General Data Protection Notice

Aladdin Middle East Limited – Turkey Branch Office

General Data Protection Notice

Aladdin Middle East Limited – Turkey Branch Office (hereinafter referred as the “Company”) is pleased that you have visited our website and are interested in our company, products and services. It is important to us to protect your personal data during handling throughout the entire business process pursuant to Law No. 6698 On Personal Data Protection (hereinafter referred as the “Law”) and our corporate policies and codes of practice. In the following, we explain what information Company collects and process personal data as “Data Controller” and categories of information listed below as per Article 10 of the Law:

1. Who is the data controller that this Privacy Notice applies for the data processing carried out,

2. How the Company collects personal data for its business activities and how this information is used;
3. What are the purposes of and the legal basis for the processing of personal data? For what purposes and to whom personal data can be transferred?
4. What are data subjects’ right with respect to their personal data and how their rights can be used?

1.  DATA CONTROLLER

This Privacy Notice applies for the data processing carried out by Aladdin Middle East Limited – Turkey Branch Office having its registered office at the following address: Karum İş Merkezi İran Caddesi No:21/394 Kavaklıdere Çankaya/Ankara/Turkey.

2.  WHAT ARE THE PURPOSES OF DATA PROCESSING?

The Company processes many types of data within the scope of its business activities such as gathering, processing and transferring the necessary information and data for the purposes of exploration, extraction and production of crude oil and other activities mentioned in Company’s Articles of Association. We also process personal data electronically, verbally and in paper form pursuant to Turkish Petroleum Law No.6491 and other applicable legislation, the administrative regulations of the Energy Market Regulatory Authority, the Revenue Administration and other competent public institutions and in order to honor our contractual obligations.

We process your personal data in compliance with conditions and purposes specified in Articles 5 and 6 of the Law for the purposes of the legitimate interests pursued by the Company, conducting necessary organizational studies in order to offer our services to our business partners and clients, ensuring the security of legal and commercial transactions

entered into by the Company and relevant stakeholders, in order to ensure secure communications with the public and business partners, ensuring security of Company premises, responding to public and private requests and complaints, for making arrangements for corporate organizations, legal compliance, supervision of business activities, conducting financial transactions, identifying and implementing our corporate strategies etc.

In order to obtain detailed information regarding Company’s purposes and modalities of personal data processing operations please refer to our Data Protection and Processing Policiy available at https://aladdinmiddleeast.com.

3.  WITH WHOM WE SHARE YOUR DATA?

We share your personal data with company headquarters located abroad, our business partners, affiliates, subsidiaries and common ventures for the following purposes: to implement human resources policies of our company, to ensure the legal and commercial security of our company and those who conduct business with our Company, to determine and implement the commercial and business strategies of our company with the consent of data subjects or if processing is necessary for the purposes of the legitimate interests pursued by the Company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject and in order to comply with our legal obligations with competent public authorities subject to conditions described in Articles 8 and 9 of the Law. For detailed information about Company shareholders and affiliates please visit https://aladdinmiddleeast.com

4.  Why and How we process your data?

We gather your personal data through technical and procedural methods performed in different channels such as the website, all kinds of verbal, written and electronic media and physical channels; to be able to present the products and services we offer in line with the above-mentioned purposes within the determined legal framework and to carry out our commercial activities within this framework. We further process your data within the based on the relevant legislation, contracts, our contractual obligations, commercial practice and principles of bona fide. Your personal data collected for aforementioned reasons are shared with third parties within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the Law No.6698. and section (2) and (3) of this Notice.

5. Your rights in relation to your data

The Article 11 of the Law on data protection gives you certain rights in relation to the data we hold on you. These are:

1. the right to be informed. This means that we must tell you how we use your data, and this is the purpose of this privacy notice;
2. the right of access. You have the right to access the data that we hold on you. To do so, you should make a subject access request. You can read more about this in our Code of Practice for Subject Access Request which is available on our website as outlined above or paper

copies can be obtained by mail to our correspondence address mentioned above for the attention of Data Protection Liaison Officer whose contact details are shown at the end of this privacy notice.

3. the right for any inaccuracies to be corrected. If any data that we hold about you is incomplete or inaccurate, you are able to require us to correct it;
4. the right to have information deleted. If you would like us to stop processing your data, you have the right to ask us to delete it from our systems where you believe there is no reason for us to continue processing it;
5. the right to restrict the processing of the data. For example, if you believe the data we hold is incorrect, we will stop processing the data (whilst still holding it) until we have ensured that the data is correct;
6. the right to portability. You may transfer the data that we hold on you for your own purposes;

7. the right to object to the inclusion of any information. You have the right to object to the way we use your data where we are using it for our legitimate interests;
8. the right to regulate any automated decision-making and profiling of personal data. You have a right not to be subject to automated decision-making in way that adversely affects your legal rights.

Where you have provided consent to our use of your data, you also have the unrestricted right to withdraw that consent at any time. Withdrawing your consent means that we will stop processing the data that you had previously given us consent to use. There will be no consequences for withdrawing your consent. However, in some cases, we may continue to use the data where so permitted by having a legitimate reason for doing so.

9. right to make a complaint

Finally, you can lodge a complaint with the supervisory authority responsible (KVKK) for compliance with personal data protection obligations. If your application is declined, the response is found unsatisfactory or the response is not given in due time, the data subject may file a complaint with the supervisory authority within thirty days starting from the notification of the response of the data controller, or within sixty days as of the application date, in any case. Please visit the following web site in order to obtain more information on how you can use your right to make a complaint: https://www.kvkk.gov.tr/Icerik/2063/Sikayet-Hakki

As per Article 13 of the Law, subject access requests must be made in writing and can be made in either hard copy format or electronically.

Within this framework, the applications to be made to the Company in "written" form can be done by printing out and signing this form. You must include specific details of the data you wish to see in your request as this will enable a more efficient response from the Company. We may need to contact you for further details on your request if insufficient information is

contained in the original request. Requests may be made by you personally, through a notary public or by a third party e.g. a solicitor acting on your behalf. We reserve our right to request evidence that the third party is entitled to act on your behalf if this is not provided at the same time as the request is made. You can also use your e-mail address that you previously notified to our Company and registered in our system. You can electronically sign this form with a "secure electronic signature" as defined in the Electronic Signature Law No. 5070 and send it to the registered e-mail address of the Company: [email protected]

If you have any questions or comments regarding this Cookies policy, please email [email protected] or use the subject access request form to make your request or send it to the following address: Karum İş Merkezi, İran Cad.No:21/394 Kavaklıdere - Ankara, Türkiye