KVKK Privacy Notice

Within the scope of the Law No. 6698 on the Protection of Personal Data ("KVKK" — Turkish Personal Data Protection Law), your personal data is processed by Norm Bitkisel Ürünler Paz. San. ve Tic. Ltd. Şti. ("Company") as the data controller, to the extent described below. Address: Mecidiye Mah. Selçuk Cad. No:85, 34930 Sultanbeyli/İstanbul Phone: +90 (216) 399 41 34 E-mail: info@normbitkisel.com

The following categories of personal data may be processed by our Company: • Identity information: First name, last name, title • Contact information: Phone number, e-mail address, postal address • Customer transaction information: Order details, payment information, delivery information • Digital footprint data: IP address, cookie data, browser information, pages visited, session durations • Legal transaction information: Contract details, invoice information

Your personal data is processed for the following purposes: • Providing and improving our products and services • Managing customer relations and conducting communication activities • Managing order processes • Fulfilling legal obligations • Carrying out statistical analyses • Conducting information security processes • Conducting marketing and campaign activities (subject to your explicit consent) • Ensuring that Company operations are conducted in compliance with applicable legislation

Your personal data is processed on the following legal grounds specified in Articles 5 and 6 of KVKK (Turkish Personal Data Protection Law): • Explicit provision in the law • Direct relation to the establishment or performance of a contract • Necessity for fulfilling our Company's legal obligation • Necessity for our legitimate interests, provided that it does not harm the fundamental rights and freedoms of the data subject • Existence of your explicit consent

Your personal data may be transferred, for the purposes stated above, to: • Our business partners and suppliers • Cargo and logistics companies • Our legal advisors • Authorised public institutions and organisations • Payment service providers Such transfers are made within the framework of the personal data processing conditions and purposes set out in Articles 8 and 9 of KVKK (Turkish Personal Data Protection Law).

Your personal data is collected through: • Forms completed via our website • E-mail, phone, and other communication channels • Cookies and similar technologies • Social media platforms • In-person meetings by both automated and non-automated means.

Pursuant to Article 11 of KVKK (Turkish Personal Data Protection Law), you have the following rights: • To learn whether your personal data is being processed • To request information if your personal data has been processed • To learn the purpose of processing your personal data and whether it is being used in accordance with that purpose • To know the third parties to whom your personal data has been transferred, domestically or abroad • To request correction of incomplete or inaccurate personal data • To request deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of KVKK • To request notification of the correction, deletion, or destruction of personal data to third parties to whom it has been transferred • To object to any outcome arising against you as a result of analysis performed exclusively through automated systems • To claim compensation for damages in case your personal data is processed unlawfully You may submit your applications in writing to info@normbitkisel.com.

Your personal data is retained for as long as required by the processing purpose and for the statutory limitation periods prescribed by applicable legislation. Upon expiry of the retention period, your personal data will be deleted, destroyed, or anonymised.