This Explicit Consent Text has been prepared in accordance with the Law on the Protection of Personal Data No. 6698 (“Law”) for the purpose of obtaining the explicit consent of data subjects regarding the procedures and principles of processing personal data and special categories of personal data obtained from data subjects by İLKO İLAÇ SAN. ve TİC. A.Ş. (“Company”), in its capacity as data controller. The “Clarification Text” is published on the Company’s official website at www.ilko.com.tr.

Within the scope of Articles 5 and 6 of the Law on the Protection of Personal Data (attached), I consent to the storage of my personal and special categories of personal data specified below by the Company within the scope of the grounds and periods specified below:

Personal Data:

Name, Surname, Date of Birth, Place of Birth, TR Identity Number, Identity Card (in case of recruitment),

Family and social life information,

Address information,

Information regarding Driver's License,

Military service status information,

Education and training information,

Employment information (Resume, Reference information),

Financial information,

Information regarding provided and procured goods and services (in case of recruitment),

Business activity information (in case of recruitment),

Information regarding professional and other licenses and permits,

Telecommunication records,

Location records via company vehicle and/or tablet (in case of recruitment),

E-mail and information systems services usage records,

Entry records,

Social Security Institution (SGK) Registration Information,

Information regarding the exit interview form (in case of recruitment).

Special Categories of Personal Data:

• Nationality - Marital Status, Vaccination Card, liver X-ray and similar health data - Biometric data - Criminal record information and ongoing lawsuit information.

I consent to the sharing of my data within the framework of the grounds and parties specified below; that data will be collected, processed, and shared within the scope of Articles 5 and 6 of the Law on the Protection of Personal Data to fulfill the legitimate company purposes detailed in the Clarification Text, provided that it is limited to the relevant purposes.

Shared Parties: Within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law on the Protection of Personal Data (attached), personal data collected by the Company may be shared with affiliates, business partners, employees, banks, legally authorized public institutions and other persons, and consulates when necessary. I declare that I have been fully informed within the scope of Article 11 of the Law (attached) regarding my rights as a data subject concerning the matters in this text; that I consent to the processing of my personal data and special categories of personal data for the stated legitimate purposes and their transfer to the specified persons; that the necessary clarification has been made to me; and that I have read and understood this with a clear conscience, without any pressure, threat, error, or fraud.

I accept ☐ I do not accept ☐

Data Subject Name Surname:

Date:

Signature:

*In this declaration, if you do not accept the consent for the processing of your personal data, including your relevant special categories of personal data, we inform you that we will not be able to provide you with the necessary and sufficient service regarding our processes that require explicit consent, except for cases where processing is permitted under KVKK legislation, and that our Company's commercial and operational activities will be negatively affected.

Relevant Articles of Law No. 6698

ARTICLE 5 -

(1) Personal data shall not be processed without the explicit consent of the data subject.

(2) Personal data may be processed without seeking the explicit consent of the data subject only in cases where one of the following conditions is met:

a) It is expressly provided for by the laws.

b) It is necessary for the protection of life or physical integrity of the person himself/herself or of any other person, who is unable to explain his/her consent due to the physical disability or whose consent is not deemed legally valid.

c) Processing of personal data belonging to the parties of a contract is necessary, provided that it is directly related to the conclusion or fulfilment of that contract.

ç) It is necessary for compliance with a legal obligation to which the data controller is subject.

d) Personal data has been made public by the data subject himself/herself.

e) Data processing is necessary for the establishment, exercise or protection of any right.

f) Data processing is necessary for the legitimate interests of the data controller, provided that this processing does not violate the fundamental rights and freedoms of the data subject.

ARTICLE 6 -

(1) Personal data relating to the race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, clothing and appearance, membership to associations, foundations or trade-unions, health, sexual life, convictions and security measures, and biometric and genetic data are deemed to be special categories of personal data.

(2) It is prohibited to process special categories of personal data without explicit consent of the data subject.

(3) Personal data, excluding those relating to health and sexual life, listed in the first paragraph may be processed without seeking explicit consent of the data subject in cases provided for by laws. Personal data relating to health and sexual life may only be processed without seeking explicit consent of the data subject by persons subject to a secrecy obligation or competent public institutions and organizations, for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment and nursing services, planning and management of health-care services as well as their financing.

(4) Adequate measures determined by the Board shall also be taken in the processing of special categories of personal data.

Erasure, destruction or anonymizing of personal data

ARTICLE 7 -

(1) Despite being processed under the provisions of this Law and other relevant laws, personal data shall be erased, destroyed or anonymized by the data controller, ex officio or upon the request of the data subject, in the event that the reasons for the processing no longer exist.

(2) The provisions of other laws relating to the erasure, destruction or anonymizing of personal data are reserved.

(3) The procedures and principles for the erasure, destruction or anonymizing of personal data shall be laid down through a regulation.

Transfer of personal data

ARTICLE 8 -

(1) Personal data shall not be transferred without explicit consent of the data subject.

(2) Personal data may be transferred without seeking explicit consent of the data subject upon the existence of one of the conditions provided for in:

a) the second paragraph of Article 5;

b) the third paragraph of Article 6, provided that adequate measures are taken.

(3) The provisions of other laws relating to the transfer of personal data are reserved.

Transfer of personal data abroad

ARTICLE 9 -

(1) Personal data shall not be transferred abroad without explicit consent of the data subject.

(2) Personal data may be transferred abroad without explicit consent of the data subject upon the existence of one of the conditions set forth in the second paragraph of Article 5 and the third paragraph of Article 6 and if in the foreign country to which personal data will be transferred:

a) There is adequate protection;

b) In case there is no adequate protection, if the data controllers in Turkey and in the related foreign country commit, in writing, to provide adequate protection and the Board’s permission is obtained.

(3) The Board shall determine and announce the countries with adequate protection.

(4) The Board shall decide whether there is adequate protection in the foreign country and whether the permission will be granted under sub-paragraph (b) of the second paragraph, by evaluating:

a) the international conventions to which Turkey is a party;

b) the reciprocity condition regarding data transfer between the country requesting personal data and Turkey;

c) for each specific personal data transfer, the nature of the personal data and the purpose and duration of processing;

ç) the relevant legislation and practice in the country to which the personal data will be transferred;

d) the measures committed by the data controller in the country to which the personal data will be transferred; and if needed, by obtaining the opinion of relevant institutions and organizations.

(5) Personal data may only be transferred abroad with the permission of the Board and after obtaining the opinion of the relevant public institution or organization in cases where the interests of Turkey or the data subject may be seriously harmed, without prejudice to the provisions of international conventions.

(6) The provisions of other laws relating to the transfer of personal data abroad are reserved.

ARTICLE 11 -

(1) Each person has the right to apply to the data controller and:

a) to learn whether his/her personal data are processed;

b) to request information if his/her personal data are processed;

c) to learn the purpose of data processing and whether this data is used for intended purposes;

ç) to know the third parties to whom his/her personal data is transferred at home or abroad;

d) to request the rectification of the incomplete or inaccurate data, if any;

e) to request the erasure or destruction of his/her personal data under the conditions laid down in Article 7;

f) to request notification of the operations carried out in compliance with sub-paragraphs (d) and (e) to third parties to whom his/her personal data has been transferred;

g) to object to the processing, exclusively by automatic means, of his/her personal data, which leads to an unfavourable consequence for the data subject;

ğ) to request compensation for the damages incurred due to the unlawful processing of his/her personal data.