Privacy Statement

Zorlu Enerji Dağıtım AŞ. , Zorlu Osmangazi Enerji Sanayi ve Ticaret A.Ş. , Zorlu Hidroelektrik Enerji Üretim A.Ş. , Zorlu Doğal Elektrik Üretimi A.Ş , Rotor Elektrik Üretim A.Ş. , Zorlu Rüzgar Enerjisi Elektrik Üretimi A.Ş. , Zorlu Jeotermal Enerji Elektrik Üretim A.Ş. , Zorlu Solar Enerji Tedarik ve Ticaret A.Ş. , Zorlu Elektrik Enerjisi İthalat İhracat ve Toptan Ticaret A.Ş. and Nemrut Jeotermal Elektrik Üretimi A.Ş.  (hereinafter jointly referred to as "Zorlu Enerji") sets out the data protection principles to be implemented in the collection and use of the personal data received through the website (hereinafter referred to as the "Website") depending on the preferences of the users (hereinafter referred to as "Users") in this Privacy Policy. As Zorlu Enerji, we pay utmost attention to the protection and security of your personal data. In this respect, as the Data Supervisor, we would like to inform you in the most transparent way about your related rights and the methods of collection, purposes of processing and legal reasons for the processing of your personal data pursuant to the Turkish Personal Data Protection Law number 6698 (hereinafter referred to as the "Law") that was enacted to protect the fundamental rights and freedoms of individuals, in particular privacy, and personal data.

Personal Data

Depending on the users’ access to and activities in the Website, Zorlu Enerji collects the data necessary for the delivery of the services offered in the Website and other information considered personal data under the Personal Data Protection Law and other applicable legislation, including but not limited to identity information, Internet Protocol (IP) information and contact information. The user, with his or her express consent, agrees the processing of the personal data he or she would share with Zorlu Enerji, within the scope and for the purposes of this Privacy Policy.

According to article 3 and 7 of the Personal Data Protection Law, data that irrevocably become anonymous are not considered personal data for the purposes of the Law, and the processing activities on such data are performed without being subject to the provisions of this Privacy Policy.

Purpose of Use of Personal Data

Personal data may be processed for the reporting and business development activities of Zorlu Enerji and used for carrying out various statistical evaluations and market analyses and establishing databases without disclosing the User’s identity. In case the User gives further consent, the said data may be also processed, stored and shared with third persons by Zorlu Enerji and other persons Zorlu Enerji is cooperating with for direct marketing purposes and the User may be contacted to for the introduction of various applications, products and services and giving information about maintenance and support operations.

Zorlu Enerji, in addition, under the following condition, may process and share with third persons the personal data without receiving the consent of the User, pursuant to articles 5 and 8 of the Personal Data Protection Law and/or related exemptions set out by the applicable legislation:

• Explicit permission by the Law,
• The requirement to protect the life or physical integrity of a User or other persons, in case the User is not able to give consent for actual impossibilities or his or her consent does not have legal validity,
• The requirement to process personal data, provided that it is in direct relation with the establishment or performance of a contract between the User and Zorlu Enerji,
• Fulfilment of legal obligations,
• Anonymization of personal data by the User him or herself,
• The requirement to process personal data for the establishment, use or protection of a right,
• The requirement to process personal for the legitimate interests of Zorlu Enerji, provided that the fundamental rights and freedoms of the User are not damaged.

Period of Storage of Personal Data

Zorlu Enerji will store the personal data collected from the User as long as the services are provided, in order to fulfil its obligations resulting from the nature of the services provided.

In addition, in case of a dispute between Zorlu Enerji and the User, Zorlu Enerji will be entitled to store personal data until the end of the period of limitation, provided that personal data is used for necessary pleading in relation to the dispute.

