1. PURPOSE

RAYVAG Wagon Industry and Trade Inc. (“RAYVAG” or “the Company”), we have placed great importance on the protection of personal data pertaining to all natural persons whose personal data we process through any means in the course of our commercial activities, as well as on the full compliance with our obligations under the Law on the Protection of Personal Data No. 6698 (“KVKK” or “the Law”), effective as of the date the Law entered into force.

The Personal Data Protection, Processing, and Privacy Policy (“Policy”) has been prepared to inform you about the processes involved in the collection, processing, retention, and transfer of personal data by RAYVAG, as well as the principles we adhere to. This document is consistent with the policies in effect within RAYVAG. Information that is not required to be disclosed to the public and is not in the public interest has not been included.

2. SCOPE

This policy applies to all personal data stored in digital or analog data recording systems—for which RAYVAG determines the purposes and means of processing and is responsible for their establishment and management—and obtained from data subjects through automated or non-automated methods. These provisions apply to RAYVAG employees, job applicants, interns, suppliers and customers with whom RAYVAG has a business relationship—including their employees and authorized representatives—as well as visitors, subcontractor employees, and RAYVAG

This covers all personal data storage and destruction activities for which RAYVAG is recognized as the data controller.

RAYVAG’s personal data processing activities, carried out in its capacity as a data processor, are governed by the provisions of the Law regarding the obligations of data processors.

3. REFERENCES

• Law No. 6698 on the Protection of Personal Data (including amendments made by Law No. 7499)

• Regulation on the Registry of Data Controllers

• Regulation on the Erasure, Destruction, or Anonymization of Personal Data

• Regulation on the Procedures and Principles Governing the Transfer of Personal Data Abroad

• Communication on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Provide Information

• Communication on the Procedures and Principles for Filing Requests with the Data Controller

• Principle Decisions and Decisions of the Personal Data Protection Board

• Board Decisions Regarding Adequate Measures to Be Taken by Data Controllers in the Processing of Special Category Personal Data

• Provisions in other legislation regarding personal data and its processing

4. DEFINITIONS AND ABBREVIATIONS

5. GENERAL PRINCIPLES GOVERNING THE PROCESSING OF PERSONAL DATA

Personal data is processed in accordance with the general principles set forth in the Act.

5.1. Compliance with the Law and Principles of Integrity

In accordance with this principle, personal data processing activities are carried out in compliance with all relevant legislation—primarily the Constitution and the Personal Data Protection Law (KVKK)—and in accordance with the principles of good faith. RAYVAG takes the necessary measures to ensure transparency and accountability.

5.2. Accuracy and Timeliness When Necessary

RAYVAG takes the necessary measures to ensure the accuracy of personal data at the time of collection. When reprocessing is required, it makes every reasonable effort to ensure the data remains up-to-date. It establishes appropriate methods to enable data subjects to correct or update their personal data and makes every effort to ensure access is provided easily and at minimal cost.

5.3. Processing for Specific, Clear, and Legitimate Purposes

Personal data shall be processed only for specified, explicit, and legitimate purposes. Personal data shall not be processed for purposes that are contrary to applicable laws and regulations or incompatible with the Company’s business activities. All personal data processing activities shall be conducted in a transparent and accountable manner.RAYVAG’s purposes for processing personal data include the manufacture, maintenance, repair, and overhaul of railway locomotives and rolling stock; the management of tendering and contractual processes; the maintenance of customer and supplier relationships; the management of human resources and personnel records; the fulfilment of occupational health and safety obligations; ensuring the security of physical premises, including visitor records and CCTV footage; the management of quality assurance and certification processes; the execution of accounting and financial operations; the handling of legal matters and ensuring compliance with applicable laws and regulations; responding to requests from administrative and judicial authorities; and ensuring information security.

5.4. Relevance to the Purpose for Which They Are Processed, and Being Limited and Proportionate

Every effort is made to ensure that the personal data collected or processed is kept to a minimum in terms of both quantity and detail. When collecting personal data, the purposes for which it is processed are taken into account; personal data that is unrelated to the purpose or not necessary to achieve the purpose is not processed. Only the minimum amount of data necessary to achieve the purpose is processed. Personal data is not collected or retained for potential future needs.

5.5. Retained for the Period Specified in the Relevant Legislation or as Necessary for the Purpose for Which They Were Processed

The maximum periods for which personal data may be retained for the purpose for which it is processed are specified. If the relevant legislation stipulates a retention period, the data is retained for that period; otherwise, it is retained for as long as necessary for the purpose for which it is processed.

