Privacy Policy and Personal Data Protection Disclosure

1. Identity of the data controller

Pursuant to Article 10 of Turkish Personal Data Protection Law No. 6698 ("KVKK"), the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation, and Articles 13 and 14 of the EU General Data Protection Regulation ("GDPR"), the data controller for your personal data is the legal entity identified below.

In this text, "DNL", "we", and "the company" refer to the legal entity identified above; "you", "visitor", and "data subject" refer to the natural person whose personal data is processed.

1.1. Data Controllers' Registry (VERBİS)

Our company falls within the VERBİS registration exemption provided for data controllers whose number of annual employees is below 50 and whose annual balance sheet total is below the threshold set by the Board, and whose main field of activity is not the processing of special categories of personal data. This exemption does not remove the Law's other obligations; our company maintains a personal data processing inventory and fulfils all obligations described in this text.

1.2. Data Protection Officer

Article 37 of the GDPR requires the appointment of a Data Protection Officer only in specific cases — public authorities, controllers carrying out large-scale regular monitoring, and controllers processing special categories of data on a large scale. Our company's activity falls into none of these cases; KVKK does not require the appointment of a Data Protection Officer either. We therefore have no appointed Data Protection Officer. All requests and questions regarding your personal data may be submitted directly to our company through the channels described in Section 12.

2. Scope of this text

This text explains how we process your personal data when you visit our website at www.dnl.com.tr, when you use the contact form on the site, when you reach us by email or telephone, and for the duration of our ongoing commercial relationship.

This text has been prepared to jointly meet our obligations under both KVKK and the GDPR. While the two regimes largely overlap, there are points where they diverge; where this is the case, the relevant section states which regime produces which result. KVKK applies to data subjects resident in Türkiye, and the GDPR applies to data subjects located in the European Union. Application of the GDPR is determined by the data subject's location; our company being established in Türkiye does not affect this.

This text does not cover data processing activities relating to our company's own employees, job applicants, or supplier personnel. Separate disclosure texts have been prepared for these groups and delivered directly to the data subjects concerned.

Our site may contain links to third-party websites. Our company is not responsible for the data processing practices of those sites; when you visit them, their own privacy policies apply.

3. Categories of personal data processed

The table below shows the categories of personal data we process and the content of each category. For a visitor who only browses our site, the data processed is limited to the first two rows of the table.

None of these categories constitute special categories of personal data as defined in Article 6 of KVKK and Article 9 of the GDPR. This is further explained in Section 14.

4. Purposes of processing and the legal basis for each purpose

The GDPR recognises six equal legal bases (Art. 6/1): explicit consent, performance of or entry into a contract, legal obligation, vital interest, public task, and legitimate interest. KVKK sets out a similar list in Article 5, but counts the bases other than explicit consent more narrowly, and accepts "legitimate interest" only on condition that it does not harm the data subject's fundamental rights and freedoms. The table below shows the legal basis under each regime separately for every processing purpose.

For every processing activity we base on legitimate interest, we have assessed whether our interest outweighs your fundamental rights and freedoms. In this assessment we considered whether the data is capable of identifying you, how foreseeable the processing is, and the benefit it provides to you. Your right to object to this assessment is explained in Section 11.

5. How personal data is collected

Your personal data is collected in the following ways:

Automatically: When you visit the site, the technical information your browser sends with every internet request is recorded by our hosting infrastructure. This record is a natural consequence of how the internet works and is technically necessary for the requested page to be delivered to you.

Submitted by you: When you fill in the contact form, send us an email, call us, write to us via WhatsApp, or leave a business card at a trade fair, you submit your data directly to us. Which information you share through these channels is your own choice; the minimum information we need to answer a technical question is a contact address we can reply to and the question itself.

From third parties: We may obtain corporate contact information from publicly available sources (company websites, trade registry records, industry trade-fair attendee lists, professional networking platforms). This information does not constitute personal data to the extent it relates only to legal entities; when we obtain contact information belonging to a natural person, we direct them to this text at our first contact.

6. Cookies and similar technologies

A cookie is a small text file saved to your device by your browser when you visit a website. In addition to cookies, there are other technologies that serve a similar function, such as local storage, session storage, and tracking pixels. The term "cookie" used in this section covers all of these.

In the European Union, permission to access and store information on your device does not arise directly from the GDPR, but from Article 5(3) of the ePrivacy Directive (2002/58/EC). Under this provision, prior consent is required for every cookie that is not technically necessary for the provision of the service. In Türkiye, the Personal Data Protection Authority's Guideline on Cookie Applications requires that explicit consent be obtained for non-essential cookies, that the reject option be as visible as the accept option, and that pre-ticked consent boxes not be used.

