Personal Data Protection

ARKİMAR Project Management and Architectural Consultancy Inc. ("ARKİMAR" or "Company") acts as data controller under the Turkish Personal Data Protection Law No. 6698 ("KVKK"). The Company is headquartered at Levent Mah. Büyükdere Cad. No:193, Şişli, Istanbul.

The following categories of personal data are processed by our Company: • Identity Data: Name, surname, national ID number, passport number • Contact Data: E-mail address, phone number, postal address • Professional Data: Company name, position, professional background, references • Financial Data: Bank account details, invoice information (within contractual scope) • Technical Data: IP address, browser type, website visit data, cookie records • Transaction Security Data: System access logs, password information

Your personal data is processed for the following purposes: • Establishment, performance, and management of service contracts • Customer relationship management and communication • Bid, tender, and project process management • Compliance with legal obligations (tax, accounting, audit) • Business development and marketing activities (subject to explicit consent) • Ensuring website security and functionality • Human resources processes (for job applications)

Your personal data is processed under Articles 5 and 6 of KVKK on the following legal grounds: • Processing is necessary for the establishment or performance of a contract • Compliance with a legal obligation to which the Company is subject • Legitimate interests of the Company, provided they do not prejudice fundamental rights • Explicit consent of the data subject (where consent is required)

Your personal data may be transferred to public institutions (tax offices, social security bodies, courts) under legal obligations; to project partners and subcontractors within the scope of service delivery; to professional service providers (accounting, legal, audit); and to banks and payment institutions. For international transfers, the safeguards under Article 9 of KVKK are ensured.

Your personal data is retained for as long as required by the processing purpose and applicable legal retention obligations. Contract-related data is kept for 10 years after contract termination; job application data for 2 years; website technical data for 1 year.

Under Article 11 of KVKK, you have the right to: • Learn whether your personal data has been processed • Request information about the processing of your personal data • Learn the purpose and whether data is used in accordance with its purpose • Know the third parties to whom your data has been transferred • Request correction of incomplete or inaccurate data • Request deletion or destruction of data under Article 7 conditions • Request notification to third parties of corrections or deletions • Object to automated processing that produces adverse results • Claim compensation for damages arising from unlawful processing

You may submit a request through the following channels: • Email: kvkk@arkimar.com.tr (with identity verification) • Post: Levent Mah. Büyükdere Cad. No:193, Şişli, Istanbul — marked "Personal Data Protection Request" • In person: By presenting a valid ID at our head office Requests will be responded to free of charge within 30 days. Where processing incurs additional cost, the fee schedule set by the Personal Data Protection Authority may apply.