1. Purpose

To date, A. O. Smith Su Teknoloji A.Ş. ( "Company”Or“A. O. Smith In accordance with the sensitivity of the works we deal with, the personal data collected are kept confidential and never shared with third parties except for their intended purpose. Protection of personal data is the basic policy of our company. Before making any legal arrangements, our company attached great importance to the confidentiality of personal data and adopted it as a working principle. As A. O. Smith, we undertake to comply with all responsibilities brought by the Personal Data Protection Law (“Law”) No. 6698.

2. Scope and Replacement

This Personal Data Protection and Processing Policy prepared by our company (“PPPD Policy”) Has been prepared in accordance with the Law No. 6698 on Protection of Personal Data. The law has come into force with all its provisions as of today.

The data obtained from you in accordance with your consent or in accordance with the other law states in the Law will be used to increase the quality of our services and to improve our quality policy. Again, some data we have are removed from being personal and anonymized. These data are data used for statistical purposes and are not subject to law enforcement and our Policy.

The A. O. Smith PPPD Policy aims and protects the data of our customers, prospects, employees and companies that work in partnership with us, and data obtained automatically from employees and employees or others.

Our company has the right to change our Policy on condition that it complies with the Law and better protection of personal data.

3. Basic Rules for the Processing of Personal Data

a) Being in compliance with the law and honesty rules: A. O. Smith questions the source of the data it collects or comes to it from other companies and attaches importance to obtaining them in accordance with the law and in accordance with the rules of integrity.

b) Being accurate and up to date when necessary: A. O. Smith pays attention to the fact that all the data within the organization is correct, does not contain false information, and if it is transmitted to it, in the event of a change in personal data, it is updated.

c) Processing for specific, clear and legitimate purposes: A. O. Smith only processes data limited to the purposes it offers and receives consent from people during service. It does not process, use and make use of data other than for business purposes.

d) Being connected, limited and restrained for the purpose for which they are processed: A. O. Smith uses data only for the purpose for which it is processed and to the extent required by the service.

e) Preservation for the period required by the relevant legislation or for the purpose for which they are processed: A. O. Smith maintains contractual data within the scope of the Law's dispute times, requirements of commercial and tax law. However, when these purposes disappear, they delete or anonymize the data. Deletes or destroys them according to the Directive on Deleting Personal Data.

It is important to note that whether A. O. Smith collected or processed the data on the basis of consent or in accordance with the law, these principles above apply.

4. Rights of Personal Data Owner listed in Article 11 of PPPD Law

According to PPPD article 11, you have the rights listed below. In order to facilitate these rights, an application form is also prepared by A. O. Smith and presented to you on your website.
The persons whose personal data are processed, by applying to our official announced by A. O. Smith on our website, regarding their own data;

a) To learn whether personal data is processed or not,

b) Request information if personal data has been processed,

c) To learn the purpose of processing personal data and whether they are used in accordance with their purpose,

d) To know the third parties to whom personal data are transferred domestically or abroad,

e) In case the personal data are incomplete or incorrectly processed, to request their correction and to request notification of the transaction made within this scope to the third parties to whom the personal data is transferred,

f) To request the deletion or destruction of personal data in the event that the reasons requiring its processing disappear or to be notified to third parties to whom the personal data is transferred, in the event that the reasons requiring its processing have disappeared, in accordance with the conditions stipulated in Article 7 of the PPPD, in accordance with the provisions of PPPD and other relevant laws,

g) to object to the occurrence of a result against the person by analyzing the processed data exclusively through automated systems,

h) It has the right to demand the compensation of the damage in case the personal data is damaged due to the illegal processing of the data. As A. O. Smith, we respect these rights.

5. Maximum Savings Principle / Stinginess Principle

According to this principle, which is called the maximum saving principle or the stinginess principle, the data reaching A. O. Smith is only entered into the system as much as necessary. Therefore, what data we collect is determined by the purpose. Data that are not required are not collected. Other data transferred to our company are also transferred to the company information systems. Excess information is not saved to the system, deleted or anonymized. These data can be used for statistical purposes.

6. Deletion of Personal Data

Personal data is erased, destroyed or anonymized by our company either at the request of the person concerned or when the legal requirements expire, the completion of judicial processes or other requirements disappear.

