Page 4 - POLICY FOR THE PROTECTION AND PROCESSING OF PERSONAL DATA OF NUROL GROUP EMPLOYEES

2.2.4 Company Fulfills a Legal Obligation
Our Company may process the personal data of the data owner if the processing of such data is
required for the fulfillment of its legal obligations.

2.2.5 Personal Data of Data Owner Having Beed Made Public
In the event of the data owner having publicly shared their personal data, the relevant personal
data can be processed to the extent that they have been made public.

2.2.6 Processing of Data is Required to Ensure or Protect a Certain Right
The personal data of the data owner may also be processed should it be required to establish,
exercise or protect a certain right.

2.2.7 Mandatory Processing of Data for the Legitimate Interests of Our Company
On the condition that the fundamental rights and freedoms of the data owner are not infringed,
our Company may process the personal data of the data owner should such data processing being
required to serve the legitimate interests of our Company.

2.3 Processing of Private Personal Data

The Law attaches particular importance to sensitive personal data, since the illegal processing of such
data can carry the risk of causing unjust harm or discrimination to persons. Such “private” personal
data includes information on race, ethnic origin, political views, philosophical beliefs, religion, sect and
other beliefs, clothing and appearance, membership of associations, foundations or labor unions,
health, sexual life, criminal history and security measures, as well as biometric and genetic data.

In line with the principles of this Policy, and taking any necessary administrative and technical
measures, including those established by the Personal Data Protection Board (“Board”), private
personal data can be processed by our Company if the following conditions are met:

(i) It is explicitly required by law; in other words, in cases where the law contains an explicit
provision regarding the processing of personal data, private personal data other than that
related to the health and sexual life, may be processed without having to obtain the explicit
consent of the data owner. In any other cases, the explicit consent of the data owner shall be
obtained.

(ii) In matters related to the protection of public health, preventive medicine, medical diagnosis,
the carrying out of treatment and care services, and the planning and management of health
services and health funding, private personal data relating to health and sexual life may be
processed without seeking the explicit consent of authorized institutions and organizations, and
by persons under obligations to keep such information confidential. In all other situations, the
explicit consent of the data owner shall be obtained.

2.4 Categories of Processed Personal Data and Purposes of Processing

The categories of personal data that are processed by our Company in accordance with the Law and
the provisions of other relevant legislation, and within the framework of the purposes and conditions
stipulated in this Policy, as well as detailed information concerning these categories, can be found in
Annex-2 (“Personal Data Categories”) to the Policy.

3