Personal Data Protection Law

MAST ENERGY AND TECHNOLOGY INC.

DATA PROTECTION AND PROCESSING POLICY

(Privacy Notice for Website Visitors)

Effective Date: 30 April 2026 — Version: 2.0

As MAST ENERGY AND TECHNOLOGY INC. ("MAST Energy" or "the Company"), the security of your personal data is our top priority. This Policy has been prepared to explain the principles regarding the processing of personal data belonging to individuals visiting our website www.mastenerji.com.tr ("Website") in accordance with the Law on the Protection of Personal Data No. 6698 ("KVKK" or "the Law") and relevant legislation.

This text has been drawn up in accordance with the Company’s duty to provide information as the data controller under Article 10 of the Law. By continuing to use the Website, you acknowledge that you have been informed about the data processing activities set out in this text.

1. Identity of the Data Controller

As the data controller as defined in Article 3 of the Law, the legal entity processing your personal data within the scope set out below:

Trade Name	MAST ENERGY AND TECHNOLOGY INC.
Tax Registration Number	6131765570
Address	Fatih Sultan Mah., 2375. Street No:9, 06790 Etimesgut/Ankara
Tel	(0312) 728 11 11 / +90 (850) 420 30 70
Email	info@mastenerji.com.tr
KVKK Application Email	kvkk@mastenerji.com.tr
KEP Address	mastenerjiteknoloji@hs01.kep.tr
Website	www.mastenerji.com.tr
VERBIS Registration No	[VERBIS registration number will be entered here]

2. Categories of Personal Data Processed

The following categories of personal data are processed in connection with your visit to our website and your interactions on the site:

a) Identity and Contact Information

First name, surname
Email address
Telephone number
Company/organisation name (where provided)
All information provided by you via the contact form, message form or career application

b) Transaction Security Information

IP address
Browser type and version, operating system information
Browsing history on the site, date and duration of visit
Referrer URL information
Device type (desktop/mobile) and screen resolution

c) Marketing and Preference Information

User preferences collected via cookies
On-site behaviour data (clicked links, viewed pages)

d) Professional Experience Information (for career applicants only)

Education, work experience, certification and reference information shared by you in your CV

Important Reminder

For detailed information regarding data collected via cookies, please refer to our separately published "Cookie Policy".

3. Purposes of Processing Personal Data

Your personal data specified above is processed in accordance with the general principles set out in Article 4 of the Law and the conditions stipulated in Articles 5 and 6 for the following purposes:

The operation of the Website, monitoring its performance and technical improvements
Receiving, evaluating and responding to requests submitted via the contact form
Providing information about products, services and projects
Receiving and assessing job applications (if applicable)
Ensuring website security, preventing unlawful use, and maintaining log records
Fulfilment of legal obligations (in particular, the obligation to retain traffic data under Law No. 5651)
Responding to legal requests and applications from authorised institutions and organisations
Generating statistics, conducting market analysis, and improving the user experience (using anonymised data)
Sending commercial electronic communications where you have given your explicit consent

4. Method of Data Collection and Legal Basis

Your personal data is collected automatically or semi-automatically through visits to our Website, the completion of our forms, and via cookies and similar technologies integrated into our site.

Our data processing activities are based on one or more of the following legal grounds under Article 5 of the Personal Data Protection Law:

Explicit provision in legislation (5/2-a) — for the log retention obligation required by relevant legislation, primarily Law No. 5651.
Directly related to the conclusion or performance of a contract (5/2-c) — to respond to your requests for information regarding products/services.
Compliance with a legal obligation (5/2-ç) — to meet the requirements of tax, commercial and administrative legislation.
Where it is necessary for the establishment, exercise or defence of a legal claim (5/2-e).
Where necessary for the legitimate interests of our Company, provided that this does not infringe upon your fundamental rights and freedoms (5/2-f) — for site security, performance improvement and the prevention of misuse.
Your explicit consent (5/1) — specifically for the use of cookies for marketing purposes and the sending of commercial electronic communications.

5. Transfer of Personal Data

Your personal data is transferred in accordance with Articles 8 and 9 of the Law, the amendments made by Law No. 7499 dated 2 March 2024, and the provisions of the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad, published in the Official Gazette dated 10 July 2024.

5.1. Transfer Within the Country

For the purposes set out above, your personal data may be transferred to the following parties:

Public institutions and organisations authorised by law (upon request)
Private legal entities authorised by law (upon request)
Our suppliers from whom we obtain server, hosting and cyber security services
Our business partners from whom we receive legal, financial and professional consultancy services
Our information technology infrastructure and maintenance service providers

5.2. International Transfer of Personal Data

Due to the analytics and performance cookies used on our website (such as Google Analytics) and our email delivery infrastructure, your personal data may be transferred to servers located abroad to a limited extent.