7. Accuracy and Data Updates

The data contained in A. O. Smith is processed, as a rule, upon the declaration of the persons concerned. A. O. Smith does not have to investigate the accuracy of the data declared by customers or persons contacting A. O. Smith, nor is it done by law and due to our business principles. The declared data is considered correct. The principle of accuracy and timeliness of personal data has also been adopted by A. O. Smith. It updates the personal data that our company processes from the official documents received or upon the request of the person concerned. It takes the necessary measures for this.

8. Privacy and Data Security

Personal data is confidential and A. O. Smith complies with this privacy. Only authorized persons can access personal data within the company. All necessary technical and administrative measures are taken to protect the personal data collected by A. O. Smith and to prevent unauthorized access and the data subject to be victimized. In this context, the software is ensured to comply with the standards, to select the third parties carefully and to follow the PPPD Policy within the company. Companies that we share personal data in accordance with the law are also requested to protect the data.

9. Data Processing Purposes

A. O. Smith's purposes of processing personal data Processing of Personal Data In Lighting Text as stated.

10. Customer, Prospective Customer and Business and Solution Partners Data

a. Collection and Processing of Data for Contract Relationship
If a contractual relationship is established with customers and prospects, the personal data collected can be used without the consent of the customer. However, this use takes place for the purpose of the contract. Data is used in accordance with the better execution of the contract and the requirements of the service and it is updated by contacting the customers when necessary.

b. Business and Solution Partner Data
A. O. Smith adopts the principle of acting in accordance with the law when sharing data with both business and solution partners. The data is shared with the business and solution partners with the commitment of data confidentiality only as much as the service requires and these parties are required to take precautions to ensure data security.

11. Data Processing for Advertising Purposes

In accordance with the Law on the Regulation of E-Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages, only electronic messages can be sent to people who have been previously approved for advertising purposes. It is imperative that the consent of the person to whom the advertisement is sent is clearly available.

A. O. Smith also respects the details of the "approval" determined in accordance with the same legislation. The approval to be obtained should include all commercial electronic messages sent by the recipients to their electronic contact addresses in order to promote, market, promote the business of your company or to increase its recognition with content such as celebrations and wishes. This approval can be obtained in writing in a physical environment or by any electronic communication means. The important thing is that the positive will declaration, name and surname, and the e-mail address of the recipient accepting commercial electronic messages.

12. Data Transactions Conducted Due To The Company's Legal Obligation Or Clear Foresight In The Law

Personal data may be processed without prior approval, in order to clearly state the processing in the relevant legislation or to fulfill a legal obligation determined by the legislation. The type and scope of data processing must be necessary for the legally permitted data processing activity and comply with the relevant legal provisions.

13. Company's Data Processing

Personal data can be processed in line with the company's services and legitimate purposes. However, the data cannot be used for illegal services in any way.

14. Processing of Special Qualified Data

A. O. Smith takes all the necessary precautions determined by the Board for the processing of special personal data. In our company, special personal data are processed according to the "Protection and Processing of Special Personal Data" Policy.

15. Data Processed by Automated Systems

On data processed through automated systems, A. O. Smith acts in accordance with the Law and secondary legislation. The information obtained from these data cannot be used against the person without the express consent of the persons. However, A. O. Smith can make decisions about who to deal with using data from his system.

16. User Information and Internet

In the event that personal data is collected, processed and used in A. O. Smith's websites and other systems or applications, the persons concerned are informed with a privacy statement and, if necessary, about cookies.

People are informed about our applications on their website. Personal data will be processed in accordance with the law.

17. Data of Our Employees

a. Processing Data for a Business Relationship
The personal data of our employees can be processed to the extent necessary, in terms of performance of the employment contract and establishment of the benefits. However, A. O. Smith ensures the confidentiality and protection of its employees' data.

b. Legal Liabilities Requirement Processing
A. O. Smith may process the data without further approval, in order to explicitly state the personal data of its employees, the processing in the relevant legislation or to fulfill a legal obligation determined by the legislation. This issue is limited to the obligations arising from the law.

c. Embroideries for the Benefit of Employees
A. O. Smith can process personal data without obtaining approval for transactions for the benefit of company employees, such as a subsidiary facility. A. O. Smith can also process employee data for disputes arising from business relationships.

