Page 13 - POLICY FOR THE PROTECTION AND PROCESSING OF PERSONAL DATA OF NUROL GROUP EMPLOYEES

Planning and/or execution of the feasibility studies
and/or risk assessment activities in the selection of
potential business
partners/suppliers/subcontractors

ANNEX 4 - THIRD PARTIES TO WHICH PERSONAL DATA IS TRANSFERRED, AND THE PURPOSES OF
SUCH TRANSFERS

Recipients of Personal Data Description Purpose of Data Transfer
Suppliers Parties that provide services to our Personal data is transferred
Company within the scope of our to suppliers only to the extent
Company’s business activities, and in necessary to ensure that the
line with our Company’s instructions supplier can provide the
and purposes as regards to data services outsourced by our
processing. Company as required for the
execution of our Company’s
commercial activities.
Group Companies These are the companies directly or Personal data is transferred
indirectly affiliated with Nurol Holding only to the extent necessary
Anonim Şirketi. A list of the group for the planning and
companies affiliated with Nurol Holding implementation of strategies
Anonim Şirketi can be found at concerning our Company’s
www.nurol.com.tr. business activities, for the
conducting of audits and for
the evaluation of prospective
employees.
Shareholders Real and legal persons who, in In accordance with the
accordance with the provisions of the provisions of the relevant
relevant legislation, are authorized in legislation, personal data is
the design of strategies and audit transferred to shareholders
activities pertaining to the business only to the extent necessary
activities of our Company. for the design of strategies
and audit activities pertaining
to our Company’s business
activities.
Legally Authorized Public Public institutions and organizations Personal data is transferred
Institutions and Organizations such as courts, tax offices, etc., that are to these institutions and
authorized to request information and organizations only to the
documents from our Company in extent that they are
accordance with the provisions of the requested, within the limits of
relevant legislation. their legal authority, by the
relevant public institutions
and organizations.
Legally Authorized Private Institutions or organizations that have Personal data is transferred
Institutions been established in accordance with to legally authorized private
the provisions of the relevant institutions only to the extent

12