When determining the maximum retention period for personal data necessary for the purpose for which it is processed;

a) The period generally accepted as standard practice in the sector in which the data controller operates, within the scope of the purpose of processing the relevant category of data,

b) The period during which the legal relationship established with the data subject will continue, which necessitates the processing of personal data falling within the relevant data category,

c) The period during which the legitimate interest that the data controller will derive, depending on the purpose of processing the relevant category of data, will be valid in accordance with the law and the principles of good faith,

d) The period during which the risks, costs, and liabilities arising from the retention of the relevant data category will continue to exist under the law, depending on the purpose of processing,

e) Whether the maximum period to be determined is suitable for ensuring that the relevant data category is accurate and, where necessary, kept up to date,

f) The period during which the data controller is required to retain personal data falling within the relevant data category pursuant to its legal obligation,

(g) The statute of limitations period established by the data controller for asserting a right related to personal data falling within the relevant data category,

is taken into account.

5.6. Conditions for the Processing of Personal Data

The conditions for processing personal data are governed by the Law. Sensitive personal data and non-sensitive personal data are treated separately with regard to the conditions for processing.

Data regarding an individual’s race, ethnic origin, political views, philosophical beliefs, religion, denomination, or other beliefs; attire; membership in associations, foundations, or labor unions; health; sex life; criminal convictions; and security measures, as well as biometric and genetic data, are considered special-category personal data.

5.6.1. Conditions for the Processing of Non-Sensitive Personal Data

The basic rule is that personal data must not be processed without the explicit consent of the data subject.

The law sets forth the conditions under which personal data that is not of a sensitive nature may be processed even without the data subject’s explicit consent in certain circumstances:

a) Where expressly provided for by law,

b) Where it is necessary to protect the life or physical integrity of a person who, due to actual impossibility, is unable to express consent, or whose consent is not legally valid, or of another person,

(c) Provided that it is directly related to the conclusion or performance of a contract, the processing of personal data belonging to the parties to the contract is necessary,

(d) It is necessary for the data controller to fulfill its legal obligation,

e) The information has been made public by the individual concerned,

f) Data processing is necessary for the establishment, exercise, or protection of a right,

g) The processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not infringe upon the fundamental rights and freedoms of the data subject.

5.6.2. Conditions for the Processing of Special Category Personal Data

The processing of special-category personal data is prohibited. However, the processing of such data;

a) The data subject’s explicit consent,

b) Where expressly provided for by law,

c) Where a person is unable to express consent due to actual impossibility, or where the person’s consent is not legally valid, and it is necessary to protect the life or physical integrity of that person or another person,

d) It relates to personal data that the data subject has made public and is consistent with the data subject’s intention to make such data public,

e) It is necessary for the establishment, exercise, or protection of a right,

f) When necessary for the protection of public health, the provision of preventive medicine, medical diagnosis, treatment, and care services, as well as the planning, management, and financing of health services, by persons or authorized institutions and organizations subject to a duty of confidentiality,

g) It is necessary to fulfill legal obligations in the areas of employment, occupational health and safety, social security, social services, and social assistance,

h) Foundations, associations, and other nonprofit organizations or entities established for political, philosophical, religious, or labor union purposes may, provided that they comply with the applicable legislation and their stated purposes, limit their activities to their specific fields of operation, and do not disclose such information to third parties, direct their activities toward their current or former members and affiliates, or toward individuals who are in regular contact with such organizations and entities,

This is possible under such circumstances. In addition, adequate measures determined by the Board are taken when processing special-category personal data.

5.7. Retention (Storage) of Personal Data

The storage of personal data is a personal data processing activity and is carried out in accordance with the conditions for processing personal data.

Personal data may be stored only in the appropriate medium or media when storage is necessary. If other processing of personal data, other than storage, does not require the data to be retained, the personal data is destroyed.

Personal data can be obtained in both physical and digital environments, and it can be transferred from a physical environment to a digital one, or from a digital system to a physical environment. The same rules apply to personal data processing activities in both environments, to the extent appropriate.

5.7.1. Digital Environments

Under this policy, the most common digital environments where personal data—whether collected digitally or converted to digital form at a later stage—is stored and can be processed by information systems include:

a) Servers (devices capable of storing digital personal data and used to provide services, such as databases, email, domain names, ERP/MRP systems, etc.),

b) Network and information security devices (routers, firewalls, switches, etc.),

c) Personal computers (desktops, laptops, etc.),

d) Mobile devices (cell phones, tablets, etc.),

e) Portable storage devices (removable USB drives, CDs/DVDs, memory cards),

f) Cloud,

g) Card readers, employee time-and-attendance systems, security cameras.