D. Processing of Special Quality Data
According to the Law, people's race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, disguise and outfit, association, foundation or union membership, health, sexual life, criminal conviction and security measures and biometric and genetic data is personal data of a special nature.

A. O. Smith takes adequate measures determined by the Board, in addition to the approval of the person concerned, in the processing of special personal data. Special quality personal data can only be processed without limitation of the person regarding the cases permitted by the Law and limited.

to. Data Processed by Automated Systems
Employees' data processed in relation to automated systems can be used in internal promotions and performance evaluations. Our employees have the right to object to the outcome against them and they do so by following internal procedures. The objections of the employees are also evaluated within the company.

f. Telecommunications and Internet
Computer, phone, e-mail and other applications allocated to employees within the company are allocated to the employee for business purposes only. The employee cannot use any of the tools that the company has allocated to it for their special purposes and communication. The company can control and control all data on these vehicles. The employee undertakes that he will not have any other data or information on the computer, telephones or other tools allocated to him from the moment he starts work.

18. Transfer of Personal Data in and Out of the Country

Personal data may be shared with the dominant shareholder, as well as business and solution partners, so that A. O. Smith can see the service.

A. O. Smith may transfer personal data to A. O. Smith's suppliers limitedly in order to ensure that our Company outsources from the supplier and provides the services required to perform our Company's commercial activities.

A. O. Smith has the authority to transfer personal data in accordance with the conditions set by the Board in accordance with the other conditions in the Law, at home and abroad.

19. Rights of the Person

A. O. Smith acknowledges that within the scope of PPPD, the person concerned has the right to get approval before the data is processed and after the data is processed, he has the right to determine the fate of his data.

Regarding personal data, by applying to our official announced by A. O. Smith on our website;

a) Learning whether your personal data is processed,

b) Request information if personal data has been processed,

c) To learn the purpose of processing personal data and whether they are used in accordance with their purpose,

ç) Knowing the third parties to whom personal data is transferred at home or abroad,

d) Requesting correction of personal data in case of incomplete or incorrect processing,

e) Requesting the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7,

f) to request that the transactions carried out in accordance with paragraphs (d) and (e) be notified to the third parties to whom the personal data are transmitted,

g) to object to the occurrence of a result against the person by analyzing the processed data exclusively through automated systems,

ğ) In the event that personal data is damaged due to unlawful processing, it has the right to demand the compensation of the loss.

However,
Persons have no right to anonymized data within the company. A. O. Smith may share personal data by the relevant institutions and organizations for the purpose of exercising the legal powers of a judicial duty or state authority in accordance with the business and contract relationship.

Personal data owners will be able to submit their requests regarding their rights mentioned above to the Company by filling out the application form, which you can obtain from the official website of the Company, and signing it with a wet signature, by sending it to the address of our company, by registered mail and with photocopies (only a photocopy for the identity card). Your applications will be answered as soon as possible according to the content of your application or within 30 days after reaching our company. You must make your applications by registered mail. In addition, only the part of your applications will be answered, and an application about your spouse, relative or friend will not be accepted.

A. O. Smith may request further relevant information and documents from applicants.

20. Privacy Policy

Whether it's employees or other people's data in A. O. Smith is confidential. Nobody can use, copy, reproduce, transfer to others, use it for any other purpose without any contract or lawfulness.

21. Transaction Security

All necessary technical and administrative measures are taken to protect the personal data collected by A. O. Smith and to prevent unauthorized access and to prevent our customers and prospects from being victimized. In this context, the software is ensured to comply with the standards, to select the third parties carefully and to follow the PPPD Policy within the company. Security measures are constantly being renewed and developed.

22. Audit

A. O. Smith conducts the necessary internal and external audits for the protection of personal data.

23. Notification of Violations

When A. O. Smith is notified of any violation of personal data, he immediately takes action to resolve the violation. It minimizes the harm of the concerned and compensates the loss. When personal data is intercepted by unauthorized persons, it immediately informs the Personal Data Protection Board.

With the notification of violations, you can apply according to the procedures stated on our corporate website. For PPPD Application and Information Request form Click here.

Update 24

Changes to this Policy are shown in the table below.

Policy Update Date	Amendments