6698 PERSONAL DATA PROTECTION LAW DISCLOSURE/INFORMATION FORM

(1) As the employer (hereinafter "Data Controller"), pursuant to Article 10 of the Personal Data Protection Law No. 6698 (hereinafter "KVK"), within the scope of the obligation to provide information regarding the processing of the employee's personal data and the responsibilities of the Data Controller, the following information is provided to obtain the employee's explicit consent:

(1) 1. Identity of the Data Controller and its representative, if any
BPO B-PLAS PLASTIC OMNIUM AUTOMOTIVE PLASTICS AND METAL INDUSTRY INC.

Data Controllers Appointed by the Board of Directors of BPO Inc.:

1-) Alev AKSOY KOVANCI:
Phone: 0224-211 66 20
e-mail: aaksoy@bpo.com.tr

2-) Hasan AYANGÜL
Phone: 0-224-211 66 20
e-mail: hayangul@bpo.com.tr

3-) Ahmet Gökhan MEMİŞ
Phone: 0-224-211 66 20
e-mail: gmemis@bpo.com.tr

(1) 2. Purpose of processing personal data
The employee's personal data will be processed manually and/or non-automatically in the data recording system for the performance of the employer's responsibilities, such as executing accounting procedures (financial transactions), determining and implementing commercial, financial, legal, and social goals, and will be kept for the necessary duration under the condition of proper storage.

(1) 3. Categories of real and legal persons to whom personal data will be transferred and the purpose of transfer

A. Categories of real and legal persons to whom the employee's personal data will be transferred:
- Parent and affiliated companies within the corporate group
- Board members of the company
- Employees with management and/or representation authority in the company's human resources, quality, financial affairs (accounting), general management, marketing, internal procurement, foreign trade, research and development, operations, branches, and IT departments.
- Company subsidiaries
- Partners and third parties (such as former employees, family members, auditors), public institutions and organizations, audit and supervision institutions, real persons, and private legal entities
- Company shareholders.

B. Purpose of transferring the employee's personal data:
The employee agrees to the transfer of their personal data domestically and internationally for the following purposes:
- Legal obligation: Storing employee personal information as required by law.
- Performance of contract: Recording company address details for delivery purposes.
- Impossibility of action: Personal health information or location details of an unconscious person or a missing person.
- Legal responsibility of the data controller: Sharing information in specialized audits, such as in banking, energy, or capital markets.
- Establishment, protection, and use of rights: Storing information of a former employee for the duration of statutory limitation.
- Legitimate interest: Processing data to apply rewards and incentives to enhance employee loyalty. The data may be transferred for purposes such as assignment and relocation procedures, contract transfer, retirement, participation in seminars or training (both domestic and international), and contracts for goods and services.

(1) 4. Method and legal basis for collecting personal data:
A. The employee's personal data is collected through the following methods:
i. Fully automated methods,
ii. Partially automated methods,
iii. Non-automated methods.

B. Legal basis for collecting the employee's personal data
The legal basis for data collection is within the framework of the relevant laws and regulations of the KVK.

(1) 5. Scope of the disclosure obligation
The employee has the right to request the following from the Data Controller:

a) Identity of the Data Controller and its representative, if any,
b) Purpose for which personal data will be processed,
c) To whom and for what purpose personal data may be transferred,
ç) Method and legal basis for collecting personal data,
d) Other rights listed below:
i) To learn whether personal data is being processed,
ii) If personal data is processed, to request information about it,
iii) To learn whether personal data is being used in accordance with its intended purpose,
iv) To know the third parties to whom personal data has been transferred, whether domestically or internationally,
v) To request correction of personal data if it is inaccurate or incomplete,
e) If personal data has been processed in accordance with KVK and other relevant laws but the reasons for processing have ceased to exist, to request deletion or destruction of personal data (KVK Art. 7, 11),
f) To request that corrections and deletions made as per (v) and (e) be notified to third parties to whom the data was transferred,
g) To object to decisions based solely on automatic processing of personal data that result in a negative outcome for the individual,
ğ) To request compensation for damages caused by unlawful processing of personal data.

(2) Application to the Data Controller
The employee may submit requests regarding the rights outlined in section (1)5 in writing to the Data Controller.

The following information and documents must be included in the employee's application:

a) Name, surname, and signature if the application is in writing,
b) For Turkish citizens, the Turkish identity number, for foreigners, nationality, passport number, or any identification number,
c) Address for notification or workplace address,
ç) If applicable, email address, phone, and fax number for notification,
d) Subject of the request.

Information and documents related to the subject of the request must be attached to the application.

(3) The date of receipt of the documents by the Data Controller or its representative is considered the application date for written applications. For other methods of submission, the date the Data Controller receives the application is considered the application date.