As ENVESU Çevre Enerji İnşaat ve Müşavirlik Anonim Şirketi (“ENVESU” or the “Company”), acting as data controller under the Personal Data Protection Law No. 6698 (“KVKK”), we process the personal data of persons who visit the www.envesu.com website (the “Site”) and who contact us through our communication channels, within the scope described below. Data collected through the forms on the Site is further described in the privacy notice of the relevant form. The general principles of our personal data processing activities are set out in our Personal Data Protection and Processing Policy.

Data controller

Personal data processed and method of collection

Purposes and legal grounds

Processing other than Site usage statistics does not rely on your explicit consent. Analytics cookies only run if you give explicit consent in the cookie panel; not consenting does not affect your use of the Site, and you can withdraw your consent at any time via the “Cookie preferences” link in the footer.

Transfers

Your personal data may be transferred, limited to the purposes above and in accordance with Articles 8 and 9 of the KVKK, to:

• competent public authorities and judicial bodies, upon request,
• our legal, financial and audit advisers,
• service providers from whom we obtain Site hosting, e-mail and information technology services,
• if you consent to analytics cookies, our analytics service provider Google (Google Analytics), with respect to Site usage data.

Our corporate e-mail infrastructure is provided through the Microsoft 365 service; data you send us by e-mail may therefore be processed on the service provider's servers located abroad. If you consent to analytics cookies, your Site usage data is also transferred to Google's servers abroad. These transfers are carried out by signing the standard contracts announced by the Personal Data Protection Board under Article 9 of the KVKK and notifying the Authority.

Retention period

Your personal data is kept for as long as required by the purpose of processing and the period stipulated in legislation. Server access logs are kept for a maximum of 2 year(s); correspondence through our communication channels for 2 year(s) after the request is concluded; and correspondence that turns into a proposal or contractual relationship under Turkish Commercial Code No. 6102, Article 82, for 10 years. User- and event-level data in Google Analytics is deleted automatically after 14 months. Data whose retention period has expired is deleted, destroyed or anonymised through the periodic destruction carried out in June and December in accordance with our Personal Data Retention and Destruction Policy.

Your rights

Under Article 11 of the KVKK, you have the right to:

• a) learn whether your personal data is processed,
• b) request information if it has been processed,
• c) learn the purpose of processing and whether it is used in line with that purpose,
• d) know the third parties to whom it is transferred in Türkiye or abroad,
• e) request correction if it is incomplete or inaccurately processed,
• f) request its deletion or destruction under the conditions of Article 7 of the KVKK,
• g) request that correction, deletion or destruction be notified to third parties to whom the data has been transferred,
• h) object to a result against you arising from analysis exclusively through automated systems,
• i) claim compensation for damage suffered due to unlawful processing.

Applications

You can submit requests regarding your rights, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, using the Data Subject Application Form or by a petition containing your full name, signature (for written applications), Turkish ID number (for foreign nationals, nationality and passport or ID number), address for notifications and the subject of your request, through one of the following channels:

• In writing: by delivering your application with a wet signature, together with your identity document, to our address above by hand, or by sending it through a notary. Please write “Personal Data Protection Law Information Request” on the envelope.
• By registered electronic mail (KEP): to envesucevre@hs06.kep.tr.
• With a secure electronic signature or mobile signature: by sending your signed application to info@envesu.com.
• By e-mail: to info@envesu.com from the e-mail address you have previously notified to us and that is registered in our system. Please write “Personal Data Protection Law Information Request” in the subject line.

Your application will be concluded free of charge as soon as possible according to the nature of the request, and at the latest within 30 days; if the process involves an additional cost, the fee in the tariff set by the Board may be charged. We may ask for additional documents to verify your identity. If your application is rejected, you find the response insufficient, or no response is given in time, you may, within 30 days of learning of the response and, in any case, within 60 days of the application date, file a complaint with the Personal Data Protection Board under Article 14 of the KVKK.

Version 1.0 · November 2026

As ENVESU, acting as data controller, we process the personal data you send us through the contact form on the Site within the scope described below. For data controller details, your rights and how to apply, the General Privacy Notice applies.

