Privacy Notice

01Data controller

This notice is provided by the data controller under Article 10 of the Turkish Personal Data Protection Law No. 6698 (the "Law") and the Communiqué on the Principles and Procedures for Fulfilling the Obligation to Inform. The Turkish version prevails in case of any inconsistency.

Data controller: DS Aero Robotics Elektronik Sanayi ve Ticaret Anonim Şirketi (the "Company") · Address: Teknopark Ankara, İvedik OSB Mah. 2224. Cad. No: 1 İç Kapı No: 116, Yenimahalle / Ankara, Türkiye · Email: info@dsrobotic.com

This notice covers only the website at www.dsrobotic.com (the "Site") and communication made through it. Separate notices apply to the Company's other processes involving employees, suppliers or business partners.

02Personal data processed

The Site is an informational website; it involves no membership, sales or payments. Only the following data may be processed through it:

Cookies: The Site uses no advertising, tracking or analytics cookies. Your chosen display theme (light/dark) is stored only in your own browser; it is not sent to the Company and does not identify you.

Special categories of data: Please do not share special categories of personal data listed in Article 6 of the Law — such as health, religion, political opinion, biometric data or criminal convictions — or data of other people unrelated to your enquiry, through the contact form or by email. The Company does not request such data; if received, it will be disregarded unless strictly necessary to answer your enquiry and deleted as soon as reasonably possible.

03Purposes of processing

Your personal data is processed only to:

• receive, assess and answer your contact, collaboration, supply, pilot deployment, press and career enquiries
• carry out discussions about your enquiry and, where needed, move to a non-disclosure agreement
• keep the Site secure and detect and prevent misuse and cyber attacks
• comply with legal obligations and requests from competent authorities
• establish, exercise and protect the Company's rights in potential disputes

Your data is not used for marketing, advertising or profiling, and no commercial electronic messages are sent without your explicit consent.

04Method of collection and legal grounds

Data is collected partly by automated means: through the Site's contact form, emails you send us directly, and the automatic server logs of the Site's hosting infrastructure.

Data is processed on the following legal grounds under Article 5(2) of the Law:

• (c) necessity for the establishment or performance of a contract — assessing collaboration, supply and pilot deployment enquiries
• (ç) compliance with a legal obligation of the data controller
• (e) establishment, exercise or protection of a right — potential disputes
• (f) legitimate interests of the data controller, provided your fundamental rights and freedoms are not harmed — answering your enquiry and keeping the Site secure

As long as these legal grounds apply, your explicit consent is not relied upon. This is a notice, not a consent form.

05Transfers

Your personal data is not sold, rented or shared with third parties for advertising. It may be transferred only to the following parties, limited to the purposes above and as necessary:

• Service providers: the Site's hosting provider, the form delivery service that forwards contact-form messages to the Company, and the Company's email service provider (whose servers may be located abroad)
• The Company's legal and financial advisers — only in the event of a dispute or audit
• Courts and competent public authorities — to the extent they are legally authorised and request it

Transfers abroad: Where hosting and email services are provided from servers abroad, transfers are made in accordance with Article 9 of the Law, on the basis of an adequacy decision, the standard contracts announced by the Board, or other appropriate safeguards provided for in the Law.

06Retention

• Enquiries: 2 (two) years from the conclusion of the enquiry
• Correspondence that turns into a collaboration or contract: the period required by law (generally 10 years under the Turkish Commercial Code)
• Server access logs: the hosting provider's policy and the period required by law

When the period ends or the reason for processing no longer exists, data is deleted, destroyed or anonymised.

07Data security

The Company takes reasonable technical and administrative measures under Article 12 of the Law to prevent unlawful processing of and access to personal data and to safeguard it (such as encrypted connections and access restriction).

No transmission of data over the internet can be guaranteed to be fully secure. We therefore ask that enquiries containing confidential technical information be sent not through the Site or plain email, but through the secure channels set out in a mutual non-disclosure agreement once it is signed.

08Third-party links

The Site may contain links to third-party sites not controlled by the Company (for example, social media accounts). The Company is not responsible for the privacy practices of those sites; we recommend reviewing their own privacy notices.

09Your rights under Article 11 of the Law

By applying to the Company, you have the right to:

• learn whether your personal data is processed,
• request information if it has been processed,
• learn the purpose of processing and whether it is used accordingly,
• know the third parties in Turkey or abroad to whom it is transferred,
• request correction if it is incomplete or inaccurate,
• request deletion or destruction under the conditions of Article 7 of the Law,
• request that correction, deletion or destruction be notified to third parties to whom the data was transferred,
• object to a result against you arising exclusively from analysis by automated systems,
• claim compensation for damage arising from unlawful processing.

10How to apply

You may submit your application in writing, under the Communiqué on the Principles and Procedures for Applications to the Data Controller, by one of the following means:

• by post or by hand to the address above, with a wet-ink signed petition
• to info@dsrobotic.com with a secure electronic or mobile signature, or from an email address previously registered in the Company's systems

Your application must include your name and surname, Turkish ID number (nationality and passport number for foreign nationals), address for notification, email and telephone if any, and the subject of your request. Additional information may be requested where identity cannot be verified; applications on behalf of others require a power of attorney or authorisation.

Your application will be concluded free of charge within 30 (thirty) days at the latest, depending on its nature. If the process incurs an additional cost, the fee set by the Board may be charged.

11Changes

The Company may update this notice in line with changes in legislation or its processing activities. The current version is always published on the Site with its update date.