Cookie-Richtlinie

KÂR KATILIM ALTIN RAFİNERİSİ A.Ş.
COOKIE NOTICE AND COOKIE POLICY

Cookies and similar online technologies used on the corporate website

This document provides information about personal data processing activities carried out through cookies. This Cookie Notice and Cookie Policy (the "Policy") has been prepared to fulfil the obligation to inform under Personal Data Protection Law No. 6698 (the "Law"). This Policy is not an explicit consent statement. Where cookies require explicit consent, users' preferences are obtained and recorded separately through the cookie management panel.

1. Data Controller and Scope of the Policy

This Policy covers cookies and similar technologies used on the website specified above, its subdomains and related web interfaces managed by the Company. Third-party cookies integrated into the Company's website are also described in this Policy. Websites and applications linked from the Company's website but not operated by the Company are subject to their own cookie and privacy policies.

2. What Are Cookies and Similar Technologies

Cookies are small text files stored on a browser or device by the website visited. Web beacons, pixels, tags, local storage, session storage and similar identifier technologies are also referred to as cookies under this Policy to the extent of their respective functions.

Cookies may be used to operate and secure the website, ensure that contact and application forms function properly, remember language and display preferences and, where the user has given consent, generate usage statistics or measure corporate promotional activities. Data are collected by wholly or partly automated means during access to and use of the website.

Where contact, quotation or application forms on the website are used, security and session data may be retained in connection with the relevant form transaction. Content entered in form fields is processed under the relevant Personal Data Protection Notice, rather than under this Policy. IP addresses and device and browser identifiers may constitute personal data. No special categories of personal data are processed through cookies, and no data collection activity is carried out for this purpose.

3. Categories of Personal Data That May Be Processed

Depending on the technology used and the user's preferences, the following categories of data may be processed:

• device and connection data: IP address, device type, operating system, browser type/version, language, approximate location and referring-page information;

• session and transaction security data: session ID, access status, security tokens, timestamps, error logs and access logs;

• user activity data: pages and corporate content viewed, searches, clicks, scrolling and form interactions;

• preference data: cookie-category selections, language, display, region and similar user settings;

• contact and application transaction data: technical records that may be associated with the form process where a contact, quotation or application form is used;

• promotional and attribution data: campaign, corporate promotion and conversion identifiers, only where explicit consent has been given.

4. Classification of Cookies

By provider, cookies may be first-party cookies, placed through the Company's domain, or third-party cookies, placed by another provider. By duration, they may be session cookies, which are deleted at the end of the browser session, or persistent cookies, which remain stored for a specified period.

The name or technical provider of a cookie does not by itself determine its legal classification. The purpose, necessity, scope of data, retention period and recipients are assessed separately for each technology. Where a cookie serves both necessary and non-essential purposes, it will not be used for the non-essential purpose unless explicit consent has been given.

5. Purposes of Use Legal Bases and Default Settings

6. Inventory of Cookies Used on the Website

The Company regularly updates the cookie inventory below. The cookie name, provider and domain, category and first- or third-party status, specific purpose of use and retention period are stated separately for each cookie or similar technology. Legal bases by category are explained in Section 5, while recipients and any transfers abroad are explained in Section 7.

7. Third Party Providers Recipients and Transfers Abroad

Cookie data may be shared, to the extent required for the relevant service, with suppliers providing website hosting and infrastructure, cybersecurity, cookie preference management, operation of contact and application forms and, where the user has given consent, analytics or promotional services. Where these organisations process data for their own purposes, they may also act as data controllers. Their current roles and recipient information are shown in the technical inventory.

Where a provider located abroad or a provider that processes data on systems located abroad is used, any transfer is carried out in accordance with Article 9 of the Law, provided that an applicable adequacy decision, an appropriate safeguard, such as an applicable standard contract or binding corporate rules, or one of the exceptional transfer cases prescribed by law exists. Personal data are not transferred abroad unless an appropriate transfer mechanism has been established, such as entering into a Standard Contract under Article 9 of the Law or relying on an adequacy decision announced by the Personal Data Protection Board.

Permission to operate a non-essential cookie does not in itself satisfy the legal condition or safeguard required for a transfer abroad. The Company assesses cookie consent and transfers abroad separately and states the actual position in the inventory.

8. Managing Cookie Preferences and Withdrawing Explicit Consent

When the website is first visited, a cookie panel presents the options Accept All, Reject All and Manage Preferences with equal prominence. Non-essential categories are not preselected and are not enabled unless the user takes an affirmative action.

Users may make selections by category. Preferences may be changed at any time through the cookie management panel on our website. Explicit consent may be withdrawn as easily as it was given and free of charge. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and the new preference is implemented as soon as possible.

Deleting cookies may also delete the preference record, in which case the panel may be displayed again. Preferences may need to be set again when the device or browser is changed, private browsing mode is used or cookies are cleared.

9. Browser and Device Settings

Cookies may also be viewed, deleted or blocked through the settings of the browser or device used. Menu names and options may vary depending on the versions of Chrome, Edge, Firefox, Safari and other browsers. Current guidance is available on the relevant provider's help pages.

Blocking all cookies through the browser may affect website navigation, security verification, form submission and language or display preferences. Browser settings do not replace the Company's category-based preference panel on the website; both tools may be used separately.

10. Retention Periods and Information Security

The period for which each cookie remains on the device is stated in the current inventory and is not longer than necessary for its purpose. Server logs and transaction and security records derived from cookies and transferred to the Company's systems may be retained separately in accordance with applicable legislation, the retention and disposal policy and limitation periods.

The Company implements appropriate technical and administrative measures, including data minimisation, access controls, encryption and logging security. Unnecessary direct identification or contact data are not stored in cookie values. Security flags and short retention periods are used where technically appropriate.

11. Data Subject Rights and Applications

Data subjects may exercise their rights under Article 11 of the Law. The application methods and identity verification requirements are explained in the Company's Data Controller Application Form. Applications may be sent to the registered office address above, to the registered electronic mail (KEP) address [email protected] or, through electronic methods permitted by applicable legislation, to [email protected].

For use of the cookie panel or technical issues, the contact channels available at www.karkatilimaltinrafinerisi.com may be used. Notifications submitted through these channels will not be treated as formal applications under the Law unless they satisfy the formal and identity verification requirements of the Communiqué on the Procedures and Principles of Application to the Data Controller.

12. Updates to and Entry into Force of the Policy

Material amendments to the Policy will be notified to users by an appropriate method through the website or recorded contact channels.

An amendment to the Policy does not replace explicit consent that has not previously been given. A new non-essential cookie, or an existing non-essential cookie whose purpose has changed, will not be enabled until the user provides a current preference.