5.7.2. Physical Environments

Media containing personal data obtained in a physical environment or converted from a digital environment to a physical environment:

a) Any type of paper on which personal data may be written using writing instruments such as forms or ledgers, or that may contain personal data obtained through printing (including personnel files, visitor logs, and occupational safety and health records),

b) Any medium other than paper that is suitable for storing personal data without digitization (cards, plaques, etc.).

This policy does not apply to personal data located in physical environments that are not part of a data recording system.

5.7.3. Determining Storage Environments

When determining the storage media for personal data that must be retained, the minimum number of media required is used. If the original medium on which the personal data was collected is suitable for storage, the data is retained in its original form on that medium. If the original form is not suitable for storage, does not allow for retention throughout the retention period, makes processing difficult, or if the data is at risk, a decision may be made to store it on another medium.

5.7.4. Storage of Personal Data by Parties Other Than the Data Controller

It is also possible for personal data to be stored in environments not under the control of the data controller, where management and oversight are exercised by other natural or legal persons. In such cases, certain conditions must be met depending on whether the environment is located within or outside the country. Compliance with transfer conditions based on the location where the personal data was collected may also be required. In these cases, the transfer rules set forth under Section 5.8 apply.

5.8. Transfer of Personal Data

Personal data may be transferred to other data controllers or data processors within the country or abroad. Such transfers are carried out in accordance with the law.

Personal data may be transferred to the relevant authorities without any obligation to provide information and without requiring explicit consent, if requested by an authorized institution or organization pursuant to Article 28(1) of the Personal Data Protection Law.

Personal data may also be transferred to authorized public institutions (such as ministries and administrative bodies under the Office of the President) upon request in cases explicitly specified by law, within the purposes and limitations set forth by law, provided that the obligation to inform the data subject is fulfilled.

5.8.1. Transfer of Personal Data Within the Country

Personal data may not be transferred within the country to parties other than the data controller without the explicit consent of the data subject.

Personal data may be transferred without the explicit consent of the data subject if one of the conditions specified in the third paragraph of Article 6 is met, provided that adequate safeguards are in place, as set forth in the second paragraph of Article 5 of the Law. In the transfer of special-category personal data, the measures prescribed by the Board must also be taken. Provisions in other laws regarding the transfer of personal data remain in full force and effect.

5.8.2. Transfer of Personal Data Abroad

Subject to compliance with the general principles governing the processing of personal data, the transfer of personal data abroad and its storage abroad are permitted only within the framework of the phased regime set forth in Article 9 of the Personal Data Protection Law, as amended by Law No. 7499, and only if certain conditions are met.

Decision on Eligibility

Personal data may be transferred abroad provided that one of the conditions specified in Articles 5 and 6 of the Law is met and there is an adequacy decision issued by the Board—and published in the Official Gazette—regarding the country to which the data will be transferred, the sectors within that country, or international organizations.

Appropriate Safeguards

In the absence of a decision on adequacy, personal data may be transferred abroad provided that one of the conditions set forth in Articles 5 and 6 of the Law is met, and provided that the data subject has the opportunity to exercise their rights and seek effective legal remedies in the country to which the transfer is made, and provided that the parties ensure one of the following appropriate safeguards:

a) The existence of an agreement—which does not constitute an international treaty—between public institutions and organizations abroad or international organizations and public institutions and organizations in Turkey, or professional organizations with the status of public institutions, and the Board’s authorization of the transfer,

b) The existence of binding corporate rules—approved by the Board and containing provisions regarding the protection of personal data—to which companies within a group of undertakings engaged in joint economic activities are required to comply,

c) Entering into a standard contract with the data recipient that includes the matters announced by the Board, such as data categories, the purposes of data transfer, recipients and groups of recipients, technical and administrative measures to be taken by the data recipient, and additional measures taken for special-category personal data,

d) The existence of a written undertaking containing provisions that ensure adequate protection, and authorization for the transfer by the Board.

A standard contract must be reported to the Authority by the data controller or data processor within five business days of its signing. In the event of a violation of this notification requirement, an administrative fine may be imposed pursuant to Article 18 of the KVKK.