The cookies and similar technologies used on our site are explained one by one below.

6.1. Essential technologies (no consent required)

These records are kept only in your own browser; they are not transmitted to our servers or to any third party, and they do not contain information capable of identifying you. The second sentence of Article 5(3) of the ePrivacy Directive exempts from the consent requirement any record that is strictly necessary for the provision of a service explicitly requested by the user; storing the cookie preference itself falls within this exemption.

6.2. Hosting and content delivery

Our site is hosted on infrastructure provided by Vercel Inc. (USA). For every internet request, Vercel's servers record the IP address the request was made from, the address of the page requested, the date and time of the request, the browser type, and the response status code, for security and error-tracking purposes. This record is technically necessary for the service to be provided and cannot be made subject to consent: blocking it would mean blocking the site from being delivered to you.

Vercel keeps these records on our behalf as a data processor, not for its own account. We have a data processing agreement with Vercel that meets the requirements of Article 28 of the GDPR. The records are kept for a short period and are not used for marketing purposes.

The typefaces (fonts) used on the site are served from our own servers. We do not call fonts from an external provider such as Google Fonts; as a result, your IP address is not transmitted to a font provider when the page loads. This choice is deliberate: a German court ruling (LG München I, 20.01.2022, 3 O 17493/20) found that externally calling Google Fonts was unlawful because it transferred the visitor's IP address to the USA without consent.

6.3. Visit measurement — Plausible Analytics (no consent required)

To understand which pages are useful to visitors, we use Plausible Analytics, provided by Plausible Insights OÜ (Estonia).

The features that distinguish Plausible from other measurement tools are precisely why it does not require consent:

• It stores nothing on your device. It sets no cookie and uses no local storage. The ePrivacy Article 5(3) consent requirement arises when a device is accessed or information is stored on it; since neither happens with this tool, the requirement does not arise.
• Your IP address is not stored. The IP address is processed momentarily only to determine the country the visit came from, and is then irreversibly hashed together with browser information and discarded. A salt value that changes daily is added to the hash, so the same visitor produces a different hash the next day; visitors cannot be tracked across days as a result.
• There is no cross-site tracking. The tool cannot track you on other sites.
• Data stays within the European Union. Hosting is in Germany; there is no transfer to a third country.
• No personal profile is built, no data is sold, and nothing is used for advertising purposes.

The measurement data we collect is at this level: the page visited, the referring address, the country, device type, browser, operating system, and campaign tags. This data is displayed in aggregate; who any single visitor is cannot be derived from it.

Plausible has published its legal assessment publicly. The reason we do not ask for consent for this tool is that consent is not required for it — placing a tool in the consent banner when it is not legally required makes the banner meaningless for the tools that genuinely do need it.

6.4. Usage analysis — Microsoft Clarity (consent required)

To be able to see usage problems occurring on the site, we use Microsoft Clarity, provided by Microsoft Ireland Operations Limited. Unlike the measurement tool described in the previous section, this tool:

• sets a cookie on your device,
• records your mouse movements, scrolling, and clicks,
• creates a recording of your session (session replay), so that how a visitor behaved on the page can be reviewed afterwards.

For this reason, the Clarity script is loaded only if you give explicit consent on the cookie banner. If you do not give consent, or do not respond to the banner, no file belonging to Clarity is downloaded to your browser, no cookie is set, and no request is sent to Microsoft's servers.

Clarity masks the content you type into text fields by default; form field content is not visible in the session recording. Nonetheless, a session recording is a detailed trace of your behaviour, which is why it is subject to consent.

Microsoft may also process Clarity data for its own account. Microsoft's privacy disclosure for this tool is published at privacy.microsoft.com. Microsoft Ireland Operations Limited is established in Ireland; however, within Microsoft's group structure, data may be transferred to the USA. This transfer is explained in Section 8.

You can withdraw your consent at any time by clicking the "Cookie preferences" link at the bottom of the site. Once withdrawn, the Clarity script will not load from the next page load onward. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal (GDPR Art. 7/3). The recorded preference is also valid for only 24 hours; once that period passes, your preference is asked again even if you take no action, and Clarity is not loaded until you respond.

6.5. Contact form — Formspree

The contact form on our site runs through infrastructure provided by Formspree Inc. (USA). When you submit the form, the information you entered passes through Formspree's servers and is delivered to our company's email address. Formspree acts as a data processor in this process and does not use the data for its own purposes.