Data Security Measures

Subject to the conditions set out by the applicable legislation or this Privacy Policy, Zorlu Enerji undertakes to take necessary technical and administrative measures and perform necessary audits to provide reasonable level of security in relation to the

• prevention of illegal processing of personal data,
• prevention of illegal access to personal data, and
• secure storage of personal data.

Personal data collected by Zorlu Enerji will not be disclosed to third persons in breach of this Privacy Policy and the applicable legislation, or used for purposes other than the intended.

Zorlu Enerji will not bear any responsibility for the privacy policy or content of any links given in the Website to other websites or applications.

Zorlu Enerji will not assume responsibility for the damages that may occur as a result of the use of personal data in line with the conditions specified above.

Modifications on the Privacy Policy

Persons who benefit from the services provided in the Website are deemed to have read and accepted the conditions set out here. Zorlu Enerji is entitled to modify the provisions of the Privacy Policy without prior notification. The current Privacy Policy will become effective when it is served with any method to Users.

Sharing of Personal Data

Zorlu Enerji is entitled to share the personal data of the User and any new data obtained by use of personal data to third persons whose services are used for the performance of the services offered to the User in the Website, limited to the performance of the said services. In this context, Zorlu Enerji may share User data with third persons including external service providers, hosting service providers, law offices, research companies and call centres in order to improve User experience (optimization, customization, etc.), ensure data security of the User, eliminate problems related to the Website or other Zorlu Enerji services and achieve any purpose set out in this Privacy Policy or other privacy texts notified to the User.

The User hereby agrees to the storage of his or her personal data by the said third persons in any server around the world, limited to the purposes specified above.

Method of Collection and Legal Justification

Your personal data may be collected by Zorlu Enerji with any automated or unautomated method from written, verbal or electronic environments, for being used for the purposes specified in the Privacy Policy. Your personal data may be processed and transferred in line with the personal data processing conditions and purposes set out in Articles 5 and 6 of the Law and this Privacy Policy.

Rights of the User

The User, as the data owner, may exercise the following rights in relation to his or her personal data by applying to Zorlu Enerji:

• Receive information whether his or her personal data were processed or not.
• Request related information, if his or her personal data were processed.
• Receive information about the purpose of processing or his or her personal data and whether the data are exactly used for the intended purposes.
• Receive information about the third persons to whom his or her personal data were transferred.
• Request correction, if his or her personal data were processed deficiently or wrong.
• Request the deletion or destruction of his or her personal data in line with the conditions set out by the applicable legislation.
• Request the communication of the correction, deletion or destruction requests to third persons to whom his or her personal data were transferred in line with the applicable legislation.
• Object to situations against him or her, resulted from the analysing or the personal data by use of nonexclusive automatic systems.
• Demand the compensation of his or her damages resulted from the unlawful processing of his or her personal data.

The User undertakes that the information he or she has provided to Zorlu Enerji subject to this Privacy Policy are complete, accurate and up-to-date and that he or she will immediately update the information when there is any change.

Zorlu Enerji cannot be held responsible, if up-to-date information are not provided by the User.

The User agrees and undertakes that in case he or she demands anything that would prevent the use of his or her personal data by Zorlu Enerji, he or she may be unable to fully benefit from the services undertaken by Zorlu Enerji and he or she will be the sole responsible for any resulting situation.

When you communicate your request related to your rights through the communication channels provided in the internet site of Zorlu Enerji, they will be evaluated and finalized in 30 (thirty) days. In the requests communicated by the data owner, it is necessary to specify his or her name and surname, signature if the application is made in written, identity number or if he or she is foreign; nationality, passport number or if any identification number, residence or workplace address to be used for notification purposes, electronic mailing address if any, phone number, fax number and subject of request. In case the request is to be responded in written, any fee will not be applied up to ten pages, while the cost tariff set out by the applicable legislation may be applied for responses over ten pages. In case the response is given in a storage media such as a CD or flash memory, Zorlu Enerji will be entitled to demand a fee corresponding to the actual cost of the storage media from the User.