Emergencies

In the absence of a decision on adequacy and one of the appropriate safeguards, personal data may be transferred abroad only on an occasional basis and only if one of the following conditions is met. Transfers that are irregular, occur once or a few times, are not ongoing, and do not fall within the ordinary course of business are considered occasional:

a) The data subject’s explicit consent to the transfer, provided that the data subject has been informed of the potential risks,

b) The transfer is necessary for the performance of a contract between the data subject and the data controller or for the implementation of pre-contractual measures taken at the data subject’s request,

c) The transfer is necessary for the conclusion or performance of a contract between the data controller and another natural or legal person for the benefit of the data subject,

d) The transfer must be necessary for an overriding public interest,

e) Where the transfer of personal data is necessary for the establishment, exercise, or protection of a right,

f) Where the transfer of personal data is necessary to protect the life or physical integrity of a person who, due to actual impossibility, is unable to express consent or whose consent is not legally valid, or of another person,

g) The transfer of data from a registry that is open to the public or to persons with a legitimate interest, provided that the conditions required by applicable law for accessing the registry are met and the person with a legitimate interest requests such access.

Data controllers and data processors are also required to comply with the safeguards provided for in the Act with respect to subsequent transfers of personal data transferred abroad.

5.9. Destruction of Personal Data

Personal data is destroyed once the circumstances requiring its retention no longer exist.

5.9.1. Disposal Methods

Delete

The purpose of deleting personal data is to ensure that such data becomes inaccessible and cannot be reused by the relevant users in any way. Personal data stored in electronic form that can be deleted is erased through the deletion process; measures are taken to prevent its recovery after deletion. For personal data stored in electronic form that cannot be deleted, the storage medium itself is destroyed. For documents stored on paper or similar physical media, the deletion process is carried out by covering the personal data with a dark color that cannot be removed (redaction).

Destruction

This refers to the destruction of media—such as documents, files, CDs, floppy disks, and hard drives—on which personal data is stored, in a manner that renders the data irretrievable and unusable. If the data can be deleted from digital media, the destruction method is not used. For optical media where deletion is not possible, the method of breaking the media into very small pieces is applied.

Anonymisierung

The anonymization of personal data refers to the process of rendering personal data such that it cannot under any circumstances be associated with an identified or identifiable natural person, even if matched with other data. Personal data is rendered incapable of being associated with an identified or identifiable natural person, even through the use of techniques appropriate to the storage medium and the relevant field of activity—such as the reversal of the data by the data controller or third parties and/or the matching of the data with other data.

5.9.2. Retention Periods

For personal data that ceases to exist upon the expiration of retention periods, the destruction period is a maximum of six months.

Personal data processed solely on the basis of explicit consent must be destroyed within 30 days if the data subject withdraws that consent. For personal data processed solely on the basis of explicit consent but for which destruction is required for a reason other than the withdrawal of consent, the destruction period is six months.

5.9.3. Periodic Destruction

Personal data for which the projected retention period expires before the scheduled retention period ends is deleted without waiting for the scheduled retention period.

The periodic destruction period is six months. Periodic destruction may be spread out over a reasonable period of time, depending on the types and quantities of personal data to be destroyed.

5.10. Security Measures

5.10.1. The Objectives of Security Measures

RAYVAG;

a) To prevent the unlawful processing of personal data,

b) To prevent unlawful access to personal data,

c) To ensure the protection of personal data,

It takes all necessary technical and administrative measures to ensure an appropriate level of security for this purpose.

5.10.2. Personal Data Processing Inventory

An inventory of personal data processing activities carried out within RAYVAG has been compiled. All activities have been reviewed, and the necessary changes have been made. The inventory is updated as needed.

5.10.3. Education

RAYVAG conducts the necessary training activities within its own organization to raise awareness about the protection of personal data and to safeguard the rights and interests of data subjects. RAYVAG ensures that individuals who process personal data are aware that they may not disclose the personal data they have obtained to others and that this obligation continues even after they leave their positions.

5.10.4. Audit

Compliance with established rules is monitored through periodic or ad hoc audits conducted either internally or by external parties.

5.10.5. Data Breach

The procedures and principles to be followed in the event of a data breach have been established. If personal data processed by the organization is obtained by others through unlawful means, this situation must be reported to the Board as soon as possible—and within 72 hours in accordance with the principles established by the Board—and also to the data subjects within a reasonable timeframe.