Formspree processes your IP address at the time of submission to prevent abuse and automated submissions. Form data is retained in Formspree's management interface for a period and is deleted regularly. Formspree is established in the USA; this transfer is explained in Section 8.

If you do not want to use the form, you can submit the same request directly by emailing info@dnl.com.tr or calling +90 538 585 62 61. In that case your data does not pass through Formspree.

6.6. Map — Google Maps (consent required)

Our contact page contains a map showing the location of our facility. This map belongs to the Google Maps service provided by Google Ireland Limited and is loaded only if you click the "Load map" button.

If you load the map:

• your IP address is transmitted to Google,
• Google may set a cookie on your device (including the `NID` cookie; this cookie is used by Google to store user preferences and for ad personalisation, and is valid for approximately six months),
• if you are signed in to a Google account, this visit may be associated with your Google account.

For this reason the map is gated behind consent. Even without loading the map, you can see our facility's full address, our phone number, and a link to an external map service on the contact page; no information is lost when the map is not loaded.

For Google's data processing practices, you may refer to the privacy policy at policies.google.com/privacy.

6.7. WhatsApp

Our site contains a link that lets you reach us via WhatsApp. Clicking this link opens your browser or the WhatsApp application; as long as you do not click it, no data is transmitted to WhatsApp and no WhatsApp cookie is set on your device.

If you write to us via WhatsApp, your message and phone number are transmitted through infrastructure of WhatsApp Ireland Limited (Meta group). Message content on this infrastructure is end-to-end encrypted; however, metadata about who communicated with whom and when is processed by Meta under its own privacy policy. Meta is the data controller for this processing; our company has no control over this metadata.

WhatsApp correspondence is stored on our company's devices and used to answer your request. If you do not want to use this channel, you may prefer email or telephone.

6.8. Managing cookies from your browser

Independently of your choice on our banner, all common browsers offer the ability to block and delete cookies. Under the privacy or site-data section of your browser's settings, you can see which cookies are stored, delete them individually or all at once, and block new cookies from being set entirely.

If you block all cookies, your cookie preference cannot be stored either, so the cookie banner will appear again on every visit. This is not a malfunction; it is the natural consequence of your preference not being storable.

7. Parties to whom personal data is transferred

We transfer your personal data to the following parties, strictly limited to the purpose stated opposite each one. We do not transfer data to any party outside this list; we never sell, rent, or disclose your personal data to third parties for advertising purposes.

We have a written data processing agreement with every party acting as a data processor, containing the elements required by Article 28 of the GDPR. These agreements govern the subject matter and duration of processing, the processor acting only on our instructions, confidentiality obligations, the technical and organisational measures the processor must take, sub-processor use being subject to our consent, deletion of data at the end of the service, and our audit rights.

8. Transfers abroad

Some of the providers listed above are established outside Türkiye. Your personal data is therefore transferred abroad on the basis of the legal mechanisms explained below. The transfer is assessed separately under each of the two regimes.

8.1. Transfer from Türkiye abroad (KVKK)

Article 9 of KVKK was substantially amended by Law No. 7499 of 12 March 2024, and the new regime entered into force on 1 June 2024. The new regulation, moving closer to the European Union model, establishes a three-tier structure for transfers: transfer to countries with an adequacy decision announced by the Board, transfer based on appropriate safeguards (binding corporate rules, standard contract, undertaking, international agreement) where no adequacy decision exists, and exceptional transfer where neither of these is possible.

The Board has not announced an adequacy decision for any country to date. Our transfers are therefore based on appropriate safeguards: a standard contract announced by the Board has been signed with the relevant providers. Transfers based on a standard contract must be notified to the Board within five business days of signature, and this notification has been made.

8.2. Transfer from the European Union to Türkiye (GDPR)

When the data of a data subject located in the European Union reaches our company, this is a transfer to a third country: the European Commission has not issued an adequacy decision for Türkiye. The transfer is therefore based on the European Commission's Standard Contractual Clauses (Implementing Decision 2021/914 of 4 June 2021), pursuant to Article 46(2)(c) of the GDPR.

The Court of Justice of the European Union's *Schrems II* ruling (C-311/18) established that standard contractual clauses alone are not sufficient; the party making the transfer must also separately assess whether the legislation of the destination country undermines the protection offered by those clauses. This assessment (a transfer impact assessment) has been carried out. The assessment took into account the nature of the transferred data — corporate contact information and technical inquiry content, containing no special category of data — and the low likelihood of this type of data attracting the interest of public authorities. In addition to the assessment, transport encryption, access restriction, and retention period limits are applied during the transfer.

