECT

Everyone may exercise the rights relating to them listed in Article 11 of the Law by applying to the Company in its capacity as data controller. Applications are concluded within the period stipulated in the Law, in accordance with the Procedure for the Management of Data Subject Applications.

In the cases listed in Article 28 of the Law, the provisions of the Law do not apply or apply only partially. In this context, the cases in which the data subject may not exercise their rights under Article 11 of the Law, except for the right to claim compensation for damage, are assessed specifically for each application.

10. DATA CONTROLLERS’ REGISTRY (VERBİS)

Pursuant to Article 16 of the Law and the Regulation on the Data Controllers’ Registry, the Company registers with the Data Controllers’ Registry and updates its notifications to the extent that it is subject to the registration obligation.

It is ensured that the notifications made to VERBİS are consistent with the personal data processing inventory and the privacy notices. Where there is a change in the information on which the notification is based, the update is made within the period stipulated in the legislation.

11. TRAINING AND AWARENESS

The Company provides its employees with training on the protection of personal data upon recruitment and at regular intervals. The training covers, at a minimum, the following topics: general principles, processing conditions, the distinction between informing and explicit consent, data minimisation, retention and destruction periods, actions to be taken in the event of a data breach, and the routing of data subject applications. Attendance is recorded by means of the KVKK Training Attendance Record.

12. ENTRY INTO FORCE, UPDATING AND PUBLICATION OF THE POLICY

The Policy enters into force by resolution of the Board of Directors. It is reviewed in the event of a change in legislation or a material change in the Company’s processes and is updated where necessary.

The current version of the Policy is published in an environment accessible to the Company’s employees and on the Company’s website. In the event of a conflict between the Policy and the legislation, the provisions of the legislation shall apply.

13. VERSION TRACKING TABLE