KVKK Disclosure Text

ONKASAN ELEKTRONIK SANAYI VE TICARET LIMITED SIRKETI

CLARIFICATION TEXT ON THE PROTECTION OF PERSONAL DATA (KVKK)

Dear Users and Customers,

As Onkasan Elektronik Sanayi ve Ticaret Limited Sirketi (“Company” or “Onkasan”), we thank you for the trust you have shown in our smart home and industrial automation (Garden Irrigation, Lighting, etc.) systems and our mobile applications.

Our Company attaches the highest level of importance to the security and privacy of your personal data, and in the capacity of "Data Controller" pursuant to the Personal Data Protection Law No. 6698 (“KVKK” or “Law”), we process your personal data within the framework described below and in full compliance with the Law.

This Clarification Text has been prepared to transparently explain which personal data of you, our valued users who use our mobile application and experience our smart automation devices, we process for what purposes, where your data is stored, our absolute and clear technical separation on the transfer of data abroad, and your rights under the Law.

1. IDENTITY OF THE DATA CONTROLLER

Pursuant to the Law, the data controller is our Company, registered with the Ankara Trade Registry, having the following contact information:

• Company Title: Onkasan Elektronik Sanayi ve Ticaret Limited Sirketi
• Address: Serhat Mh. 1123. Cd. No: 3/24 Yenimahalle / Ankara / Turkey
• Contact Email: info.onkasan@gmail.com
• Phone: +90 533 352 93 41

2. YOUR PERSONAL DATA PROCESSED AND METHOD OF COLLECTION

When using our mobile application, performing device pairing, and interacting with our automation systems, your data in the following categories is collected by automatic or non-automatic digital methods:

• Identity Information: Your name and surname.
• Contact Information: Your email address (for user login and account verification) and phone number.
• Device and Pairing Information: Pairing records of the device serial number (SSID / Device ID) belonging to the smart automation device with your user account.
• Location Data (Temporary Local Security Guarantee): During the initial installation of the smart device, location permission and data are requested instantaneously due to the technical infrastructure requirements of mobile operating systems (Android/iOS) in order to scan the surrounding local WiFi networks and introduce the device to the network. This location data is strictly never recorded on our Company's servers, is not stored, and is only used locally on the device at the time of installation.

3. PURPOSES AND LEGAL GROUNDS FOR PROCESSING PERSONAL DATA

Your collected personal data is processed for the following purposes based on the legal grounds specified in Article 5 of the Law (in particular, "provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract" and "legitimate interests of the data controller"):

1. Digital pairing of the smart automation devices (garden irrigation, lighting, etc.) we produce with user accounts,
2. Accurate control authorizations over local networks or the internet via the mobile application,
3. Sending push notifications to your mobile device for system statuses, critical warnings, and user updates,
4. Troubleshooting technical glitches, maintenance, repair, and uninterrupted after-sales technical support services,
5. Ensuring user account security and cybersecurity at the highest level.

4. LOCATION WHERE YOUR PERSONAL DATA IS STORED AND ITS SECURITY

Our Company adopts an absolute approach regarding the localization and cybersecurity of your data:

• ALL personal identity and contact data (Name, Surname, Email, Phone, etc.) belonging to our users are stored in our secure MSSQL (Microsoft SQL Server) database hosted on our local servers within the borders of Turkey.
• This database is protected against unauthorized access, data losses, and cyber threats with up-to-date encryption mechanisms, firewalls, and strict access authorizations.

5. DATA TRANSFER ABROAD AND TECHNICAL DATA SEPARATION (MUTLAK GUARANTEE)

As Onkasan, we have specially designed our software and cloud infrastructure so that our users' personal data is not transferred abroad. The absolute technical data separation we apply when using global services for the remote control of our devices is as follows:

• Personal Data Guarantee: No personal data (Name, Surname, Email, Phone, etc.) that makes our users identified or identifiable is ever transferred abroad or kept on foreign-based servers. These data remain entirely on our local servers in Turkey.
• Technical Service Use and Anonymous Data: Google Firebase (Realtime Database & Cloud Messaging) services are used to control devices remotely over the internet, track their status in real-time, and send push notifications.
• Firebase Limits: Only and strictly anonymous technical data is sent to this foreign-sourced infrastructure. The data kept on Firebase servers consists only of: device serial number (Device ID), instantaneous status of relays (e.g., garden irrigation valve or lighting on/off info), and online/offline status info showing whether the device is connected to the internet.
• Result: Foreign service providers can technically never determine back to which real person (Name, Surname, Email owner) this technical data belongs. Thanks to this technical architecture, no transfer of personal data abroad takes place in the sense of KVKK.

6. TO WHOM AND FOR WHAT PURPOSE YOUR PERSONAL DATA CAN BE TRANSFERRED

Your personal data stored on our local servers is strictly not shared with third parties for commercial, advertising, or marketing purposes. Your data can only be shared:

• With authorized public institutions and organizations (courts, police units, judicial authorities, etc.) in accordance with the legislation in force, upon request and within legal limits, in order to fulfill our legal obligations.

7. YOUR RIGHTS UNDER ARTICLE 11 OF THE LAW

As a personal data owner, you can apply to our Company to use your following rights pursuant to Article 11 of the KVKK:

• To learn whether your personal data is processed or not,
• To request information if your personal data has been processed,
• To learn the purpose of processing your personal data and whether they are used appropriately for their purpose,
• To know the third parties to whom your personal data is transferred domestically,
• To request correction of your personal data if they are processed incompletely or incorrectly,
• To request deletion or destruction of your personal data within the framework of the conditions provided for in Article 7 of the Law,
• To request notification of the correction, deletion, or destruction processes to third parties to whom your personal data has been transferred,
• To object to the occurrence of a result against you by analyzing the processed data exclusively through automated systems,
• To demand the compensation of the damage in case you suffer damage due to the unlawful processing of your personal data.

8. METHOD OF APPLICATION AND CONTACT

You can apply to our Company using the following methods to exercise your rights under the Law, get information about your data, or submit your correction/deletion requests:

1. Via Email: By applying in writing to info.onkasan@gmail.com through your email address registered in our systems or allowing us to verify your identity,
2. In Writing with Signature: By sending an application in person or via notary public to the address "Serhat Mh. 1123. Cd. No: 3/24 Yenimahalle / Ankara / Turkey" along with documents proving your identity.

Your requests will be evaluated and finalized free of charge within 30 (thirty) days at the latest from the date they reach our Company.

As Onkasan Elektronik Sanayi ve Ticaret Limited Sirketi, we continue to keep our data security standards at the highest level so that you can use our locally manufactured automation systems with confidence.