PRIVACY POLICY AND PROTECTION OF PERSONAL DATA

Milltech Platform Mobile Application

This Privacy Policy and Personal Data Protection Notice has been prepared by Değirmencioğlu Makine (hereinafter referred to as the "Company" or "Data Controller") to explain how your personal data is processed within the scope of the Milltech Platform mobile application (the "Application") in accordance with Turkish Law No. 6698 on the Protection of Personal Data ("KVKK").

1. Data Controller

The details of the Company processing your personal data as the Data Controller are as follows:

· Company Name: Değirmencioğlu Makine (Milltech / Degpa)

· Address: Büyük Kayacık Mah. OSB 413 Nolu Sokak No 7/A, Selçuklu / Konya / TÜRKİYE

· Phone: +90 (332) 502 13 00 / +90 (332) 342 40 33

· E-mail: info@degpa.com / export@milltech.com.tr

· Website: platform.milltech.com.tr

2. Personal Data Processed

The following categories of personal data are processed through the Application:

· Identity Information: First name and surname.

· Contact Information: E-mail address and telephone number.

· Address Information: Province, district and full address (billing and delivery addresses).

· Account and Security Information: Username, password (encrypted) and session authentication token.

· Customer Transaction Information: Products ordered, quantities, cart contents and order history.

· Request/Contact Information: Name, e-mail address, telephone number and message content submitted through the contact form.

The Application does not collect your location data, photos/gallery content, address book or contacts. No third-party advertising or user behavior analytics/tracking is carried out through the Application.

3. Purposes of Processing Personal Data

Your personal data is processed for the following purposes:

· Creating user accounts and managing login/session processes.

· Receiving, processing and confirming spare parts and product orders.

· Fulfilling orders according to billing and delivery addresses.

· Responding to requests, questions and messages submitted through the contact form.

· Carrying out customer support and after-sales service processes.

· Fulfilling legal obligations and responding to requests from authorized authorities.

4. Legal Grounds for Processing Personal Data

Your personal data is processed based on the following legal grounds pursuant to Article 5/2 of the KVKK:

· Being directly related to the establishment or performance of a contract (KVKK Art. 5/2-c): membership and ordering processes.

· Being mandatory for the Data Controller to fulfill its legal obligation (KVKK Art. 5/2-ç): obligations concerning commercial books, invoices and record retention.

· Being necessary for the legitimate interests of the Data Controller, provided that this does not prejudice the fundamental rights and freedoms of the data subject (KVKK Art. 5/2-f): customer support and communication processes.

5. Transfer of Personal Data

Your personal data may be transferred in accordance with the conditions set forth under Articles 8 and 9 of the KVKK and only in the following circumstances:

· To data centers and hosting providers from which we receive hosting services for the Application and servers, only to the extent required for the provision of the service.

· To legally authorized public institutions and organizations, including courts, prosecutors' offices and regulatory/supervisory authorities, as required by our legal obligations.

· Due to the distribution of the Application through app stores such as Apple App Store and Google Play, personal data may be transferred abroad (e.g. to the United States) as required by the infrastructure of these platforms. Such transfers are subject to the privacy policies of the relevant platforms.

Except for the circumstances stated above, your personal data is not shared with or sold to third parties for commercial purposes without your explicit consent.

6. Retention Period of Personal Data

Your personal data is retained for the period required by the purposes of processing and taking into account the statutory retention periods applicable to us (e.g. the 10-year retention period for commercial books and documents). Once the applicable retention periods expire or the reasons requiring processing cease to exist, your personal data is deleted, destroyed or anonymized.

7. Data Security

Appropriate technical and administrative measures are taken pursuant to Article 12 of the KVKK to ensure the security of your personal data. These measures include:

· Passwords are processed in encrypted form and are not stored in plain text.

· Communication between the Application and the server is carried out over an encrypted connection (HTTPS).

· Session authentication is provided using a signed (HMAC) and time-limited token.

· Access to personal data is restricted to authorized personnel only.

8. Local Storage and Preferences

Instead of using browser cookies, the Application stores only the following data in the local storage area of your device:

· Your language preference.

· Your connected server/API address preference.

· Your cart contents (stored only on your device).

· Your session authentication token (valid for 30 days).

This data is required only for the operation of the Application and is not shared with third parties. This data may be deleted when you uninstall the Application or log out.

9. Rights of the Data Subject

Pursuant to Article 11 of the KVKK, you have the following rights by applying to the Data Controller:

· To learn whether your personal data is being processed.

· To request information about the processed data if it has been processed.

· To learn the purpose of processing and whether the data is used in accordance with that purpose.

· To know the third parties to whom your personal data is transferred domestically or abroad.

· To request correction if your personal data is incomplete or incorrectly processed.

· To request the deletion or destruction of your personal data within the scope of Article 7 of the KVKK.

· To request notification of third parties to whom your data has been transferred regarding correction and deletion operations.

· To object to a result arising against you through the exclusive analysis of processed data by automated systems.

· To claim compensation for damages if you suffer damage due to unlawful processing.

10. Application Procedure

You may submit your requests concerning the above rights to the Data Controller in writing in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller through the following channels:

· E-mail: info@degpa.com

· Postal Address: Büyük Kayacık Mah. OSB 413 Nolu Sokak No 7/A, Selçuklu / Konya / TÜRKİYE

Your applications will be concluded within 30 (thirty) days at the latest, depending on the nature of the request.

11. Children's Privacy

The Application is not intended for children. Persons under the age of 18 should not share their personal data through the Application without the permission of their parents or legal guardians.

12. Policy Changes

This Privacy Policy may be updated from time to time due to changes in legislation or updates to the Application. The current version of the policy is always published within the Application and on the relevant websites.

13. Contact

For questions regarding our Privacy Policy or the processing of your personal data, you may contact us:

· E-mail: info@degpa.com

· Phone: +90 (332) 502 13 00

· Address: Büyük Kayacık Mah. OSB 413 Nolu Sokak No 7/A, Selçuklu / Konya / TÜRKİYE

Effective Date: September 15, 2026