8.3. Transfer to the USA

Vercel and Formspree are established in the USA. An additional mechanism applies to these transfers: on 10 July 2023, the European Commission adopted an adequacy decision for the USA under the EU–US Data Privacy Framework. This decision applies only to transfers made to organisations that have joined the Framework and are listed on the register kept by the US Department of Commerce.

Transfers to US providers that have not joined the Framework rely on the standard contractual clauses and the impact assessment described in Section 8.2.

8.4. Your right to request a copy of the transfer documentation

You may request a copy of the standard contractual clauses underlying the transfer of your data abroad. If you submit your request through the channels in Section 12, a copy with commercially sensitive economic provisions redacted will be provided to you.

9. Retention periods

We do not keep your personal data for longer than the processing purpose requires or longer than the maximum period set by the relevant legislation. The periods are set out in the table below. Where a piece of data falls under more than one row, the longer period applies.

Personal data whose retention period has expired is deleted, destroyed, or anonymised during periodic destruction cycles. Periodic destruction is carried out at intervals of at most six months, pursuant to Article 11 of the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

A request to delete a piece of data cannot be fulfilled if a statutory retention obligation listed in the table above still applies to that data. In such a case, we end its active use, restrict access to it, and continue to retain it only for the purpose the legal obligation requires; we notify you of this restriction in writing.

10. Data security measures

Article 12 of KVKK and Article 32 of the GDPR require technical and organisational measures appropriate to the nature and risk of the processing. The measures we have taken are as follows:

Technical measures: The site and all its subpages are served over HTTPS; all traffic between your browser and our server is encrypted in transit. Our server infrastructure is kept up to date and security patches are applied without delay. Access to administrative interfaces is protected by multi-factor authentication. Access to systems containing personal data is limited to personnel who need it for their role, and permissions are reviewed regularly. Access logs are kept. Backups are taken and stored encrypted. Third-party scripts are kept to a minimum; every new script added is separately assessed from a data-protection standpoint.

Organisational measures: A personal data processing inventory is kept and updated. Personnel who process personal data are informed about the categories of data they handle and their obligations. A written agreement is signed with every data processor. A personal data retention and destruction policy is in force, and periodic destruction is applied. A data protection impact assessment is carried out before a new tool or process is put into use.

In the event of a data breach: In the event of unlawful access to, acquisition, alteration, destruction, or disclosure to third parties of personal data, notification is made to the Personal Data Protection Board as soon as possible and in any case within 72 hours of becoming aware of the breach under KVKK, and to the relevant supervisory authority within the same period under Article 33 of the GDPR. If the breach poses a high risk to the rights and freedoms of data subjects, data subjects are also notified without delay (GDPR Art. 34). The notification includes the nature of the breach, the categories of data affected, its likely consequences, and the measures taken.

No security measure provides absolute protection. A completely risk-free transmission is not possible given the nature of data transmission over the internet. If you wish to send particularly sensitive information, we recommend contacting us by phone rather than by unencrypted email.

11. Rights of the data subject

11.1. Your rights under KVKK Art. 11

By applying to the data controller, you have the right to:

• a) learn whether your personal data is being processed,
• b) request information if it has been processed,
• c) learn the purpose of the processing and whether it is used in accordance with that purpose,
• ç) know the third parties, domestic or abroad, to whom the data is transferred,
• d) request correction if it has been processed incompletely or incorrectly,
• e) request its deletion or destruction within the conditions set out in the Law,
• f) request that the actions taken under items (d) and (e) be notified to the third parties to whom the data was transferred,
• g) object to a result that is to your detriment arising solely from analysis by automated systems,
• ğ) request compensation for damage you have suffered as a result of unlawful processing.

11.2. Your additional rights under the GDPR

For data subjects located in the European Union, the following rights apply in addition to those above. These rights are either entirely absent from KVKK or recognised in a more limited scope:

Right of access (Art. 15): You may request a copy of the personal data being processed, together with information on the purposes of processing, the categories of data, the recipients, the retention period, the scope of your rights, the source of the data, and any automated decision-making involved. The first copy is free of charge.

Right to erasure (Art. 17): KVKK ties the erasure request to the conditions set out in the Law. The GDPR, by contrast, lists six independent grounds for erasure; one of them is the withdrawal of consent in cases where the processing is based on explicit consent. In other words, in a processing activity based on consent, the right to erasure arises directly once you withdraw your consent.

