Disclosure on Health Data

DISCLOSURE AS PART OF ARTICLE 52 SUB-ARTICLE 7 OF ENERJISA ELECTRICITY MARKET CONSUMER SERVICES REGULATION

Our companies1 (hereinafter will be referred to as “ENERJISA”), which are vested with the title of Data Controller and licensed to be a electricity supplier, would like to inform you about your personal data processed by ENERJISA to enable you benefit from the rights defined under Article 52 Sub-article 7 of Electricity Market Consumer Services Regulation with this Disclosure herein as per the Personal Data Protection Law (“PDPL”) no. 6698. Besides, further information on the personal data processed can be accessed via Customer Services Centres, call centres and from the Disclosure on www.enerjisa.com.tr website.

1) Which Personal Data Do We Collect?

2) What is the Method and Legal Ground of Collecting Personal Data?
Your personal data is collected through manual channels that are partially or fully automatic including customer service centres, customer transaction centres, call centres, etc. or provided that these channels are parts of any data system including any and all kinds of written, digital communication, etc.; through any agreements and forms filled out by your party in the physical environment; and via digital channels including e-mail, phone, call centres. ENERJISA may process the data acquired in its premises; also, may transfer the data for below-mentioned purposes; and transfer and process the data in its operations, affiliated companies or partners. Your data is collected based on the legal grounds of “explicit consent” and “as clearly stipulated by laws” defined under article 5 of PDPL and processed as part of the defined legal reasons.

3) Why Do We Process Your Personal Data?
ENERJİSA’nın mevzuat kapsamındaki yükümlülükleri yerine getirmek başta olmak üzere faaliyetlerini en iyi şekilde yürütebilmesi için bir takım kişisel verilerinizin toplanılması, kullanılması ve işlenmesi yüksek önem arz etmektedir. Kişisel verileriniz;

1Companies include Enerjisa Istanbul Anadolu Yakası Elektrik Perakende Satış A.Ş., Enerjisa Başkent Elektrik Perakende Satış A.Ş., Enerjisa Toroslar Elektrik Perakende Satış A.Ş. and our company that you have signed contract with is the data controller for you.

• In the event of explicit consent, data is processed limited to define the rights as per Article 52, Sub-article 7 of Electricity Market Consumer Services Regulation and carry out electricity supply operations in line with the related legislation, fulfil our obligations from the legislation that our Company is subject to including Electricity Market Law and the secondary legislation; fulfil our obligations related to providing information and reporting in the event of a request from official and/or governmental organisations, including Energy Market Regulatory Authority, Ministry of Energy and Natural Resources, Enerji Piyasası İşletme A.Ş., etc.; manage legal processes with regulation and compliance; proceed litigation and execution processes for debts that our company is a party to; reply consumer grievances, provide legal and commercial security, carry out financial operations and follow up financial issues.

Your personal data is used and processed in compliance with and under the governance of PDPL with utmost confidentiality and the purpose of ENERJISA to provide you service. ENERJISA follows legislation and ethics while processing your personal data and pays utmost attention to have accurate data, avoid misuse, process in compliance with the legal grounds, keep the data updated and store the data for a reasonable period required for the purpose.

4) Why and To Whom Do We Transfer Your Personal Data?
Your personal data can be shared with the aforementioned purposes, to the extent that the legislation allows and is required by our work processes, with the parties that it must be shared with, as a matter of course of the activities we carry out as part of the practices conducted to improve the quality of the service we provide;

• If explicitly stipulated by the related laws, data can be shared with related governmental authorities, organisations and institutions allowed by the Electricity Market Law and other related legislation, Energy Market Regulatory Authority, Ministry of Energy and Natural Resources, Elektrik Piyasaları İşletme A.Ş., Türkiye Elektrik Dağıtım A.Ş., Türkiye Elektrik İletim A.Ş. and related public entities as part of the requirements and purposes of personal data processing defined under articles 8 of PDPL. The data is processed for a period required by our electric supply activities in accordance with our policies and procedures defined in compliance with the By-Law on Erasure, Destruction or Anonymisation of Personal Data; and erased when your relationship with ENERJISA ends, and no other legal requirement or compliance exists.

5) What Are Your Rights, as Data Owner, As Per Article 11 of PDPL?

Please kindly be informed that as per Article 11 of PDPL you are entitled to;

a) Know whether or not your personal data is processed,
b) Ask further information if your personal data is processed,
c) Request information on the purpose of processing and if your data processed is misused,
d) Know the third parties nationwide and abroad to which your personal data is transferred,
e) Ask your personal data to be revised if there is any information processed is missing or incorrect,
f) Ask your personal data to be erased or destructed in the event that the grounds for the data to be processed are no longer valid, although the data was processed in compliance with the provisions of PDPL and other related legislation,
g) Ask the third parties that data is transferred about the processes carried out pursuant to the aforementioned paragraphs (e) and (f),
h) Object to have an outcome not in your favour by means of exclusive analyses through automatic systems,
i) Ask for compensation of your damages in the event of any damages due to illegal processing.

6) How to Claim Your Rights Related to Your Personal Data Submitted?

As part of article 11 of PDPL, you can claim your right to apply regarding your personal data by sending the documents proving your ID and a petition consisting of the details of your request in written to the following addresses in written; or by sending an e-mail to our registered electronic mail (“KEP”) with your safe electronic signature or mobile signature or to the following addresses by using your previously defined and registered e-mail address in ENERJISA’s system.

Your application must include the following information as per article 5 paragraph 2 of Communique on the Principles and Procedures for the Request to Data Controller (“Communique”);

a) Name, surname and signature, if the request is in writing,
b) For Turkish citizens, Turkish ID number; for foreigners, nationality, passport number or ID number, if exists,
c) Residential and business address for notification,
ç) Electronic mail address, telephone, fax number for notification, if exists,
d) Subject of request. Please use Data Controller Application Form, which can be found on Customer Service Centres and corporate website, for related requests. Your application shall be accepted by ENERJISA following the identity verification and the related parties shall be informed in writing or digitally within the legal periods. As per article 7 of the Communique, if your application is to be responded in writing, no fee will be charged up to ten pages. Please kindly be informed that 1 Turkish Lira shall be charged per page over ten pages in compliance with the Communique.

7) Amendments

ENERJISA reserves the right to make any revisions in its policies and procedures to comply with the amendments made in the related legislation. This Disclosure herein is the first version prepared as part of Article 52, Sub-article 7 of Electricity Market Consumer Services Regulation.

Yours faithfully,

Enerjisa İstanbul Anadolu Yakası Elektrik Perakende Satış A.Ş.

Enerjisa Başkent Elektrik Perakende Satış A.Ş.

Enerjisa Toroslar Elektrik Perakende Satış A.Ş.