KVKK Information Notice

Data Controller: GRS Roller Sanayi ve Ticaret A.Ş. Address: OSB Mh. Platin Sk. No:6, 16140 Işıktepe OSB / Nilüfer, Bursa / Türkiye Phone: +90 224 324 40 72 E-mail: satis@grsroller.com Contact: satis@grsroller.com

We may process the following categories of personal data in our capacity as data controller:

• Identity: first name, last name, job title
• Contact: e-mail, phone, company, address, country/city
• Customer transaction: quotation requests, order details, correspondence
• Marketing: newsletter subscriptions, marketing consents
• Transaction security: IP address, log records, cookie data
• HR (for job applicants): CV, education, experience

Your personal data is processed for the following purposes:

• Conducting sales and after-sales support of goods/services
• Executing customer relationship management processes
• Managing contract processes
• Monitoring finance and accounting operations
• Following up and executing legal matters
• Conducting storage and archiving activities
• Managing information security processes
• Providing information to authorised persons, institutions and organisations
• Sending commercial electronic messages within the scope of your explicit consent
• Managing candidate application processes

Your personal data is processed based on the following legal grounds set out in Articles 5 and 6 of KVKK:

• Processing is expressly permitted by law (5/2-a)
• Processing is directly related to the establishment or performance of a contract (5/2-c)
• Processing is necessary to fulfil the data controller's legal obligations (5/2-ç)
• Processing is necessary for the establishment, exercise or protection of a right (5/2-e)
• Processing is necessary for the legitimate interests of the data controller, provided it does not harm the fundamental rights and freedoms of the data subject (5/2-f)
• Where none of the above apply, your explicit consent (5/1)

Your personal data is collected through automated or partly automated means, including contact and quotation forms on our website, e-mail correspondence, phone calls, physical petitions, fairs and industry events, social media channels, cookies and analytics tools.

Your personal data may be transferred within the scope of Articles 8 and 9 of KVKK and limited to the purposes listed above, to:

• Our hosting, cloud and IT service providers
• Logistics, customs, freight and insurance providers
• Independent auditors, tax advisors and lawyers
• Authorised public institutions (upon request)
• Our cloud and analytics providers located abroad — based on appropriate safeguards and/or your explicit consent

As a data subject, under Article 11 of KVKK you have the right to:

• Learn whether your personal data is processed
• Request information if data has been processed
• Learn the purpose of processing and whether data is used in line with that purpose
• Know the third parties within Türkiye or abroad to whom data has been transferred
• Request the correction of incomplete or incorrect data
• Request deletion or destruction of your data
• Request that correction, deletion or destruction be notified to third parties
• Object to any adverse outcome based solely on automated analysis of your data
• Demand compensation for damages due to unlawful processing

You can submit your requests regarding the above rights in accordance with the "Communiqué on the Procedures and Principles of Application to the Data Controller" through:

• A wet-signed petition delivered in person or via notary to OSB Mh. Platin Sk. No:6, 16140 Işıktepe OSB / Nilüfer, Bursa / Türkiye
• An e-mail sent to satis@grsroller.com from an e-mail address previously notified to us and registered in our systems
• A message from your registered e-mail (KEP) address signed with a secure electronic signature

Your request will be answered, free of charge, within 30 (thirty) days depending on its nature. If the transaction requires additional costs, the fee set by the Board's tariff may be charged.