Right to restriction of processing (Art. 18): Where you contest the accuracy of the data, where you consider the processing unlawful but do not want the data deleted, or where you need the data retained for legal defence, you may request that the data be merely stored — not subjected to any other processing — instead of being deleted. This intermediate remedy does not exist under KVKK.

Right to data portability (Art. 20): You may request to receive data processed by automated means on the basis of your consent or a contract, and which you provided yourself, in a structured, commonly used, machine-readable format, and to have it transmitted directly to another data controller. This right does not exist under KVKK.

Right to object (Art. 21): You may object to processing based on legitimate interest, citing your particular situation. If you object, it falls to us to reassess and demonstrate whether our legitimate interest outweighs your rights and freedoms; if we cannot demonstrate this, we stop the processing. If we process your data for direct marketing purposes, we stop that processing unconditionally upon your objection; no assessment is made in that case. KVKK ties the right to object only to automated decision-making, and does not include this broader right to object recognised by the GDPR.

Right to lodge a complaint with a supervisory authority (Art. 77): You may lodge a complaint directly with the data protection authority in your own country. You are not required to contact us first before lodging a complaint; however, we recommend writing to us first to speed up the resolution.

11.3. Automated decision-making and profiling

We do not make any decision about you based solely on analysis by automated systems that produces a legal effect concerning you or significantly affects you. We do not carry out ad personalisation, credit scoring, automated pricing, or any similar profiling activity. The measurement carried out on the site produces aggregate results about pages, not about individual visitors.

12. Application procedure

To exercise your rights, you may submit your request through one of the following channels:

Pursuant to the Communiqué on the Procedures and Principles of Application to the Data Controller, your application must include your first and last name, your signature if the application is in writing, your Turkish identity number if you are a Turkish citizen (otherwise your nationality and passport number), your residential or business address for correspondence, your email address and phone number if applicable, and the subject of your request. Attaching information and documents relevant to your request will help it be resolved more quickly.

Telephone conversations are not considered a formal application, as identity verification cannot be performed over the phone; the telephone channel is only for obtaining information about the process.

Response periods. Pursuant to Article 13 of KVKK, your requests are resolved as soon as possible depending on their nature, and in any case within thirty days of the request reaching us. Under Article 12 of the GDPR, the period is one month; this may be extended by a further two months in the case of complex or numerous requests, with the extension and its reasons notified to you within the first month. For data subjects located in the European Union, the shorter of the two periods applies.

Your request is resolved free of charge. If the transaction requires an additional cost, a fee set under the tariff determined by the Board may be charged; for requests under the GDPR, a reasonable fee may only be charged for requests that are manifestly unfounded or excessively repetitive.

Before responding to your application, we may ask for additional information to verify your identity, to confirm that the request genuinely comes from you. This step is to prevent your data being disclosed to an unauthorised person.

If your application is rejected, if you find our response insufficient, or if you do not receive a response within the period; you may lodge a complaint with the Personal Data Protection Board within thirty days of learning of the response and in any case within sixty days of the date of application.

13. Children's data

Our website is a corporate site providing information about engineering products for industrial facilities; it is not directed at children and its content is not of a nature that would attract children's interest. We do not knowingly collect personal data from persons under the age of sixteen.

If we learn that a person under the age of sixteen has submitted data to us, we delete that data without delay. If you believe your child has submitted data to us, you may contact us through the channels in Section 12.

14. Special categories of personal data

Article 6 of KVKK defines data relating to a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, health, sex life, criminal conviction and security measures, as well as biometric and genetic data, as special categories of personal data. The processing conditions of this article were brought closer to the structure of Article 9 of the GDPR by Law No. 7499 of 12 March 2024.

We do not process any data in this category. No form on our site requests information of this nature, and our commercial activity does not require data of this nature.

If you share information of this nature in a message you send us — for example, mentioning a health condition in a meeting request — we process this information only for the shortest period necessary to fulfil your request, do not record it, and then destroy it. We recommend that you not share information of this nature in your correspondence with us.

15. Changes to this text

We may update this text due to changes in legislation, changes in the tools we use, or changes in our business processes. The current text is always published at this address, with the last-updated date stated at the top.

If there is a material change in our processing activities — such as a new category of data beginning to be processed, a new purpose being added, or data beginning to be transferred to a new party — we will separately announce the change on our website. If the change expands a processing activity based on your consent, we will ask for your consent separately for the expanded scope; we do not automatically apply your existing consent to an expanded scope.

If you wish to see a previous version of this text, you may request it through the channels in Section 12.

16. Entry into force

This text entered into force on 9 October 2026 and is valid as of the last-updated date stated above.

In the event of any discrepancy between language versions, the Turkish version prevails.