Page 5 - POLICY FOR THE PROTECTION AND PROCESSING OF PERSONAL DATA OF NUROL GROUP EMPLOYEES

In line with the Law and other legislation, and within the scope of the requirements detailed in the
Policy regarding the conditions for the processing of personal data and of private personal data, the
purposes of our Company for the processing personal data are as follows:
1. The planning and/or execution of our Company’s human resources policies and processes,
2. The planning and/or execution of the activities aimed at ensuring the legal and technical safety
of our Company and of the relevant persons in a business relationship with our Company,
3. The planning and/or execution of the activities required for the purpose of customizing the
products and services offered by and/or on behalf of our Company according to tastes, usage
habits and needs of relevant people, and suggesting and promoting such activities to the
relevant people,
4. The carrying out of the necessary works to ensure that the relevant people benefit from the
products and/or services offered by and/or on behalf of our Company, and carrying out the
relevant business processes for this purpose,
5. The carrying out of the necessary works and other associated business processes by means of
our relevant business units so that the necessary business and/or operational activities can be
carried out by our Company,
6. The planning and/or execution of our Company’s commercial and/or business strategies.

Detailed information on the purposes behind the processing of the personal data in question can be
found in Annex-3 (“Annex 3 - Purposes Of Personal Data Processing”) of this Policy.

3. SECTION 3 – GENERAL POINTS RELATING TO THE TRANSFER OF PERSONAL DATA

In compliance with the law, our Company can, after taking the necessary security measures, transfer
the personal data and private personal data of the data owner to third parties for data processing
purposes. To this end, our Company shall act in accordance with the provisions of Articles 8 and 9 of
the Law. More detailed information on this subject can be found in Annex 4 to the Policy (“Annex 4 -
Third parties to which personal data are transferred by our Company, and the purposes of such
transfers”).

3.1 Transfer of Personal Data

Even in the absence of the explicit consent of the data owner, personal data may be transferred to
third parties in the event of one or more of the conditions listed below being present, with our
Company showing the necessary diligence and implementing all the necessary security measures,
including the methods defined by the Board, when performing the transfer:

 When the law clearly defines activities that may require the transfer of personal data,
 When the transfer of personal data by the Company is related to or required for the drawing
up or execution of a contract,
 When the transfer of the personal data is a requirement for our Company to fulfill its legal
obligations,
 When the personal data transferred by our Company is to the extent that the said data has
already been made public, provided that they have been made public by the data owner,
 When the transfer of personal data by the company is an obligation for the Company, the data
owner or third parties for the ensuring, exercising or protection of their rights,
 On the condition that the fundamental rights and freedoms of the data owner are not
infringed, when the transfer of the personal data is obligatory from the standpoint of our
Company’s legitimate interests,

4