Data Subject Application Form

TFI TAB GIDA YATIRIMLARI ANONİM ŞİRKETİ DATA SUBJECT APPLICATION PROCESS PERSONAL DATA PROCESSING ENLIGHTENMENT NOTE

Pursuant to the Law on Personal Data Protection numbered 6698 (the "Law"), your personal data may be processed by TFI TAB Gıda Yatırımları A.Ş. in its capacity as data controller within the scope explained below.

For What Purpose Personal Data May be Processed
Your personal data will be processed for the purposes described below ("Purposes") and within the scope of personal data processing conditions and purposes set forth in Article 5 of the Law.

• evaluating and finalising, in compliance with the legislation, the applications you file with the Company within the scope of exercising of your rights as set out in Article 11 of the Law in relation to your personal data that are processed by our Company, and performing the necessary procedures within this framework,
• keeping the necessary records regarding the applications you file with our Company for the general limitations period in order to serve as evidence in any potential disputes that may arise in the future,
• following up and conducting legal procedures,
• fulfilling the requests of governmental authorities and giving information to authorised bodies pursuant to the legislation.

To Whom and For What Purpose the Processed Personal Data May be Transferred
Your personal data that have been collected for fulfilment of the above Purposes may be transferred to our attorneys and counsels from whom we receive legal consultancy services within the scope of our legitimate interests; to our suppliers in connection with your application; if you filed a request within the scope of correction / destruction process, to the relevant parties to whom personal data have been transferred pursuant to Article 11(1)(f) with the condition to be limited with the notice that will be served; to governmental authorities authorised by law for establishment, exercise and protection of a right and fulfilment of our legal obligations, including Personal Data Protection Authority, and to private persons authorised by law, within the framework of personal data processing conditions set out in Article 5 of the Law, in compliance with the rules on transfer of personal data as set out in Article 8 of the Law.

Method and Legal Grounds for Collection of Personal Data
Your personal data are collected via e-mail or via data subject application form or your petitions which you submit through electronic or physical channels within the scope of fulfilment of the above Purposes.

Your personal data are gathered and processed by our Company based on the personal data processing conditions set out in Article 5 of the Law for the purposes and legal grounds set out below.

Based on the legal grounds that it is explicitly foreseen under the laws, and it is compulsory in order for the data controller to be able to fulfil its legal obligation;

• evaluating and finalising, in compliance with the legislation, the applications you filed with the Company within the scope of exercising of your rights as set out in Article 11 of the Law in relation to your personal data that are processed by our Company, and performing the necessary procedures within this framework,
• keeping the necessary records regarding the applications you file with our Company for the general limitations period in order to serve as evidence in any potential disputes that may arise in the future,
• fulfilling the requests of governmental authorities and giving information to authorised bodies pursuant to the legislation.

Based on the legal grounds that data processing is compulsory for the legitimate interests of the data controller, with the condition not to harm the fundamental rights and freedoms of the data subject;

• Following up and conducting legal procedures.

Rights of the Data Subject As Set Forth in Article 11 of the Law
We hereby notify you that you have the following rights in relation to your personal data pursuant to Article 11 of the Law:

• learn whether or not your personal data have been processed,
• to ask for information if your personal data have been processed,
• to learn the purpose of processing of personal data and if such personal data have been used in accordance with the intended purpose,
• to know the third parties within and outside the country to whom your personal data have been transferred,
• to ask for rectification if your personal data have been processed wrongly or with omissions and ask that such rectification process be notified to third parties to whom your personal data have been transferred,
• in cases where the reasons that required processing of personal data are no longer applicable even though the personal data were processed in accordance with the provisions of the Law and other applicable laws, to ask for deletion or destruction of your personal data and ask that such deletion or destruction be notified to the third parties to whom personal data have been transferred,
• to object to a result arising to your disadvantage as a result of analysis of personal data exclusively by means of automated systems,
• if you incur damage due to unlawful processing of personal data, to demand reimbursement of the damages.

If you submit your requests regarding your above rights to our Company, our Company will finalise your request, free of charge, within the soonest possible time and within, at the latest, thirty days, depending on the nature of the request. However, if the process requires any additional costs, you may be charged a fee based on the tariff to be designated by the Personal Data Protection Board.