Corporate

Personal Data Protection Law

SÜREKO PERSONAL DATA PROTECTION POLICY & NOTICE PROCEDURE
This policy aims to inform about Süreko Waste Management Transport Logistics Electricity Generation Inc.’s practices regarding personal data for which it is responsible—including plants and factories located in other provinces. It applies to all personal data obtained and processed as detailed below. Süreko may update the content and scope of this notice as needed.

METHOD AND LEGAL GROUNDS FOR COLLECTING PERSONAL DATA
Due to its commercial activities in cement and ready‑mix concrete production and sales, and in waste disposal and management, Süreko may need personal data of individuals with whom it engages. Examples of such data subjects include:

The most frequently needed personal data among the above, required for Süreko’s operations, include:

These data are usually provided directly and voluntarily by the data subjects to Süreko via printed documents such as evaluation, information and registration forms; order and payment instruction forms; annexes to contracts (e.g., tax certificate, signature circulars, ID copies) using non‑automated means, or by automated or partially automated means such as email and web‑based portals used by Süreko—always lawfully, for clear, specific, and legitimate purposes, to the extent permitted by applicable law, and with explicit consent where necessary.

Personal data may also be obtained when explicitly prescribed by law, when directly necessary for the establishment or performance of a contract, for Süreko to fulfill its legal obligations (e.g., notifications, disclosures, record‑keeping) or when necessary to establish, exercise, or protect a right.

Süreko may obtain personal data to the extent necessary for its legitimate interests, while taking care not to harm fundamental rights and freedoms. Publicly disclosed personal data may be processed by Süreko.

Personal data may also be obtained and processed to the extent necessary to protect the life or physical integrity of a person who is unable to give consent due to actual impossibility or whose consent is not legally valid.

PURPOSES OF PROCESSING PERSONAL DATA
Süreko may store, view, analyze, and use the above personal data in its systems of record for legitimate commercial and business purposes and in other cases permitted by law, to the extent necessary. Within these legal grounds, processing may occur for the following purposes:

THIRD PARTIES TO WHOM PERSONAL DATA MAY BE TRANSFERRED
Within the above legal grounds and purposes, and always limited, proportionate, and relevant—and, where required, with explicit consent—personal data may be shared on a “need‑to‑know” basis with:

1) Süreko’s customers
2) Suppliers and consultants from whom Süreko obtains external services as part of its commercial activities
3) Süreko’s dealers and business partners
4) Süreko company in Türkiye and abroad, its affiliates and subsidiaries (see our group structure at www.sureko.com)
5) Legally authorized institutions and organizations

For purposes described in this policy and notice, Süreko may use certain software, programs, and databases (e.g., Microsoft Office 365, SAP) that operate on servers located outside Türkiye, for activities such as centralizing, reviewing, and securing data. For details on current server locations, you may contact Süreko as described below. Süreko takes great care to ensure that third parties to whom data are transferred act in compliance with personal data protection laws and take necessary security measures.

When entrusting Süreko with personal data of third parties (not your own) within the scope of the above commercial activities, please share only what is necessary, limit sharing to those who need to know, inform the relevant individuals, obtain explicit consent where required, and comply with applicable laws.

YOUR RIGHTS REGARDING YOUR PERSONAL DATA
Under Article 11 of Law No. 6698 on the Protection of Personal Data, you may:

To exercise your rights, submit your requests or obtain further information about this Notice, you may contact us in writing at: Egemenlik Mahallesi Eski Kemalpaşa Caddesi No: 4B Işıkkent Bornova İzmir, or via registered email (KEP), secure electronic signature, or mobile signature to sureko@hs01.kep.tr. To be processed, your application must include:

(a) Name, surname, and signature if the application is in writing
(b) Turkish ID number (for citizens), or nationality and passport number/ID number (for non‑citizens)
(c) Residential or workplace address for notifications
(d) Email address, telephone, and fax number for notifications, if any
(e) The subject of the request

Please attach all relevant information and documents so your request can be properly reviewed. We will respond as soon as reasonably possible and in any event within 30 days from receipt. If fulfilling your request requires additional cost, a fee may be charged as permitted by law.