5.11. Informing the Data Subject

RAYVAG aims to inform data subjects whose personal data is processed in a process-based, understandable, and sufficiently detailed manner, in compliance with the law, using appropriate methods, and within a reasonable timeframe. Even when the processing of personal data is subject to explicit consent, RAYVAG places importance on ensuring that the data subject is accurately informed about the consequences of giving such consent.

5.11.1. Request by the Data Subject

Data subjects must first contact the data controller to exercise their rights regarding their personal data. According to Article 14 of the Law, complaints cannot be filed directly with the Personal Data Protection Board.

Under the law, the data subject;

a) To learn whether their personal data has been processed,

b) To request information regarding the processing of their personal data, if it has been processed,

c) To learn the purpose of the processing of their personal data and whether it is being used in accordance with that purpose,

d) To know the third parties to whom their personal data has been transferred, whether within the country or abroad,

e) To request the correction of their personal data if it has been processed incompletely or incorrectly,

f) To request the erasure or destruction of their personal data if the grounds for processing no longer exist,

g) To request that the third parties to whom their personal data has been transferred be notified of the actions taken pursuant to subparagraphs (e) and (f),

h) To object to a decision made solely through the automated processing of their data that results in a negative outcome for them,

i) To request compensation for damages suffered as a result of the unlawful processing of their personal data

They may exercise these rights.

Data subjects may submit their requests in accordance with the Communiqué on the Procedures and Principles for Submitting Requests to the Data Controller; they may do so in writing or by using a registered electronic mail (KEP) address, a secure electronic signature, a mobile signature, or an email address previously provided to RAYVAG by the data subject and registered in RAYVAG’s system.

In this regard, interested parties may fill out the application form available at https://rayvag.com.tr/en/home/kvkk-privacy-notice/ ; they may then submit a signed copy of the form, along with identification documents, in person to the address “Adana Hacı Sabancı Organized Industrial Zone (OSB), Celal Bayar Boulevard No. 28, Sarıçam, 01400 Adana,” either in person, by certified mail, or through a notary public; or they may submit the form with a secure electronic signature to the registered email address rayvag@hs02.kep.tr

5.11.2. Circumstances Under Which the Data Controller Cannot Be Contacted

Data subjects may not exercise their right to lodge a complaint with the data controller—except for the right to request compensation for damages—in the following cases:

a) The processing of personal data is necessary for the prevention of a crime or for a criminal investigation,

b) The processing of personal data that the data subject has made public,

c) Where the processing of personal data is necessary for the performance of supervisory or regulatory duties, or for disciplinary investigations or proceedings, by public institutions and organizations, as well as professional associations with the status of public institutions, acting pursuant to the authority granted by law,

(c) The processing of personal data is necessary to protect the State’s economic and financial interests in matters related to the budget, taxes, and financial affairs.

5.11.3. Responding to Inquiries

Applications from interested parties are carefully reviewed and responded to as soon as possible—and in any case within a maximum of 30 days—either in accordance with the applicant’s request or by another method deemed appropriate. No fee is charged for the response. However, if the process incurs additional costs, the applicant may be required to pay the fee specified in the schedule established by the Board.

In order to fulfill the applicant’s requests, the applicant may be asked to provide proof of identity or to submit additional information or documents for another reason.

5.12. Data Controller Registry (VERBİS)

Data Controller Registry (VERBİS)

5.13. Updates to the Policy, Their Disclosure, and Retention

The Policy is updated as necessary in accordance with applicable regulations. Since the Policy is intended for public access, it is published on the Company’s website (www.rayvag.com.tr). The Policy is maintained by Rayvag.

5.14. Situations Not Covered by the Policy

In the event of disputes not addressed in this Policy or arising from the implementation of this Policy, the relevant sources will be consulted. The applicable legal regulations in force regarding the processing and protection of personal data will apply.

6. OTHER MATTERS

In the event of any inconsistency between the provisions of the KVKK and other relevant legislation and this Policy, the provisions of the KVKK and other relevant legislation shall take precedence.

In the event of any changes to the Policy, the relevant provisions of the Policy will be updated accordingly.

7. SPECIAL CIRCUMSTANCES AND EXCEPTIONS

There isn’t any.

8. AMENDMENTS AND REPEAL

This Policy is reviewed and updated by RAYVAG.

9. ENFORCEMENT

This Policy, prepared by RAYVAG, entered into effect on July 14, 2026.

10. IMPLEMENTATION

RAYVAG is responsible for implementing this document.

11. DISTRIBUTION

The policy is published on the RAYVAG website (www.rayvag.com.tr) and communicated to third parties and Company employees.