Protection of Personal Data and Privacy Policy

At EPSIS, we attach the utmost importance to the security of your personal data. Below is our privacy notice explaining how your data is collected, processed and protected under Law No. 6698 on the Protection of Personal Data (KVKK).

This Privacy Notice (Clarification Text) has been prepared pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (“KVKK”) and the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Inform, in order to inform member and guest users who benefit from the EPSIS electric vehicle charging network service. The data controller is Form Elektrik İnşaat Mühendislik A.Ş., the owner of the EPSIS brand. This notice supplements Form Elektrik's general Policy on the Protection and Processing of Personal Data (formelektrik.com/kvkk).

1. Data Controller

Trade Name: Form Elektrik İnşaat Mühendislik Anonim Şirketi (“Form Elektrik” / “EPSIS”)

Address: Malıköy Anadolu OSB, 29 Ekim Caddesi, No:1/A, Sincan/Ankara

MERSIS No: 0388020129900013

Registered E-mail (KEP) Address: formelektrik@hs01.kep.tr

E-mail: kvkk@formelektrik.com • destek@epsis.net

Call Center: 0850 308 36 76

Brand / License: EPSIS • Electric Vehicle Charging Network Operation License No: ŞH/11301-2/00049

2. Categories of Personal Data Processed

• Identity: Name and surname; Turkish ID/passport number where required for invoicing
• Contact: Mobile phone (GSM), e-mail, address
• Customer Transaction: Member/transaction number, request and complaint records, call center voice recordings
• Vehicle: Vehicle license plate, model/vehicle description, AutoCharge vehicle ID
• Location: Charging station location; (if permitted) mobile application location data
• Charging Transaction: Charging session date/time/duration, energy transferred (kWh), station and socket information
• Finance: Payment and invoice information (card data is stored only on the infrastructure of the authorized payment institution)
• Transaction Security: IP address, log records, username and password
• Marketing (with consent): Preference, campaign and usage habit data, if explicit consent has been given

3. Purposes of Processing Personal Data

• Creating and managing the membership account and verifying the user's identity
• Providing the charging service and carrying it out in compliance with the relevant legislation (Charging Service Regulation)
• Carrying out payment, pre-authorization/blocking, invoicing and collection processes
• Providing access to services on other networks within the scope of roaming
• Managing customer relations, requests and complaints, and call center processes
• Ensuring information and transaction security and preventing fraud
• Fulfilling legal obligations and exercising the right of defense in disputes
• Where explicit consent is given; marketing, campaign, satisfaction survey and promotional activities

4. Purposes of Processing and Legal Grounds

• Establishment/performance of a contract (Art. 5/2-c): Creating and managing memberships, providing the charging service, payment and invoicing, roaming
• Legal obligation (Art. 5/2-ç): Keeping invoices/financial records, reporting and retention under the legislation
• Establishment/protection of a right (Art. 5/2-e): Request and complaint management, defense in legal disputes
• Legitimate interest (Art. 5/2-f): Information security, fraud prevention, improving service quality
• Explicit consent (Art. 5/1): Marketing/commercial electronic messages and (in the absence of appropriate safeguards) transfer abroad

5. Method of Collecting Personal Data

Your personal data is collected electronically and/or physically through the EPSIS mobile application, the website (epsis.net) and its sub-sites, charging stations and equipment, the call center, e-mail and other communication channels; by fully or partially automated means or by non-automated means as part of a data recording system, based on the legal grounds stated above.

6. Transfer of Personal Data

Your personal data may be transferred to the following recipient groups in accordance with the conditions set out in Articles 8 and 9 of the KVKK and the purposes above, provided that the necessary administrative and technical measures are taken;

Recipient Group	Purpose of Transfer	Legal Ground
Banks and authorized payment/intermediary payment institutions	Carrying out payment transactions	Performance of the contract / legal obligation
Charging network operators within the scope of roaming	Access to charging services on other networks	Performance of the contract / legitimate interest
IT, hosting, cloud and software suppliers	Setting up, operating and securing the infrastructure	Legitimate interest
Cargo/logistics suppliers	Delivery of RFID cards	Legitimate interest
Authorized public institutions and organizations	Responding to legally mandatory requests for information/documents	Legal obligation
Service providers located abroad	Cloud/infrastructure services	Appropriate safeguards (KVKK Art. 9) or explicit consent

7. Retention Periods

Your personal data is retained for the period required by the purpose of processing and for the periods stipulated in the legislation; it is then deleted, destroyed or anonymized in accordance with the EPSIS Personal Data Retention and Destruction Policy. For example, invoices and financial records are retained under the Tax Procedure Law (at least 5 years), and commercial books and documents under the Turkish Commercial Code (10 years). Even if you request deletion, records that must be kept by law are retained for the relevant period solely for this purpose.

8. Your Rights as a Data Subject (KVKK Art. 11)

You have the right to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether it is used in line with that purpose; know the third parties to whom it is transferred domestically/abroad; request correction if it has been processed incompletely/incorrectly; request its deletion/destruction when the conditions are met; request that correction/deletion operations be notified to the third parties to whom it was transferred; object to a result against you arising from analysis exclusively by automated systems; and claim compensation for damages arising from unlawful processing.

9. Application Method

You may submit the above requests, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, in person with a wet signature or through a notary public to the address above; to the KEP address (formelektrik@hs01.kep.tr); or with a secure electronic/mobile signature or from your e-mail address registered in our system to kvkk@formelektrik.com. Your applications will be concluded free of charge within 30 (thirty) days at the latest, depending on the nature of the request; if the process requires an additional cost, the tariff set by the Board may be applied. For detailed information, you may refer to the Form Elektrik General KVKK Policy (formelektrik.com/kvkk).