Page 6 - POLICY FOR THE PROTECTION AND PROCESSING OF PERSONAL DATA OF NUROL GROUP EMPLOYEES

 When collecting data from a person incapable of expressing explicit consent, or whose consent
is legally void, to protect the life or physical integrity of the person or another person.

If the personal data is to be transferred abroad, it should, in addition to the conditions specified above,
be sent by our Company only to foreign countries that have been declared by the Board as having
adequate protection (“Foreign Country with Adequate Data Protection”) or, if such adequate
protection is lacking, to foreign countries for which data controllers in Turkey and in the relevant
foreign countries declare/assure in writing that there is adequate protection, and for which the Board
has also issued approval (“Foreign Countries where a Data Controller Guaranteeing Adequate Data
Protection is Available”).

3.2 Transfer of Private Personal Data

In line with the principles of this Policy, and taking any necessary administrative and technical
measures, including the methods set by the Board, private personal data can be transferred by our
Company should the below conditions be satisfied:

(i) When explicitly required by law; in other words, when the law contains an explicit provision
regarding the transfer of personal data, private personal data other than that related to the
health and sexual life may be transferred without having to obtain the explicit consent of the data
owner. In all other situations, the explicit consent of the data owner shall be obtained.

(ii) For the purposes of protecting public health, preventive medicine, medical diagnosis, the
conducting of treatment and care services, and the planning and management of health services
and health funding, private personal data relating to health and sexual life can be transferred
without seeking the explicit consent of authorized institutions and organizations, and by persons
under obligation to keep such information confidential. In all other situations, the explicit consent
of the data owner shall be obtained.

If the private personal data is to be transferred abroad, it should be sent only to Foreign Countries with
Adequate Data Protection or to Foreign Countries where a Data Controller Guaranteeing Adequate Data
Protection is Available, in addition to the conditions specified above.

4. SECTION 4 – INFORMING THE OWNER OF THE PERSONAL DATA

In accordance with Article 10 of the Law and the secondary legislation, our Company will inform the
owner of the personal data of the purposes for which their personal data is being processed by the
data controller; with which parties and for what purposes the data is being shared; by which methods
the data was collected; the legal reasons for its collection; and the rights that the data owners have in
relation to the processing of their personal data.

5. SECTION 5 – STORAGE AND DESTRUCTION OF PERSONAL DATA

Our Company stores personal data for as long as is required for the purpose for which it has been
processed, and in accordance with the minimum time periods defined in the legislation. Accordingly,
our Company first determines whether a specific time period is specified in legislation for the storage
of personal data, and acts accordingly if such a time period is defined. If no legally defined time period
is available, the personal data is kept for as long as it is necessary, in accordance with the purpose for
which it has been processed. Personal data will be destroyed in accordance with pre-defined methods
(deletion and/or disposal and/or anonymization) at the end of its storage period, or at periodic times
for designated data destruction, or upon the application/request of the data owner.
5