KVKK Privacy Notice

RAYVAG VAGON SAN. VE TİC. A.Ş.

PRIVACY NOTICE REGARDING THE PROCESSING OF EMPLOYEES’ PERSONAL DATA

This document has been prepared in accordance with Article 10 of the Personal Data Protection Law No. 6698 and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Provide Information.

This text has been prepared for your information. In accordance with the Data Protection Board’s Principle Decision No. 2026/347 dated February 18, 2026, the privacy notice and the declaration of explicit consent are prepared separately. For the limited number of data processing activities requiring explicit consent, an “Employee Explicit Consent Form” will also be provided to you as a separate document.

1. IDENTITY OF THE DATA CONTROLLER

Your personal data is processed by RAYVAG Vagon Sanayi ve Ticaret A.Ş. (“RAYVAG” or “the Company”), acting as the data controller, within the scope described below.

Title	RAYVAG Vagon Sanayi ve Ticaret A.Ş.
Address	Adana Hacı Sabancı Organize Sanayi Bölgesi, OSB Celal Bayar Bulvarı No: 28, Sarıçam / 01400 ADANA
MERSIS No.	0734058146400013
Tax Identification Number	7340581464
KEP Address	rayvag@hs02.kep.tr
Website	www.rayvag.com.tr
VERBİS Contact Person	Pınar Gürsubaşı – Human Resources Manager – pinar.gursubasi@rayvag.com.tr – 0539 597 55 08

2. SCOPE

This Privacy Notice applies to employees working under an employment contract at RAYVAG, as well as interns and students enrolled in apprenticeship or vocational training programs.

The obligation to provide information must be fulfilled in all cases—regardless of the legal basis for the data processing activity—and before the processing of personal data begins.

3. CATEGORIES OF PERSONAL DATA PROCESSED

Data Category	Personal Data Covered
Identity	First and Last Name, Turkish ID Number, Place and Date of Birth, Parents’ Names, Gender, Marital Status, Copy of Population Registry Card/ID Card, Extract from the Population Registry, Signature
Contact	Residential address, cell phone/landline number, personal and business email addresses, and contact information for a person to be reached in an emergency
Personal Information	Employment contract, Social Security Institution (SGK) registration number, employment start and end notifications, employment history, education and degree information, certificates and qualification documents, job title, leave and absence records, performance and disciplinary records, military service status, reference information
Finance	Bank account/IBAN information, salary and benefits information, pay stubs and payroll records, enforcement/garnishment and alimony deduction information, advance and per diem records, minimum subsistence allowance/tax deduction information
Information About Family and Close Relatives	Spouse and child information, as well as the first and last names and identification information of dependents (only to the extent required by legal obligations and ancillary rights)
Physical Space Security	Employee access card logs, on-site closed-circuit television (CCTV) footage, vehicle license plate records, and parking records
Transaction Security	Corporate usernames, system and application access/authorization logs, corporate Internet and network traffic logs, corporate email traffic logs, ERP/MRP transaction logs
Mesleki Deneyim	Önceki iş tecrübesi, alınan eğitimler, eğitim katılım ve sınav kayıtları, mesleki yetkinlik ve operatör belgeleri (kaynakçı sertifikası, forklift/vinç operatörlüğü vb.)
Visual and Audio Recordings	Passport-style photos added to the personnel file, as well as photos and video recordings taken for corporate events and promotional purposes
Legal Proceedings	Information on litigation and enforcement case files, correspondence with government agencies, and records of formal notices and service of process
Health Information (Sensitive)	Pre-employment and periodic medical examination reports, fitness-for-work reports, sick leave reports, records of work-related accidents and occupational diseases, disability status and reports, blood type, hearing/respiratory/eye examination results, and vaccination and immunization records
Criminal Convictions and Security Measures (of a Special Nature)	Criminal record only in cases where relevant legislation requires it for specific positions
Other Special Categories of Data	Information on union membership (only for purposes related to collective bargaining agreements and union dues deductions)

At RAYVAG, time and attendance tracking is not performed using biometric identification systems such as fingerprint, facial recognition, palm vein scanning, iris, or retina scanning. Attendance tracking is carried out using encrypted card/RFID-based systems and paper-based attendance sheets, in accordance with the Personal Data Protection Board’s Principle Decision No. 2026/921 dated April 29, 2026.

