Personal data Types of personal data we process CHOBAN AGRO / subsidiaries processes various personal data depending on your relationship or collaboration with CHOBAN AGRO / subsidiaries. As a customer We collect the following personal data in connection with or pursuant to our relationship with (potential) customers:

• Identification and contact details (name, e-mail address, telephone number, title);

• Professional details (position, company number, company address, land code, language);

• Financial and economic data (payments); As a supplier We collect the following personal data in connection with the collaboration with our suppliers: • Identification and contact details (name, e-mail address, telephone number, address.);

• Professional details (position, company number);

• Company financial and economic data (payments); As a job applicant In connection with job applicants, CHOBAN AGRO / subsidiaries limits the collection of personal data to the following:

• Identification and contact details (name, e-mail address, telephone number);

• Professional details (CV, motivation letter, evaluations). As a visitor of our websites When you visit our websites, we will automatically collect a number of personal details by means of cookies. For this, we refer you to the cookie statement on the website www.chobanagro.com As a visitor of our workplace We collect the following personal data in connection with visitors of our workplace:

• Identification (name)

• Professional details (company name

1. Why do we process personal data? CHOBAN AGRO / subsidiaries processes personal data for various purposes, depending on your relationship or collaboration with CHOBAN AGRO / subsidiaries. As a customer We collect and process personal data of customers for the following purposes:

2. • To provide the services, information, support, etc. that you request;

3. • To process orders;

4. • To maintain customer relationships;

5. • In order to help us to serve you and to offer you personalized functionalities;

6. • To comply with our legal obligations - including, but not necessarily limited thereto - all administrative, tax-related and social-legal obligations.

7. • To grant you your access rights to our websites, mobile sites and/or applications;

8. • To direct our efforts for the improvement of our products;

9. • To contact you as a possible survey respondent;

10. • Provided with explicit permission, to send promotion material (newsletters...) to you. As a supplier We collect and process personal data of suppliers for the following purposes:

11. • The optimal collaboration and maintaining the suppliers relationship;

12. • To place and pay for orders. As a job applicant We collect and process your personal data for the following purposes:

13. • To carry out an effective and efficient recruitment and selection procedure;

14. • Later communication for a (different) job vacancy within a period of one year, after explicit consent from the job applicant. As a visitor of our websites To provide a better user experience on our websites. As a visitor of our workplace To maintain our security and safety within our workplace. How have we obtained your personal data?As a customer We obtain your personal data that you share directly with us. This is possible through various channels such as through an employee or a sub-contractor. In some case, it is possible that we obtain your personal data via public databases or acquaintances. If this is the case, then we will inform you about this during our first contact as required by law. As a supplier We obtain your personal data that you share directly with us. In some case, it is possible that we obtain your personal data via public databases or acquaintances. If this is the case, then we will inform you about this during our first contact as required by law. As a job applicant We obtain the personal data that you share with us via your job application. In addition, we could possibly request references from a third party (former employers). As a visitor of our websites We obtain the personal data by visiting our website and accepting non-essential & non- functional cookies or by filling in our contact form. As a visitor of our workplace We obtain the personal data via our visitor registration in our offices.With whom do we share your personal data? Your processed personal data may be transferred to the following for the above purposes and within the conditions determined by the KVKK within the framework of your explicit consent or the conditions determined by law;

15. • To the business partnerships of our company in order to fulfil and ensure the continuity of commercial activities,

16. • To our suppliers on a limited basis in order to provide outsourced products and services,

17. • To audit firms within the scope of the relevant contracts for the audit of our commercial activities in accordance with the provisions of the relevant legislation,

18. • To our administrative staff for the limited purpose of designing strategies regarding the commercial activities of our company,

19. • To legally authorised public institutions and organisations within the scope of their requests within the legal authority of the relevant public institutions and organisations, • To institutions and organisations designated to ensure the fulfilment of legal obligations specified in the KVKK.

20. How long do we retain your personal data? CHOBAN AGRO / subsidiaries undertakes nothing to retain your personal data longer than for the purpose for which we have collected these personal data. As a customer We will retain the personal data of customers for a maximum period of 10 years after the last purchase. As a supplier We will retain the personal data of suppliers for a maximum period of 10 years after the last order. As a job applicant We will retain the personal data of job applicants for a maximum period of 4 weeks after filling in the vacancy. As a visitor of our websites We will retain the personal data as stated in our cookie policy on the website. As a visitor of our workplace We will retain the personal data of visitors for a maximum period of 30 days after the visit. How is your personal data protected against loss, misuse or undesired manipulation?

21. In order to protect the information that we have under our control against loss, misuse or undesired manipulation, we have appropriate physical, electronic and managerial procedures in place to promote the availability, confidentiality and integrity of your personal data. For example, our servers are only accessible for authorized personnel, your personal data are only shared with personnel on a need-to-know basis only for the purpose of the realization of the transaction and providing the requested services to you. Moreover, an extensive analysis is performed for new projects that could possibly have an impact on your privacy to secure your rights, and to promote the security and protection of your personal data. Should an incident occur nevertheless involving your personal data, you will be notified personally in the circumstances provided for in the law. Choban Agro and its subsidiaries do their best to secure your information. This does not eliminate all possible leaks. Under no circumstances can Choban Agro or its subsidiaries be held liable if your information is misused, lost or subject of undesired manipulation. Which possibilities do you have with regards to your rights? You can change your interests and or subscribe or unsubscribe to any marketing or promotional newsletter or mailing at any time. CHOBAN AGRO / subsidiaries retains the right to send service-related communication to you as part of your CHOBAN AGRO / subsidiaries account, without you having the possibility to unsubscribe for this. You can change or update your account settings at any time.

22. When you share your personal data with CHOBAN AGRO / subsidiaries, you have a number of rights with regard to your personal data. CHOBAN AGRO / subsidiaries respects these rights and aims for transparencyand accuracy of your personal data. Therefore, as an individual you have the right to: • Inspect and transferability of your personal data; • Revise (correct) your personal data if the data are incorrect or incomplete; • Temporary (or permanent) limitation of the processing of your personal data*; • Delete your personal data; • To oppose the use of your personal data for direct marketing purposes.

23. With these rights, you must take into account that CHOBAN AGRO / subsidiaries may no longer be able to offer some services. For instance, you will no longer be able to purchase products at CHOBAN AGRO / subsidiaries or we will no longer be able to contact you for possible job vacancies.

24. CHOBAN AGRO / subsidiaries retains the right to determine whether your request is justified. Moreover, in some cases, we have to comply with a number of statutory retention periods and therefore we cannot fully accommodate your request to delete your personal data. In that case, we will evaluate which personal data we can already delete and we will inform you accordingly. Moreover, the right to deletion is limited to the legal right. If you have any further complaints regarding compliance with the privacy statement, you must contact us first. If you still have any unresolved issues after that which you believe that we have not dealt with properly, you can contact the Personal Data Protection Authority. If you wish to exercise your rights or submit complaints, we do request you to first identify yourself in order to avoid anyone doing this in your name. In addition, we request you to always be as specific as possible so that we can respond to your request optimally. We will always respond within the statutory specified term of 30 days.