KVKK Information Notice

1. Identity of the Data Controller

Tuna Project Global Ticaret Anonim Şirketi (the "Company") acts as data controller under Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") for personal data processed through the website industrial.tunaproject.com (and other domains used for the Tuna Industrial Platform) and through the contact, demo-request and lead processes operated on it.

Registry identifiers: MERSIS 0861109944300001 · Tax ID 8611099443 (Karşıyaka Tax Office) · Registered address: Fuat Edip Baksı Mah. Anadolu Cad. No: 175/1 D: 13, Bayraklı / İzmir 35540, Türkiye · KEP: tunaproject@hs01.kep.tr · Requests: office@tunaproject.com · General: info@tunaproject.com, +90 850 532 32 44.

Regarding Tuna Project LLC (US): The group includes a Florida-registered entity, Tuna Project LLC. For this website and Tuna Industrial Platform activities, Tuna Project LLC is not a data controller, and sharing of your personal data with Tuna Project LLC is not currently envisaged. Should such a transfer become necessary in the future, the conditions in Article 9 of the KVKK will be met and this notice will be updated.

2. Personal Data Processed and Collection Methods

Depending on how you interact with the website, the following may be processed: identity and contact data (name, e-mail, phone, company, title/role); request/message content (solution area of interest, factory/sector information, free-text you choose to provide); commercial-evaluation data (lead notes, interaction history, request status); technical and security data (IP address, browser/device information, request metadata, timestamps, anti-abuse signals); cookie and measurement data (site usage/navigation data, session identifiers, Google Analytics 4 measurement data — see the Cookie Policy).

Data is collected electronically (web forms, e-mail, cookies, technical logs) by automated and partly automated means.

Demo access: The Tuna Industrial Platform demo uses synthetic/simulated factory data and contains no real customer data. Whether demo access will be public or request-based (lead-gated) has not yet been decided. If request-based access is used, the identity and contact data you provide in the demo-request form are processed under the "identity and contact" and "request/message content" categories above.

3. Purposes of Processing

Responding to contact and information requests; scheduling and running demos; evaluating commercial opportunities for the Tuna Industrial Platform and preparing proposals and pilots; managing lead follow-up and commercial communication; ensuring the security of the website and infrastructure and preventing abuse; analysing site usage and improving content (subject to your cookie choices); fulfilling legal obligations and protecting rights in potential disputes.

4. Legal Grounds for Processing (KVKK Art. 5)

The following mapping is a draft and must be confirmed by counsel: contract-related purposes (responding to requests, scheduling demos, preparing proposals/pilots) — Art. 5/2-(c) (directly related to the conclusion or performance of a contract) and/or Art. 5/2-(f) (legitimate interests of the controller); lead follow-up and commercial-communication management — Art. 5/2-(f); site security, logging, abuse prevention — Art. 5/2-(f) and, where applicable, Art. 5/2-(ç) (legal obligation); analytics/measurement cookies — Art. 5/1 explicit consent (obtained via the cookie banner for non-essential cookies); marketing electronic messages — Art. 5/1 explicit consent (plus İYS approval under Law No. 6563); legal obligations — Art. 5/2-(ç).

5. Transfers of Personal Data

Your personal data may be transferred only to the extent required by the relevant purpose and in accordance with KVKK Art. 8 (domestic) and Art. 9 (international) to: hosting/infrastructure providers ([PROVIDER(S) — PENDING]); the analytics provider Google (Google Analytics 4), which may process data on its own infrastructure including servers abroad — this transfer occurs only if you consent to analytics/measurement cookies; an internal tracking/CRM tool ([TOOL — PENDING]); legal, accounting and audit advisers as necessary; and competent public authorities upon a lawful request.

International transfers: Transfers abroad may occur in the context of the analytics and infrastructure services above and are carried out in accordance with the conditions of KVKK Art. 9 (explicit consent or other prescribed safeguards). The definitive transfer inventory and mechanism will be completed during legal review.

6. Retention Periods

Your personal data is retained for as long as necessary for the purpose of processing and taking into account the statutory limitation/retention periods. As a draft principle: non-converting contact/demo-request records — [PERIOD — PENDING, e.g. 1–2 years] after the request is closed; lead/commercial-discussion records — [PERIOD — PENDING] after last contact; records that become a contractual relationship — for the applicable limitation period after the relationship ends (as a rule up to 10 years); server/security logs — [PERIOD — PENDING, e.g. 6–24 months]; cookie/analytics data — for the lifetime of the relevant cookie (see the Cookie Policy). At the end of the period, data is deleted, destroyed or anonymised.

7. Your Rights as a Data Subject (KVKK Art. 11)

You have the right to: learn whether your data is processed; request information if it is; learn the purpose and whether it is used accordingly; know the third parties to whom it is transferred domestically or abroad; request rectification of incomplete/incorrect data; request erasure/destruction under the conditions of Art. 7; request that rectification/erasure be notified to third parties; object to a result to your detriment arising solely from automated analysis; and claim compensation for damage arising from unlawful processing.

8. How to Exercise Your Rights

Send your request, in accordance with the Communiqué on the Procedures and Principles for Application to the Data Controller, by e-mail to office@tunaproject.com (from the e-mail address registered in our systems) or in writing / via KEP to the Company's registered address with a wet-signed petition or to tunaproject@hs01.kep.tr with a secure electronic signature. Your request must clearly include information verifying your identity and the subject of your request. The Company will conclude your request free of charge as soon as possible and within 30 days at the latest; where the process entails an additional cost, the tariff set by the Board may apply. If your request is rejected, you retain the right to complain to the Personal Data Protection Board.

9. Counsel / KVKK Adviser Checklist (to complete before publication)

Legal-basis matrix (§4) finalised against the production data flow; transfer inventory (§5) — all processors and the international-transfer mechanism; retention schedule (§6) — definitive periods per category; VERBİS registration-obligation assessment (the Company has no VERBİS registration); alignment with the cookie banner / explicit-consent flow (COOKIE_POLICY.md); İYS approval if marketing messages will be sent; assurance via form design that no special-category data is processed; publication date and version number added.