CAMERA RECORDINGS INFORMATION NOTICE WITHIN THE SCOPE OF KVKK

Ender Aluminum Industry and Trade Joint Stock Company (“Company”) carries out personal data processing activities at building entrances and within its facilities in accordance with the Constitution of the Republic of Türkiye, the Personal Data Protection Law (“KVK Law”) and other relevant legislation. As the data controller under the KVK Law, our Company processes personal data through security camera monitoring within our buildings and facilities and tracks the entry and exit of visitors, personnel, customers, and their vehicles for the purpose of ensuring security.

1. Camera Monitoring and Recording Activities at Facility Entrances and Inside the Facilities

Our Company processes personal data by capturing images through a closed-circuit camera system in company premises in order to ensure legal, technical and commercial occupational security.

1.1 Legal Basis of Camera Monitoring Activity and Method of Collecting Personal Data

The camera monitoring and recording activity carried out by our Company is conducted in accordance with the Law No. 5188 on Private Security Services and its implementing regulation, based on the legitimate interest of our Company.

Personal data is collected electronically through closed-circuit camera systems in order to ensure the security of our business within the framework of the personal data processing conditions specified in Articles 5 and 6 of the KVK Law.

1.2 Conducting Camera Monitoring Activities in Accordance with the KVK Law

Our Company conducts security camera monitoring activities in order to ensure security within its facilities in accordance with the purposes stipulated in the relevant legislation and the personal data processing conditions listed in the KVK Law.

1.3 Announcement of Camera Monitoring Activities

Our Company informs personal data owners in accordance with Article 10 of the KVK Law.

General information about camera monitoring activities is provided through warning notices placed within the facility and through this information text in order to ensure transparency and protect the fundamental rights and freedoms of personal data owners.

Warning notices indicating that monitoring is conducted are placed at the entrances of the areas monitored by cameras.

1.4 Purpose and Limitation of Camera Monitoring Activities

In accordance with Article 4 of the KVK Law, our Company processes personal data in a manner that is relevant, limited and proportionate to the purpose for which it is processed.

The purpose of camera monitoring activities through closed-circuit systems is limited to the purposes specified in this information notice.

Accordingly, the monitoring areas, number of cameras, and monitoring times are determined in a way that is sufficient to achieve the security objective and limited to that purpose.

Monitoring is not conducted in areas where it may violate personal privacy beyond security purposes (such as prayer rooms, restrooms, etc.).

1.5 Ensuring the Security of the Collected Data

Our Company takes the necessary technical and administrative measures in accordance with Article 12 of the KVK Law to ensure the security of personal data obtained through camera monitoring activities.

1.6 Retention Period of Personal Data Obtained through Camera Monitoring

The retention period of personal data obtained through cameras is 1 month.

1.7 Persons and Purposes for Which the Collected Data May Be Transferred

Only a limited number of employees have access to the information obtained through monitoring. Camera recordings may be transferred to authorized public institutions, shareholders, board members, lawyers, and contracted service providers in accordance with Articles 8 and 9 of the KVK Law for the purpose of ensuring company security. (For example, upon written request from the prosecutor or judge during an investigation.) Individuals who have access to these records sign confidentiality agreements declaring that they will protect the confidentiality of the data.

2. Monitoring of Visitor Entry and Exit within the Facilities

Our Company processes personal data for the purpose of tracking visitor entries and exits within company facilities in order to ensure security.

When visitors enter our buildings, their names and surnames are collected and they are informed through notices provided at the premises. These data are processed solely for visitor tracking purposes and are recorded physically in the visitor logbook based on the legitimate interest of our Company in accordance with Articles 5 and 6 of the KVK Law.

The collected personal data may be transferred to authorized public institutions within the framework of Articles 8 and 9 of the KVK Law for the purpose of ensuring building security.

3. Purposes, Categorization and Retention Periods of Processed Personal Data

In accordance with Article 10 of the KVK Law, our Company informs personal data owners about the categories of personal data processed, the purposes of processing, and retention periods.

• Emergency Management Processes
• Information Security Processes
• Audit and Ethics Activities
• Compliance with Legal Regulations
• Ensuring Physical Security
• Legal Affairs Management
• Internal Investigation and Intelligence Activities
• Business Operations Management
• Logistics Management
• Security of Movable Assets and Resources
• Security of Data Controller Operations
• Providing Information to Authorized Authorities
• Management Processes
• Visitor Record Tracking

Camera records are stored for 1 month.

4. Deletion, Destruction and Anonymization of Personal Data

Even if personal data is processed in accordance with relevant laws, if the reasons requiring processing cease to exist, personal data will be deleted, destroyed or anonymized by our Company either upon its own decision or upon the request of the data subject, in accordance with Article 7 of the KVK Law and Article 138 of the Turkish Penal Code.

5. Rights of the Personal Data Owner under Article 11 of the KVK Law

Personal data owners have the following rights:

• To learn whether their personal data is processed
• To request information if personal data has been processed
• To learn the purpose of processing and whether data is used accordingly
• To know the third parties to whom data is transferred
• To request correction of incomplete or incorrect data
• To request deletion or destruction of personal data
• To object to results arising from automated analysis
• To request compensation for damages caused by unlawful processing

You can submit your requests by reviewing the Data Subject Application Methods and Rights and the Data Subject Application Form available on our website and filling out the form.