PRIVACY POLICY FOR ICRON WFM USERS

This Privacy Policy regulates the policy regarding the confidentiality of the information and documents shared by the parties (the “Firm” or “Customer”) that have signed the User Agreement with ICRON Technologies Europe B.V. (“ICRON” or “Company”), during their use of the human resources and personnel management system (“Platform”) offered by ICRON.

As ICRON, it is our priority to protect and ensure the confidentiality of the information provided by the Customer Firm, Firm officials or employees during the membership and use of the Platform. ICRON processes the personal data shared on the Platform as a “data processor” within the scope of the Law on Protection of Personal Data No. 6698 (“PDPL”) and European Union General Data Protection Regulation (“GDPR”). For this reason, the information provided by the Customer Firm and shared on the Platform will not be used in any scope other than the rules and purposes specified in the User Agreement and will not be shared with third parties.

In cases where it acts as a data processor, the activities of ICRON are mostly limited to the technical parts of data processing. The authority to take decisions regarding the processing of personal data belongs to the data controller “the Firm”. In this context, the rights of the relevant person stipulated in the PDPL and GDPR must be conveyed to the relevant data controller.

THE METHOD OF COLLECTING PERSONAL DATA

Your personal data is collected by ICRON via cookies, digital forms located on our website or the other information and documents which you or your firm have disclosed to us.

THE PURPOSES AND THE LEGAL REASONS OF PROSESSING PERSONAL DATA

Our Company will be able to process your personal data in order for taking the necessary actions and fulfilling legal obligations, executing the necessary business processes to benefit you from our services, planning and executing the proposal and promotion of the services customized according to their choices, usage habits and needs, improving ICRON products and services, providing communications with the Customer Firm regarding the use of the Platform, and carrying out business development and reporting activities, planning the Firm’s commercial and/or business strategies, ensuring the legal, technical and commercial-business security of the Firm, creating a e-bulletin membership, evaluating and follow-up your requests, suggestions and complaints, informing you regarding our products and /or services, planning and executing the customer satisfaction activities within the scope of legal reasons listed in below:

• “compliance with a legal obligation” regulated in Article 5/2(ç) of PDPL and Article 6/1(c) of the GDPR,
• the “legitimate interest of the data controller” regulated in Article 5/2 (f) of the PDPL and Article 6/1(f) of the GDPR,
• “explicit consent” regulated in Article 5/1 of PDPL and Article 6/1(a) of the GDPR (for the purpose of sharing on the website of our clinic within the scope of conducting

advertising, marketing and promotional activities regarding products and / or services, measuring your satisfaction with our services by satisfaction questionnaire, taking necessary actions and making analyzes for your satisfaction)

TRANSFER OF PERSONAL DATA

We only share your Data when strictly necessary, and only to the following third parties provided that:

• our partner companies,
• our suppliers, to perform the purposes described above or to fulfil a task on our behalf (including sales support, advertising, market research or customer services, and account management, supply of products or services now or in the future, or prize draws, competitions or promotions);
• to a third party when stipulated or authorized by the law, or a valid legislative provision, court order or regulation, or if such disclosure is necessary as part of an investigation or procedure, within the national territory or in another country.

Finally, in accordance with the legal provisions (in particular Article 6(1) and recital 48 of GDPR; and in Article 8 and 9 of PDPL), we may share your Data with ICRON Global companies for internal administrative purposes.

If a transfer as described above takes place to a country outside the Republic of Turkey and/or the European Union and , we will put in place measures to protect your data, appropriate to the legislation in force. Similarly, if you are located outside the EU, your Data will be transferred within the EU where they will be processed in accordance with the legal provisions of the European Data Protection Regulation.

YOUR RIGHTS AS THE DATA SUBJECT

According to the PDPL and GDPR, you also have the following rights:

• To learn whether your personal data is processed, to request information regarding it,
• To request a copy of your processed personal data,
• To learn the purpose of processing your personal data and whether they are used appropriately for their purpose,
• To know the third parties to whom your personal data are transferred
• To request the correction of your personal data if it is incomplete or incorrectly processed, to request that this situation be notified to the third parties to whom your personal data has been transferred, if you exercise this right,
• To request the erasure or to be forgotten of your personal data in case the reasons for processing your personal data disappear, to request that this situation be notified to third parties to whom your personal data is transferred, if you exercise this right,
• To lodge a complaint with a supervisory authority,
• To obtain from the controller restriction of processing where one of the cases in the 18th article of GDPR applies:
• To receive the personal data concerning you, in a structured, commonly used and machine-readable format
• To transmit your personal data to another controller without hindrance from the controller to which the personal data have been provided
• To object to the result regarding you by analyzing the information we obtain with automatic systems and requesting compensation in case of damage

Please fill out the Application Form provided on our website with your information and application requests and submit it to the address gdpr@icrontech.com.

Our company fulfills your requests as soon as possible and within thirty days at the latest and once for free of charge. However, requester may be charged for following requests or for the initial request if the action taken on the request requires additional cost. Our company can accept and process the request or reject the request in writing by explaining its reason.

We would like to emphasize that your data is meticulously protected by our Company and thank you for the trust that you place in us.