Our transfers abroad are carried out in accordance with the new provisions of Article 9 of the Personal Data Protection Law (KVKK), subject to one of the following safeguards:

Transfer to countries for which the Personal Data Protection Board has issued an adequacy decision,
Where no adequacy decision exists, the existence of a Standard Contractual Clause signed between the parties and notified to the Authority,
The existence of binding corporate rules or a written undertaking approved by the Board,
Where the above safeguards cannot be provided, under the exceptional circumstances covered by Article 9(6) of the KVKK (in particular, explicit consent).

Transparency Commitment

In the case of transfers abroad; the identity of the recipient, the purpose of the transfer, the legal basis and the safeguards applied will be communicated to you in writing upon your request.

6. Retention Period for Personal Data

Your personal data is retained in accordance with the principle set out in Article 4 of the KVKK, which states that data “shall be retained for the period prescribed by relevant legislation or for as long as necessary for the purposes for which it is processed”. The retention periods are determined in accordance with our Company’s Personal Data Retention and Destruction Policy.

Data Category	Retention Period	Legal Basis
Contact form records	2 years from the date the request is resolved	Legitimate interest
IP, log and traffic records	2 years	Article 7 of Law No. 5651
Cookie records (session)	For the duration of the browser session	Explicit consent / Legitimate interest
Cookie records (persistent)	Up to 2 years depending on the type of cookie	Explicit consent
Job application (CV)	1 year from the date of application	Explicit consent
Records of legal disputes	Relevant limitation period for legal proceedings (maximum 10 years)	Turkish Civil Code and Turkish Commercial Code

When retention periods expire, your personal data will be deleted, destroyed or anonymised.

7. Your Rights as a Data Subject

In accordance with Article 11 of the Personal Data Protection Law, you may exercise the following rights by contacting our Company in its capacity as the data controller:

To find out whether your personal data has been processed,
To request information regarding the processing of your personal data,
To find out the purpose of the processing of your personal data and whether it is being used in accordance with that purpose,
To know the third parties to whom your personal data has been transferred within or outside the country,
To request the rectification of your personal data if it has been processed inaccurately or incompletely,
To request the erasure or destruction of your personal data in accordance with the conditions set out in Article 7 of the KVKK,
To request that the actions taken in response to the above requests be notified to the third parties to whom your personal data has been transferred,
To object to a decision being made solely through the automated processing of your data that adversely affects you,
To request compensation for any damage suffered as a result of the unlawful processing of your personal data.

8. Application Methods

To exercise the rights outlined above, you may submit a request to the Data Controller in accordance with the Regulation on the Procedures and Principles for Submitting Requests to the Data Controller, using one of the following channels along with documents verifying your identity:

Written Application	By submitting a hand-signed petition in person or via a notary public to the address: Fatih Sultan Mah., 2375. Cd. No:9, 06790 Etimesgut/Ankara
KEP Address	mastenerjiteknoloji@hs01.kep.tr (via KEP to KEP with a secure electronic signature)
Email (registered)	kvkk@mastenerji.com.tr — From your email address previously registered in the company’s systems, using a secure electronic signature or mobile signature
Application Form	By completing the "Data Subject Request Form" available on the Data Protection page of our website

Your application must clearly state your first name, surname, Turkish ID number (passport/ID number for foreign nationals), residential or business address for service of notice, email address for notification (if applicable), telephone and fax numbers, and the subject of your request.

Your applications will be processed free of charge as soon as possible and within a maximum of thirty (30) days, depending on the nature of the request. However, if the process incurs additional costs, a fee in accordance with the tariff determined by the Personal Data Protection Board may be charged.

In the event that your application is rejected, the response is deemed insufficient, or no response is provided within the prescribed timeframe, you have the right to lodge a complaint with the Personal Data Protection Board within thirty (30) days of receiving the response and, in any event, within sixty (60) days of the date of your application.

9. Measures Regarding Data Security

In accordance with Article 12 of the Personal Data Protection Law (KVKK), our company takes the necessary technical and administrative measures, commensurate with the level of technological advancement, to prevent the unlawful processing and access to personal data and to ensure its protection.

The main measures taken in this context include: encryption, the implementation of access authorisation matrices, firewalls, penetration testing, the keeping of log records, staff training, the signing of confidentiality agreements with data processors, and regular internal audits.

10. Updating the Policy

This Policy may be updated in line with changes in legislation or our business processes. Any changes take effect on the date they are published on the Website. We recommend that you review the current version of the Policy at regular intervals.

MAST ENERGY AND TECHNOLOGY INC.

Data Controller