Information Note on PDPL

OMV ENERJİ TİCARET ANONİM ŞİRKETİ

INFORMATION NOTE ON THE PROTECTION OF

SUPPLIER, CUSTOMER AND VISITOR PERSONAL DATA

1.Introduction

As OMV Enerji Ticaret Anonim Şirketi (“OMV”), we have the title of data controller within the scope of the Personal Data Protection Law No.6698 (“Law”) and we give importance to the protection of personal data in this context. We submit to your information through this information note the context and conditions under which we process supplier, customer and visitor data and the rights and obligations of both you and OMV.

The legal concepts used in this text regarding the protection of personal data express their meanings in the Law.

2. Principles

We undertake to process your personal data in accordance with the law and the rule of honesty, observing the principle of accuracy and timeliness, for certain, clear and legitimate purposes, in connection with the purpose for which they are processed, in a limited, measured manner and limited to the period stipulated by the provisions of the legislation or required by the purpose of processing.

3. Purposes of Processing of Your Personal Data

Your personal data are processed in accordance with the conditions specified in Article 5 of the Law for the purposes presented to your information below:

Establishing a contract between you and our company and the performance of our obligations under the contractual relationship (in this context, providing of services/products to by our Company or providing of services/products by you to our Company),

Fulfillment of our company's legal obligations,

Conducting the executive and administrative activities of our company,

Conducting our company's communication and marketing activities,

Ensuring the security of our company's operations and buildings / facilities.

4. Transfer of Your Personal Data

Your personal data will be provided to OMV's shareholders, business partners, service providers, suppliers, customers, public institutions and private entities authorized by law, especially other group companies located in Turkey and / or abroad with which OMV cooperates, in order to expand existing business partnerships and also to servers located in Turkey and / or abroad for the following purposes, within the framework of the conditions specified in Articles 8 and 9 of the Law:

Fulfillment of our company's legal obligations,

Conducting the executive and administrative activities of our company,

Conducting our company's communication and marketing activities,

5. Method and Legal Cause of Collection of Personal Data

Your personal data is collected by all verbal, written and electronic means including documents, personal card, business cards, company documents sent to OMV by the relevant right holder, electronic systems of the group companies of which the company is a part, signature circulars, power of attorneys, e-mail and other electronic messages, contracts. In addition, your personal data is collected through cameras located in the company buildings / facilities. Your personal data collected by these methods are processed in accordance with the following legal causes among those stated in Article 5 of the Law: (i) data processing is stipulated under the law, (ii) data processing is necessary for the establishment or fulfilment of the contract, (iii) data processing is necessary for the establishment, protection or use of a right, and (iv) data processing is necessary for the legitimate interest of the data controller or based on your express consent.

6. Data Security

OMV protects your personal data in full compliance with all reasonable technical and administrative security controls, which are required to be conducted according to information security standards and procedures. These security controls are constantly updated, taking into account technological developments, and are kept at an appropriate level against possible risks.

OMV which is an international company, attaches importance to the confidentiality of all information and information assets, including personal data, and has an information security network structuring that starts from an international level and that specializes on a country basis. Within this structuring, the sensitivity shown for full compliance with local legislation is also shown for the General Data Protection Regulation and related regulations brought by the European Union globally with the same discipline. OMV has a certificate of conformity to ISO 27001: 2013 Standard due to its highly secure information and data processing infrastructure and this document is an indication of OMV's sensitive and detailed approach to data security.

7. Data Subject’s Rights

As per article 11 of the Law, data subject is entitled to exercise the following rights by applying to OMV:

Right to learn whether the personal data is processed,

Right to request information on the matter, if the personal data is processed,

Right to learn the purpose of processing of personal data and whether the personal data is used in accordance with such purpose,

Right to know the third parties to which the personal data are transmitted domestically or in abroad,

If the personal data is processed wrongfully or deficiently, right to request for correction of the personal

To request their deletion or destruction in case the reasons requiring the processing of personal data to be evaluated within the principles of purpose, duration and legitimacy disappear,

In case of correction, deletion or destruction of personal data, requesting that these transactions are notified to third parties to whom personal data is transferred,

Right to objection to an unfavorable result in the event that the processed personal data is analyzed exclusively through automated systems.

Right to demand the compensation of the damage in the event of unlawful processing of personal data.

You may submit your requests regarding your above stated rights in the format determined by the Board of Protection of Personal Data along with the identifying information and documents to our company by using the following methods:

By mail to our postal address below,

Maslak Mh. Maslak Meydan Sk. No:3 Veko Giz Plaza Kat:12 D:37-38-39-40 Sarıyer / İstanbul

To our KEP address below, with secure electronic signature or mobile signature, or through your e-mail address registered with our company, to the e-mail address below,

omvenerji@hs02.kep.tr

The applications made by you as stated above will be answered in writing or electronically within 30 (thirty) days from the date of receipt of our company, in accordance with Article 13 of the Law. Our company reserves the right to request additional documents (identity card or copy of driver's license, etc.) for identification and determination of authorization in order to eliminate legal risks that may arise from unlawful and unfair data sharing and especially to ensure the security of your personal data.