Data processed

• Identity and contact: your name and e-mail address.
• Request details: the service you are interested in and the content of your message.
• Transaction security: the date and time the form was submitted and, to the extent recorded by the form infrastructure, your IP address.

Please do not include in your message any personal data not needed for your request, in particular special categories of personal data such as health, religion or criminal convictions.

Method of collection, purpose and legal ground

Your data is collected electronically, partly by automated means, when you fill in the form.

Transfers

In accordance with Articles 8 and 9 of the KVKK, your data may be transferred to service providers from whom we obtain form and e-mail infrastructure services (including Microsoft 365), to the relevant business partner if your request concerns a project we carry out in a joint venture, and to competent public authorities upon request. For transfers abroad, the explanation in the General Privacy Notice applies.

Retention period

Form records and correspondence are kept for 2 year(s) after the request is concluded. Correspondence that turns into a proposal or contractual relationship is kept under Turkish Commercial Code No. 6102, Article 82, for 10 years.

Version 1.0 · November 2026

As ENVESU, acting as data controller, we process your personal data in connection with job applications made through the careers form on the Site or by e-mail, within the scope described below. For data controller details, your rights and how to apply, the General Privacy Notice applies.

Data processed

• Identity and contact: full name, e-mail address; phone, address and photograph if included in your CV.
• Professional information: CV, education, certificates, work experience, area of expertise and your introductory text.
• Reference information: names and contact details of the referees listed in your CV. We kindly ask you to inform your referees accordingly.
• Interview process records: interview notes and assessment results.

Please do not include special categories of personal data such as health, religion, association or trade union membership or criminal convictions in your application. Such data is not requested; if shared, it is not used in the assessment and is deleted from your application record using the methods in our Personal Data Retention and Destruction Policy.

Method of collection, purpose and legal ground

Your data is collected electronically, partly by automated means, when you fill in the careers form, send us an e-mail and attend interviews.

Transfers

Your data is shared internally with the managers involved in the recruitment process, and may be transferred to service providers from whom we obtain human resources and e-mail infrastructure services (including Microsoft 365) and to competent public authorities upon request, in accordance with Articles 8 and 9 of the KVKK. If you consent in the explicit consent text below, your CV may be transferred in proposal documents to contracting authorities, international financial institutions and our joint-venture partners, some of which are located abroad.

Retention period

• If your application is unsuccessful and you have not consented to the candidate pool: 6 months from the conclusion of the application.
• If you have consented to the candidate pool: 2 years from the date of application or until you withdraw your consent (whichever comes first).
• If you are hired: your data is transferred to your personnel file and processed under the Employee Privacy Notice.

Career Application Explicit Consent Text

The two processing activities below are optional and are carried out only if you give your explicit consent. Not giving consent does not affect the assessment of your application. You can withdraw your consent at any time by writing to info@envesu.com; withdrawal does not affect processing carried out up to that date.

Version 1.0 · November 2026

As ENVESU, acting as data controller, we process the personal data of the reporting person, the persons concerned by the report and witnesses, in connection with reports made under our Ethical Principles Procedure, within the scope described below. For data controller details, your rights and how to apply, the General Privacy Notice applies.

Reporting channels and confidentiality of your identity

• Web form and e-mail: The form on the Site opens your report in your e-mail program as a ready-made message to etik@envesu.com; form data is not stored on our server. The message is sent from the e-mail address you use; that address and the technical headers of the e-mail reach us. The “I wish to remain anonymous” option on the form only means you do not share your name and phone number; it does not hide your e-mail address.
• If you do not want your identity to be known: you can use an e-mail address that does not identify you, or send the Ethics Violation Reporting Form unsigned by post to our head office address, writing “Quality and Audit Unit – Confidential” on the envelope. Please note that we may not be able to give you feedback on anonymous reports.
• If you share your identity and want it kept confidential: your identity details are shared only with the persons responsible for examining the report and are kept confidential as far as possible. No sanctions are applied against those who report breaches of ethical principles in good faith.

