GÜMÜŞTAŞ MINING WEBSITE INFORMATION NOTE

This Information Note provides the basis for the processing of your personal data in line with the provisions of the Law No. 6698 on Protection of Personal Data (the “Law”) and other applicable legislation, by Gümüştaş Madencilik ve Tic A.Ş. (the “Company”), located at the address of “Karşıyaka Mahallesi Osman Bey Caddesi Alkan Apt. Kat:1 No:22 Merkez/Gümüşhane” acting as data controller.

1. Purpose of Personal Data Processing

Your personal data collected by the Company when you visit our website may be processed by the Company in accordance with articles 5 and 6 of the Law for the following purposes:

To plan and execute the activities necessary for recommending and promoting the Company’s services to relevant audiences by tailoring said services in line with their preferences, usage habits and needs,

To inform the works and processes to be carried out by the Company’s relevant business units to perform the Company’s commercial activities,

To plan and execute the commercial and/or business strategies of the Company,

To ensure legal, technical and commercial-business safety of the Company and its business partners,

2. Recipients of Processed Personal Data and Reasons for Transfer

Your personal data collected by the Company may be transferred to our business partners (external service providers, hosting service providers, research companies, call centers, etc.), duly authorized public agencies and third parties in accordance with the terms, conditions and purposes of personal data processing as specified in articles 8 and 9 of the Law.

3. Personal Data Collection Method and Legal Basis

Your personal data is collected automatically by the Company through the data files (cookies) placed on your device when you visit the Company’s website, as well as the forms you submit for the purposes specified in this Information Note. Please refer to the Cookie Policy for more information about the cookies.

Your personal data is processed for the following legal reason(s):

Processing of data is necessary based on legitimate interest of the Company under article 5/2 (f) of the Law without detriment to the fundamental rights and liberties of the data subject.

4. Your Rights and Liberties Regarding Your Data

Under Article 11 of the Law, with respect to their personal data, customers are entitled to apply to the Company to a) inquire about whether their personal data has been processed, b) if their personal data has been processed, request information on the processing, c) learn the purpose of processing of the personal data and whether their data is used in accordance with the specified purpose, d) request information on domestic and foreign third parties with whom their data has been shared, e) request correction in case the personal data processed is inaccurate or incomplete, f) request deletion or destruction of personal data under article 7 of the Law, g) request that the actions taken within the framework of paragraphs (e) and (f) be notified to the third parties to whom the personal data is transferred, h) object to any result that is to their detriment as a result of an exclusively automated analysis of their personal data, and i) claim compensation for the damages they might have suffered in the event their personal data is processed in an unlawful manner. In addition, you are able to unsubscribe from the e-mail list by clicking on the relevant link included in the e-mails.

You can apply to the Company to exercise your rights specified above in line with the Communique on Procedures and Principles for Applying to the Data Controller.

The Company will resolve your request as soon as possible depending on the nature of the request, and within 30 days at the latest, free of charge. The Company may charge a fee in case of subsequent requests on the same subject, or if the request necessitates and additional cost. The Company is entitled to accept and process the request, or reject the request via written notice by providing an explanation.

In case the application made in line with the above procedure is rejected, the answer provided by the Company is insufficient, or the application is not resolved in due time, you are entitled to file a complaint with the Personal Data Protection Board (the “Board”) within 30 days after the Company’s response, and in any case within 60 days from the application date. Please keep in mind that no complaint may be filed before making an application to the Company.

The Board is authorized to conduct an investigation on the matters that fall within its jurisdiction. The Board shall evaluate the request and submit a written response to relevant parties. If no response is sent within 60 days of the complaint, the request shall be deemed rejected. In the event that an investigation, whether launched ex officio or in response to a complaint, reveals a violation, the Board shall order the data subject to remedy the violation via written notice. This order shall be fulfilled without delay in no later than 30 days. The Board may also suspend the processing or its transfer abroad in case such processing or transfer is clearly in violation of the law and poses the risk of irreparable damage.

The Company takes due care in protecting your data. Thank you for your trust.