1. Identity of the Data Controller

As AYPAR Spare Parts and Automotive Industry Trade Co. Ltd. (“AYPAR AUTOMOTIVE” or “Our Company”), acting in the capacity of Data Controller, we exercise the utmost care and diligence in protecting your personal data and ensuring the confidentiality and security of your information.

Our company’s registered address is: Sanayi Mh. 60079 Nolu Cad. No.1 Şehitkamil / Gaziantep, Türkiye. We are registered with the Gaziantep Trade Registry Office under registration number 21190. Our company’s website is www.ayparotomotiv.com.tr, and our MERSIS number is 0106013050700014.

Within this scope, as Aypar Spare Parts and Automotive, we attach great importance to the secure processing and preservation of all kinds of personal data of individuals who benefit from or contact our Company regarding our products and services, including our suppliers, dealers, and employees of our dealers, in full compliance with applicable laws and regulations.

This privacy notice has been prepared in accordance with Article 10 of the Law on the Protection of Personal Data No. 6698 (“Law” or “KVKK”), and aims to inform you about the procedures and principles regarding the processing of your personal data, as well as the rights and freedoms you hold under the Law.

Should you wish to receive further details regarding any of the topics covered herein, you may contact us through the communication channels specified below.

2. Purposes of Processing Personal Data

The personal data processed by AYPAR Spare Parts and Automotive and the purposes for which they are processed may vary depending on your relationship with our Company, the products and services you use, or the commercial activities carried out. For each specific processing purpose, detailed information is provided before your data is collected, in line with the requirements of the Law.

If you are an employee/partner/representative/contact person of our corporate or individual trader customers purchasing products or services from AYPAR Automotive, the personal data that you may directly or indirectly share with us include:

Identity information Contact information Financial information Transaction security data Physical space security data Legal transaction data Risk management data Special categories of personal data such as religious affiliation or blood type (only if provided through copies of your ID or driver’s license). Your personal data is processed within the framework of our legal obligations arising from KVKK and other applicable legislation, exclusively for the purposes listed below: Conducting information security processes Ensuring compliance with legislation Carrying out financial and accounting operations Following and conducting legal affairs Executing and auditing business activities Conducting communication activities Conducting internal audits/investigations/intelligence activities Carrying out procurement processes Providing after-sales services for goods/services Conducting sales processes for goods/services Managing production and operational processes Conducting customer satisfaction activities Managing performance evaluation processes Managing risk processes Executing contract processes Tracking requests and complaints Ensuring the security of movable property and resources Conducting product and service marketing processes

Ensuring the security of data controller operations Providing information to authorized persons, institutions, and organizations Creating visitor records and ensuring physical security if you visit our Company premises Authorizing access to our network and internet infrastructure, applying information security policies, and fulfilling our legal obligations (especially under Law No. 5651). Additionally, if you wish to become one of our authorized dealers, your personal data will be processed for: Performing necessary evaluations and research for the dealership agreement Establishing and executing the dealership agreement Setting up required systems and applications, creating user accounts, and managing system permissions Managing applications and payment processes under the dealership agreement Carrying out necessary procedures for outsourcing, procurement, contract execution, and payment processes Supporting the execution of business processes to fulfill our Company’s commercial activities. Your personal data may be stored both digitally and physically in our IT systems and physical archives.

3. Transfer of Personal Data

Your personal data may be transferred, in accordance with applicable laws including KVKK, and by taking all necessary technical and administrative measures, to the following categories of recipients, limited to the purposes outlined above:

a) Employees and Job Applicants

• Payroll service providers for salary, leave, and similar employee processes
• Banks for salary payments and other financial benefits
• Insurance companies and business partners for employee benefits
• Vehicle leasing companies for company-provided vehicles
• Building management and authorized security units for workplace access and security
• Occupational health physicians for workplace health services
• Authorized institutions/portals/servers to ensure compliance and commercial operations
• Training providers, conference/seminar organizers for professional development
• Dealers and business partners for the fulfillment of duties and responsibilities
• Travel and accommodation providers for company events/organizations
• Official authorities, auditors, courts, or prosecutors when legally required.

b) Dealers and Suppliers

• Banks for payment and collection processes
• Ministry of Finance, Ministry of Customs and Trade, and other legally authorized bodies
• Official authorities and auditors
• Courts and prosecutors in case of disputes or legal investigations
• IT and website infrastructure providers
• Postal/cargo companies, PTT, and Notaries for official notifications
• Other authorized institutions when legally required.

c) Visitors and Other Individuals

• Building management and security units for access control
• IT service providers responsible for the website or applications
• Official public institutions when legally required
• Auditors and regulatory authorities
• Courts, prosecutors, and other competent authorities in case of disputes.
• Our website’s cookie policy is available at: https://ayparotomotiv.com.tr/cerez-politikasi

4. Methods and Legal Grounds for Collecting Personal Data

Your personal data is collected, for the purposes specified above, under the legal grounds stated in Articles 5 and 6 of KVKK, including:

a) Explicitly stipulated in laws
b) Necessary for the establishment or performance of a contract
c) Necessary for the fulfillment of the Data Controller’s legal obligations
d) Necessary for the establishment, exercise, or protection of a right

Data may be collected through various automatic or non-automatic methods such as:

• Physical visits to our Company
• Statements and documents you provide
• Our business partners and dealers
• Our website and cookies
• Applications, requests, and visits
• Communication via e-mail, phone, fax, or social media
• Notifications from administrative and judicial authorities
• Video, written, or electronic records from building management at our office premises
• Other communication channels as required.

5. Your Rights Regarding the Protection of Personal Data

Pursuant to Article 11 of KVKK, you have the following rights:

a) To learn whether your personal data is processed
b) To request information if it has been processed
c) To learn the purpose of processing and whether it is used appropriately
d) To learn the third parties to whom data has been transferred domestically or abroad
e) To request correction of incomplete or inaccurate data and to have this communicated to third parties
f) To request deletion or destruction of data under Article 7 and to have this communicated to third parties
g) To object to outcomes against you resulting from automated data analysis
h) To request compensation if you suffer damages due to unlawful data processing

You may submit your requests under these rights in writing to aypar@ayparotomotiv.com.tr through one of the following channels:

• By delivering the application form and identity documents in person to our address: Sanayi Mh. 60079 Nolu Cad. No.1 Şehitkamil / Gaziantep
• By sending the application form via notary public
• By sending it to our Registered Electronic Mail (KEP) address: ayparotomotiv@hs02.kep.tr
• By sending a signed application form via secure electronic signature or mobile signature to aypar@ayparotomotiv.com.tr
• By other methods specified under the Law and applicable regulations, ensuring identity verification.

Our Company will respond to your requests free of charge, as soon as possible and at the latest within 30 days, in accordance with Article 13 of KVKK. If the process incurs an additional cost, fees may be charged according to the tariff set by the Personal Data Protection Authority (KVKK Authority).