Collection Methods and Legal Grounds

Your personal data is collected physically or electronically through various communication channels, based on the establishment or performance of a contract, our legitimate interests, or your explicit consent for marketing and promotional activities. Collected data may be processed for purposes including but not limited to: • Financial and accounting management • Corporate communication • Customer satisfaction and complaint management • Customer relationship management • Compliance with legal obligations • Event management • After-sales services • Manufacturing and operational processes • Supplier and business partner relationship management • Reporting activities • Contract management and legal follow-up • Employee performance evaluations • Market research and marketing analytics • Internal audit and investigation • Data accuracy and currency • Marketing, advertising, and promotional activities across digital and traditional channels • Customer profiling and behavior analysis for personalized marketing Our Company may also process personal data within the limits set by Articles 5 and 6 of the Law for other legally permitted purposes.

Special Categories of Personal Data

Special categories of personal data include information about race, ethnicity, political opinion, philosophical belief, religion, sect, attire, association or union membership, health, sexual life, criminal records, biometric and genetic data. As a rule, our Company does not request or process such data. However, if special category data appears incidentally within documents (e.g., religion field in ID copies for domain registration purposes), processing is limited to the required context. Personal data may be shared, to the extent necessary, with: • Authorized public institutions and organizations, • Domestic and foreign affiliates, • Legal advisors, accountants, occupational health and safety professionals, • Call centers and business partners, • Third parties providing services supporting Company operations.

Your Rights under Article 11 of the Law

Without prejudice to the exceptions set out in Article 28 of the Law, you may exercise the following rights by applying to our Company: a. To learn whether your personal data is processed, b. To request information if it has been processed, c. To learn the purpose of processing and whether it is used in accordance with its purpose, d. To learn the third parties to whom it is transferred, e. To request correction if it is incomplete or incorrect, f. To request deletion or destruction in accordance with Article 7, g. To request notification of such actions to third parties, h. To object to any outcome arising solely from automated processing, i. To claim compensation if you suffer damages due to unlawful processing. You may submit your requests regarding your rights and the application of the Law in writing to our Human Resources Department. Requests will be evaluated and concluded within 30 days free of charge, unless they require additional costs as specified by the “Communiqué on the Procedures and Principles of Application to the Data Controller.”

Contact Information

For your applications under the Law, you may submit your request with identity verification to: Bimed Teknik Aletler San. ve Tic. A.Ş. Özar Sanayi Sitesi, Deliklikaya Mh., Yüzbaşı Mehmet Hilmi Cd. No. 28/1, Arnavutköy – İSTANBUL via personal delivery, notary, or secure electronic signature to bimedteknikaletler@hs02.kep.tr Please note that applications can only be accepted following identity verification.

Communiqué on the Procedures and Principles of Application to the Data Controller – Article 5

(1) Data subjects may submit their requests under Article 11 of the Law in writing, via registered electronic mail (KEP), secure electronic signature, mobile signature, or using their e-mail address previously registered with the data controller. (2) Applications must include: a) Full name and signature (if written), b) Turkish ID number (or passport number for foreigners), c) Residential or business address, d) Contact information (email, phone, fax), e) Subject of the request. Applications must clearly indicate the applicant’s relationship with the Company (e.g.,Employee, Former Employee, Customer, Visitor, Business Partner) and preferred response method (by mail, email, or in person).

Application Form under the Personal Data Protection Law

Subject: Request for Information under the Law on the Protection of Personal Data

Applicant Information

• Full Name*:

• T.R. ID No / Passport No*:

• Address for Notification*:

• Date of Birth: • Phone Number:

• E-mail Address:

• Subject of the Request*:

(Fields marked with * are mandatory under the Communiqué)

1. Relationship with the Company:

☐ Customer / Supplier ☐ Employee / Former Employee / Candidate ☐ Third Party

2. Response Notification Method:

☐ I would like it to be sent to my address.

☐ I would like it to be sent to my e-mail address.

☐ I would like to receive it in person. (In case of proxy delivery, a notarized power of attorney is required.)

This application form has been prepared in order to identify your relationship with our Company, to determine, if any, the personal data processed by our Company in full, and to ensure that your application is responded to accurately and within the legal time frame. To eliminate legal risks that may arise from unlawful or unauthorized disclosure of data and to ensure the security of your personal data, our Company reserves the right to request additional documents and information (such as a copy of your ID card or driver’s license) for the purpose of verifying your identity and authority. In cases where the information you provide within the scope of this form is not accurate or up to date, or if an unauthorized application is made, our Company shall not be held liable for any claims arising from such incorrect information or unauthorized applications. If the transaction required by your request incurs an additional cost, a fee may be charged in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. A processing fee of 1 Turkish Lira per page may be charged for each page exceeding ten (10). If the response to your application needs to be delivered on a recording medium such as a CD or flash drive, the cost of such medium shall also be borne by you.