4. PURPOSES AND LEGAL BASES FOR THE PROCESSING OF PERSONAL DATA

Your personal data is processed for the following purposes and based on the legal grounds indicated next to them:

Purpose of Processing	Legal Basis	Description
The establishment and performance of employment contracts; payment of wages and benefits; and leave and attendance management	Article 5(2)(c) of the KVKK	Being directly related to the formation or performance of the contract
Creation and storage of personnel files, SGK/İŞKUR filings, tax and payroll obligations, and maintenance of statutory books and records	Article 5(2)(ç) of the KVKK	Compliance with the data controller’s legal obligations (Article 75 of the Labor Code No. 4857, Law No. 5510, Tax Procedure Code No. 213, and the Turkish Commercial Code No. 6102)
Compliance with occupational health and safety obligations, pre-employment and periodic medical examinations, procedures for work-related accidents and occupational diseases, and emergency and evacuation planning	Article 6(3)(f) of the KVKK	It is mandatory for compliance with legal obligations in the areas of employment, occupational health and safety, and social security (Occupational Health and Safety Law No. 6331)
Conducting vocational training, orientation, competency assessment, and certification processes	Article 5(2)(ç) and Article 5(2)(f) of the KVKK	Legal obligation and RAYVAG’s legitimate interest
Planning of railway vehicle manufacturing, maintenance, repair, and overhaul activities; execution of production and quality processes; and maintenance of traceability records (ECM, TSI, EN 15085, etc.)	Article 5(2)(ç) and Article 5(2)(f) of the KVKK	Legal obligation and legitimate interest
Ensuring physical security, controlling access to the facility, conducting video surveillance, and protecting workplace and production assets	Article 5(2)(f) of the KVKK	The legitimate interests of the data controller (including measures under Law No. 5188), provided that this does not infringe upon the fundamental rights and freedoms of the data subject
Ensuring information security, maintaining network and system logs, authorization and access control, and investigating cybersecurity incidents	Article 5(2)(ç) and Article 5(2)(f) of the KVKK	Legal obligation (Law No. 5651) and legitimate interest
Denetim, iç kontrol, etik ve disiplin süreçlerinin yürütülmesi, kalite ve müşteri denetimlerine yanıt verilmesi	Article 5(2)(f) of the KVKK	Legitimate interest
Submission of personnel competency certificates to the relevant authority or client as required by the tender, contract, or client	Article 5(2)(ç) and Article 5(2)(c) of the KVKK	Legal Obligations and Contract Performance
Exercising the right to defense in legal disputes, conducting litigation and enforcement proceedings, and responding to requests from government authorities	Article 5(2)(e) and Article 6(3)(d) of the KVKK	Necessary for the establishment, exercise, or protection of a right
Transactions Related to Dues Deductions Arising from Union Membership and Collective Bargaining Agreements	Article 6(3)(f) of the KVKK	Legal obligations in the areas of employment and social security (Law No. 6356)
Use of photos and videos in corporate communications, internal communications, and events; providing references after the employment relationship ends; procedures related to private health insurance as part of employee benefits	Article 5(1) and Article 6(2) of the KVKK	Explicit consent (obtained only through a separate Explicit Consent Form)

For data processing activities based on a legal basis other than explicit consent, your explicit consent will not be sought separately; in this regard, you do not have the option to refuse to give consent or to withdraw your consent.

5. YOUR SPECIAL CATEGORY PERSONAL DATA

Your health data is processed only by the occupational physician, the occupational safety specialist, and authorized personnel bound by a duty of confidentiality, to the extent required by occupational safety and health regulations; it is stored separately from other personal data in a locked cabinet and/or a digital environment with password-protected, restricted access.

With regard to your special-category personal data, the appropriate safeguards established by Decision No. 2018/10 of the Personal Data Protection Board, dated January 31, 2018, are implemented: separate policies and procedures, regular training for relevant employees and confidentiality agreements, clear definition of the scope and duration of authorization, maintenance of access logs, encryption and secure key management in electronic environments, and secure storage and controlled transfer in physical environments.

6. METHOD OF COLLECTING PERSONAL DATA

Your personal data is collected through the forms you fill out and the documents you submit upon hiring, your employment contract and its attachments, human resources software and the ERP system, card-based access control and camera systems, corporate email and network infrastructure, records from the Occupational Health and Safety Unit (OSGB) and the workplace physician, as well as through bank and Social Security Institution (SGK) systems and correspondence with government agencies; in both physical and electronic formats, either partially or fully automatically, or through non-automated means provided that such means form part of a data recording system.

7. TRANSFER OF PERSONAL DATA

7.1. Domestic Transfers

Your personal data may be transferred to the following categories of recipients in accordance with Article 8 of the KVKK and solely for the relevant purpose:

• The Social Security Institution, İŞKUR, the Ministry of Labor and Social Security, tax offices, and other authorized public institutions and organizations
• Judicial and administrative authorities, enforcement offices, courts, and law enforcement agencies (upon request and within the limits prescribed by law)
• Banks and financial institutions through which salary payments are made
• Joint Health and Safety Unit (OSGB), occupational physician, and occupational safety specialist
• Firms and independent professionals from whom independent audit, financial advisory, and legal consulting services are obtained
• Suppliers providing IT, ERP, payroll, and archiving services (in their capacity as data processors)
• Government agencies and clients that require personnel qualification certificates as part of a bid or contract
• Union (only for membership and dues-related matters)

Written agreements are entered into with service providers acting as data processors, which include confidentiality and data security obligations as well as breach notification requirements.

