Visitor Request Form

As Turkish Petroleum Off-Shore Technology Center Inc. (“Company”), we hereby inform you about the processing and protection of your personal data. Your personal data may be processed by the Company, as the data controller, in accordance with the Personal Data Protection Law No. 6698 (“Law”), within the scope described below.

1. Methods of Personal Data Collection

Your personal data may be collected automatically or non-automatically, through our affiliated units, website, identity documents, vehicle and license plate information, and camera recordings, verbally, in writing, or electronically.

Your personal data may be processed for as long as your relationship with our Company continues, within the legal retention periods, and may be stored in both digital and physical formats.

Within the scope of visitation activities carried out at our institution, your personal data are processed in accordance with the conditions set forth in Article 5 of the Law, specifically:

• (ç) Where it is necessary for the data controller to fulfill its legal obligations,

• (f) Where it is necessary for the legitimate interests of the data controller, provided that such processing does not prejudice the fundamental rights and freedoms of the data subject.

2. Purpose of Personal Data Processing

Your personal data may be processed within the scope and purposes outlined in Articles 5 and 6 of the Law, specifically for:

1. Recording visitor entries to our facilities and verifying identities,

2. Ensuring the safety of life, property, and occupational health & safety for our Company and third parties present at our facilities,

3. Storing camera recordings, managing facility operations, and maintaining security and supervision at our headquarters and units,

4. Supporting inspections and regulatory duties of authorized public institutions and auditing organizations,

5. Fulfilling requests for information and documents from judicial and/or administrative authorities,

6. Carrying out risk management and quality improvement activities,

7. Implementing all necessary technical and administrative measures for system and application data security.

3. Disclosure and Transfer of Personal Data

In accordance with Article 12 of the Law, our Company takes all necessary technical and administrative measures to ensure the security of personal data.

Personal data collected to fulfill our processing purposes may be transferred to legally authorized public institutions and private entities, when explicitly required by law or necessary to fulfill our legal obligations, in line with the data processing conditions set out in Articles 8 and 9 of the Law.

4. Rights of the Data Subject (Article 11 of the Law)

As a data subject, you may submit requests regarding the following:

• To learn whether your personal data is being processed,

• To request information if your personal data has been processed,

• To learn the purpose of processing and whether your data is used in line with that purpose,

• To know the third parties, domestically or abroad, to whom your personal data has been transferred,

• To request correction of incomplete or inaccurate personal data,

• To request deletion or destruction of your personal data in accordance with the conditions set out in the relevant legislation,

• To request notification of corrections, deletions, or destructions to third parties with whom data has been shared,

• To object to any outcome arising from automated analysis of your personal data,

• To request compensation for damages suffered due to unlawful processing of personal data.

5. Application Procedure

In accordance with Article 13 of the Law, you may exercise the above rights by submitting a written application to:

Address: Finanskent Mah. Finans Cad. No: 4 İç Kapı No: 11 Ümraniye / İstanbul

E-mail: kvkk@tp-otc.com

Our Company will finalize your application in accordance with Article 13 of the Law. If your request is rejected, the reason(s) for the rejection will be communicated to you in writing or electronically.