Data processed

• Reporting person (optional): full name, phone, e-mail address, relationship with ENVESU.
• Incident information: type of report, place, date and time, whether the incident is ongoing, description and attachments.
• Persons concerned by the report and witnesses: name, position, role in the incident and other information included in the report.
• Depending on the content of the report, special categories of personal data (e.g. health, criminal convictions). We kindly ask you not to include such data unless it is essential for understanding the report.

Method of collection, purpose and legal ground

Your data is collected electronically and physically through reports made by e-mail, post or in person and through information and documents gathered during the investigation.

Access and transfers

Only the authorised staff of the Quality and Audit unit and the Human Resources unit responsible for examining reports under the Ethical Principles Procedure, and the Board of Directors where necessary, have access to reports. If a report concerns one of these persons, that person is excluded from the investigation. Where necessary, data may be transferred to our legal advisers, competent public authorities and judicial bodies, and to our e-mail infrastructure service provider (Microsoft 365) in accordance with Articles 8 and 9 of the KVKK.

Informing the person concerned by the report

The person concerned by the report is informed at the earliest stage that does not jeopardise the proper conduct of the investigation and the preservation of evidence. Article 28/2(a) of the KVKK is reserved where processing of personal data is necessary for the prevention or investigation of a crime.

Retention period

Report and investigation records are kept for 10 years from the conclusion of the investigation. Reports found to be unfounded or outside the scope of the Ethical Principles Procedure are deleted or anonymised 1 year(s) after the record is closed.

Version 1.0 · November 2026

This policy explains how ENVESU uses cookies and similar technologies on the www.envesu.com website. The Site uses a strictly necessary preference record required for the site to work and, only if you give explicit consent, Google Analytics 4 analytics cookies to measure visit statistics. No advertising, retargeting or social media tracking cookies are used. This policy replaces the Cookie Policy dated 27.10.2025 (Version 1).

What is a cookie?

Cookies are small text files stored in your browser by the websites you visit. The browser's local storage may also be used for similar purposes. In this policy, the term “cookie” also covers these similar technologies.

Cookies and similar technologies used on the Site

Google Analytics

Google Analytics 4 is a web analytics service provided by Google. Unless you give explicit consent to analytics cookies, the Google Analytics tag is not loaded and no analytics cookies are stored. If you consent, data such as the pages you visit, visit duration, referring source, device and browser type and your approximate location (country/city) are collected and transferred to Google's servers abroad. According to Google, Google Analytics 4 does not log IP addresses; the IP address is used only momentarily to determine approximate location.

We have configured the service to minimise data: Google signals, ad personalisation and data sharing with Google products are turned off; user- and event-level data is deleted automatically after 14 months. We use the reports only as aggregate statistics and do not try to identify you individually. The transfer to Google is carried out by signing standard contracts under Article 9 of the KVKK and notifying the Authority. For Google's data processing practices, please see the Google Privacy Policy (policies.google.com/privacy).

Third-party resources

• Fonts: The fonts on the Site are loaded from Google Fonts servers; in doing so, your IP address and browser information are transmitted to Google.
• Maps and LinkedIn links: The “Open in maps” and LinkedIn links only open the relevant site in a new tab when you click them. The cookie policies of the respective companies apply on those sites.

Legal ground

The strictly necessary preference record is not subject to explicit consent, since it is strictly necessary to provide the service you request (KVKK Art. 5/2(c) and (f); the Authority's Guidelines on Cookie Practices). Since Google Analytics cookies are not strictly necessary, they run only on the basis of the explicit consent you give in the cookie panel (KVKK Art. 5/1). If marketing or advertising cookies are ever introduced, this policy will be updated in advance and those cookies will also be activated only with your explicit consent.

Managing your preferences

You can change or withdraw your preference at any time via the “Cookie preferences” link in the Site footer; when you withdraw your consent, analytics cookies are deleted and the Google Analytics tag is no longer loaded. You can also delete or block cookies and local storage through your browser settings. For your rights regarding your personal data and how to apply, please see the General Privacy Notice.

Version 2.0 · November 2026