7.2. Transfer Abroad

As a general rule, your personal data is not transferred abroad. If a transfer is necessary due to the use of a cloud-based service or a project conducted with a customer or business partner based abroad, the phased regime provided for in Article 9 of the Personal Data Protection Law, as amended by Law No. 7499, applies:

• First, an assessment is made to determine whether there is a qualification decision issued by the Board and published in the Official Gazette.
• If no eligibility decision has been issued, one of the appropriate safeguards—such as the standard contract, binding corporate rules, or a letter of commitment—announced by the Board must be provided. The signed standard contract must be reported to the Authority within five business days of the date of signature.
• In cases where there is no determination of eligibility and no appropriate safeguards are in place, your explicit consent will be obtained—provided you are informed of the potential risks—only for transfers of an incidental nature.

8. RETENTION PERIODS

Data / Process	Retention Period
Personnel file, employment contract and its attachments, payroll records	10 years from the termination of the employment relationship
Occupational health and safety records, medical examination records, and work-related accident records	15 years from the termination of the employment relationship (or the specific period stipulated in the relevant legislation in cases involving work with carcinogenic or mutagenic substances)
Education and Competency/Certification Records	10 years from the expiration of the document’s validity period
Accounting, tax, and business ledger records	10 years from the end of the relevant year (Turkish Commercial Code, Art. 82); 5 years for tax records (Turkish Tax Procedure Code, Art. 253)
Camera (CCTV) video recordings	30 days from the date of registration
Employee Time Card Records	2 years from the date of registration
Network and system log records	2 years from the date of registration
Data processed based on explicit consent	No later than 30 days from the date the consent is withdrawn

Personal data for which the retention period has expired is deleted, destroyed, or anonymized during periodic destruction cycles conducted at least once every six months, in accordance with the RAYVAG Personal Data Retention and Destruction Policy.

9. YOUR RIGHTS AS A DATA SUBJECT

Pursuant to Article 11 of the KVKK, you have the following rights regarding your personal data, which you may exercise by contacting RAYVAG:

• Find out whether your personal data is being processed.
• If your personal data has been processed, you may request information regarding this.
• The right to know the purpose of the processing of your personal data and whether it is being used in accordance with that purpose.
• The right to know which third parties your personal data has been transferred to, whether within the country or abroad.
• If your personal data has been processed incompletely or incorrectly, you may request that it be corrected.
• Request the erasure or destruction of your personal data in accordance with the conditions set forth in Article 7 of the KVKK.
• Request that third parties to whom your personal data has been transferred be notified of any corrections, deletions, or erasures.
• To object to a decision made solely through the automated processing of your personal data that results in adverse consequences for you.
• If you suffer harm as a result of the unlawful processing of your personal data, you have the right to request compensation for such harm.

In addition, with regard to your personal data processed based on your explicit consent, you have the right to withdraw your consent at any time without providing a reason. Withdrawal of consent does not affect the lawfulness of processing carried out up to the date of withdrawal.

10. APPLICATION PROCEDURE

You may submit your requests using one of the following methods, in accordance with the Communiqué on the Procedures and Principles for Submitting Requests to the Data Controller:

• Fill out the Application Form available at rayvag.com.tr and submit a hand-signed copy, along with a document verifying your identity, in person to the following address: “Adana Hacı Sabancı Organized Industrial Zone, OSB Celal Bayar Boulevard No. 28, Sarıçam / 01400 ADANA”
• Send the same documents by certified mail or through a notary public
• Send your application, signed with a secure electronic signature or mobile signature, to the registered email address rayvag@hs02.kep.tr
• To submit an application using the email address you previously provided to RAYVAG and that is on file in our system

Your application will be processed free of charge as soon as possible, depending on the nature of the request, and in any case within thirty days at the latest. If the process involves additional costs, a fee based on the schedule established by the Board may be charged.

If your request is denied, if the response is deemed insufficient, or if no response is provided within the prescribed timeframe, you may file a complaint with the Personal Data Protection Board within thirty days from the date you receive the response and, in any case, within sixty days from the date of your request. To file a complaint directly with the Board, you must first submit a request to RAYVAG.

11. ENTRY INTO FORCE AND UPDATES

This Privacy Notice entered into effect on August 1, 2026, and superseded the Privacy Notice on the Processing of Employees’ Personal Data dated December 30, 2019. In the event of any changes to applicable laws or Company procedures, the text will be updated, and the current version will be communicated to employees. It will be published on the Company’s website.