Privacy Statementon the Protection of Personel Data

As Borusan Otomotiv Group , it is among our primary priorities to protect your personal data which we obtain during our procedures. We attach great importance to ensuring the security of your personal data and using/processing them in accordance with the legislation. This privacy statementcontains information about how we process personal data in our capacity as a data controller within the scope of our relations with our customers.

This privacy statementcontains information about how we process personal data in our capacity as a data controller within the scope of our relations with our customers.

1 .For which Purposes and Legal GroundsDo We Process Your Personal Data?

Articles 5 and 6 of the on the Protection of Personal Data regulates the legal groundsfor processing personal data. Below, we explain the purposes for which we process personal data along with the legal grounds which we rely on for such purposes:

For the following purposes based on the legal ground that processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract:

Creating and managing your customer record,
Evaluation and satisfaction of your requests for sale, rental, after sale services and exchange-pricing.
Managing processes for offers, purchase orders, work orders, requests, and agreements,
Managing creditprocedures in cases you prefer to obtain aloan to buy/lease a product ,
Managing financial and accounting transactions, including finalizing payments,.
Managing procedures related to vehicle insurance, insurance and guarantees, .
Managing operational processes for performance of the agreements with our customers, such as vehicle registration and license plate procedures, vehicle delivery, exchange of registration document, damage procedures and road assistance.

For the following purposes based on the legal ground of processing of personal data is necessary for compliance with a legal obligation which we are subjected to:

Managing operational processes arising from applicable legislation, such as issuing invoices, identification, notifications for technical actions and recalls,
If requested by authorizedinstitutions or organizations from our Company or if we are required to inform such institutions for the fulfillment of our legal obligations (for example, sharing your information if requested by a governmental agency with regards to a transaction that is suspected to be illegal),
Performing our activities in compliance with the legislation.

For the following purpose based on the legal ground that processing of personal data is necessary for establishment, exercise or protect a right:

• To protect and use our rights and to carry out legal processes in case of a possible legal dispute.

For the following purposes based on the legal ground that processing of personal data is necessary for our legitimate interests, without prejudice to the fundamental rights and freedoms of the data subject:

Receiving and dealing with your suggestions, requests, and complaints,
Ensuring safety during your visits to our showrooms, facilities, or authorized dealers/service partners,
Performing activities to achieve customer satisfaction,
Managing works for developing and improving our products, services, and processes,
Reporting, auditing, and inspecting our business processes and ensuring compliance with the policies, practices and rules of our group companies and manufacturer standards.

For the following purposes provided that you have given explicit consent:

Informing you about the campaigns, promotions, events, surveys and opportunities in line with your communication preferences (this kind of communication allows us to enhance your loyalty and satisfaction with our products/services),
Customizing your experience with our products/services, providing products and services that fit your preferences and areas of interest, managing marketing analysis processes,
Managing cooperation efforts for marketing with business partners.

Your explicit consent will be separately asked of this privacy statement, and in the event that you have given your consent, you are eligible to withdraw such consent at any time.

2. Which Personal Data Do We Process?

In alignment with the purposes and processes described above, we process customer transaction details including identity, contact information, vehicle information, invoices, purchase orders and activity history; marketing, transaction security information; financial information; legal transaction information; physical space security information; and risk management information.

During the processesrelated to fleet and corporate customers, we also process the information on the list of authorized signatories and titles-positions.

3. Whom are Your Personal Data Transferred to and For What Purposes?

Within the scope of the legal grounds mentioned above, we transferyour personal data,for the purposes specified in this privacy statement,to our domestic and internationalauthorized dealers and service partners, group companies, authorizedinstitutions and organizations, manufacturers, suppliers and business partners.While sharing your personal data with the parties specified in this privacy statement, we comply with the rules specified in Articles 8 and 9 of the Law on the Protection of Personal Data.

4. By Which Methods and On WhatLegal Grounds Do WeObtain Your Personal Data?

We collect your personal data mentioned above in accordance with the relationship you establish with us throughcommunication channels such as showroom visits, telephone calls, e- mail correspondence or in electronic medium. We collect your personal data based on the legal grounds that processing of personal data of the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract, processing of personal data is necessary for compliance with a legal obligation which we are subjected to, processing of personal data is necessary for establishment, exercise or protect a right, and processing of personal data is necessary for our legitimate interests, without prejudice to the fundamental rights and freedoms of the data subject, provisioned under Articles 5 and 6 of the Law on the Protection of Personal Data. You can find the details regardingthe purposes ofdata processing based on the legal grounds in the first Article of this privacy statement.

5. What Are Your Rights Regarding Your Personal Data and How Can You Exercise Them?

Article 11 of Personel Data Protection Law regulates the rights of the data subjects. Pursuant to this Article, you have the followingrights:

The right to know whether your personal data is being processed or not.
The right to request information if your personal data has been processed.
The right to learn the purpose of processing your personal data and whether they are being used for their intended purpose.
The right to know the third parties, both within the country and abroad, to whom your personal data is transferred.
The right to request the correction of your incomplete or inaccurate personal data and, within this scope, to have the relevant transaction notified to the third parties to whom your personal data has been transferred.
The right to request the deletion or destruction of your personal data in case the reasons requiring the processing of your personal data cease to exist, despite being processed in accordance with the Law and other relevant legislation, and to have the operations performed in this regard notified to the third parties to whom your personal data has been transferred, in case your personal data is incomplete or inaccurate.
The right to object to a result against you that arises from the analysis of your processed data exclusively through automated systems.
The right to request compensation if you suffer any damages due to the unlawful processing of your personal data.

Here are the main methods through which you may exercise your rights:

- You mayfill in the Application Form provided under “Protection of Personal Data” section on our websites,
- You maysend an e-mail including your request to botopyu@borusanotomotiv.com using your e-mail address registered in our systems.

You may also prefer to apply to the data controller by using other methods specified in the Communiqué on the Application Procedure and Principles to the Data Controller.