Personal Data Protection — Privacy Notice

1. Data Controller

Onur Grup İnşaat A.Ş., operating under the Luna Tones brand, acts as the data controller pursuant to the Law on the Protection of Personal Data No. 6698 ("KVKK"). Address: Kileci Mahallesi Lütfi Bostanoğlu Caddesi No:4/A Akşehir / Konya Phone: 444 24 23 Email: info@lunatones.com KEP: onurgrup@hs01.kep.tr

2. Personal Data Processed

• •First and last name
• •Email address
• •Phone number
• •Country and city
• •Message content
• •Company / professional details (B2B)
• •IP address (technical security)

3. Purposes of Processing

• •Commercial communication and quotation preparation
• •Evaluation of export and dealership applications
• •Customer service and technical support
• •Marketing and product promotion (with consent)
• •Contract management and invoicing
• •Compliance with legal obligations
• •Site security and fraud prevention

4. Legal Bases

Personal data is processed on the following legal grounds under KVKK Art. 5: • Explicit Consent (Art. 5/1): for marketing communications. • Statutory Obligation (Art. 5/2-a): tax, commercial and labour law requirements. • Contract Performance (Art. 5/2-c): dealership, sales and service agreements. • Legal Obligation (Art. 5/2-ç): retention obligations under TTK, VUK and related law. • Legitimate Interest (Art. 5/2-f): security and internal operations.

5. Data Transfers

Your personal data is not sold, rented or commercially shared with third parties. Transfers are limited to public authorities (where legally required), authorised business partners under NDA, payment institutions, SMTP infrastructure (for message delivery only), and legal or financial advisers under confidentiality obligations.

6. Retention Periods

Contact and request records: 3 years Contracts and orders: 10 years (Turkish Commercial Code) Invoices and accounting records: 5 years (Tax Procedure Law) Job application data: 2 years Security logs: 2 years Cookies: session-based or up to 13 months

7. Your Rights

• •Learn whether your personal data is being processed
• •Request information about the processing
• •Learn the purpose and whether it is used accordingly
• •Know the third parties to whom data is transferred
• •Request correction of incomplete or inaccurate data
• •Request deletion or destruction (KVKK Art. 7)
• •Request notification of corrections/deletions to third parties
• •Object to automated processing that produces adverse outcomes
• •Claim compensation for damages caused by unlawful processing

8. How to Exercise Your Rights

To exercise your rights under Article 11 of KVKK: • By email: info@lunatones.com (subject: "KVKK Request") • By KEP: onurgrup@hs01.kep.tr • By written petition: Kileci Mahallesi Lütfi Bostanoğlu Caddesi No:4/A Akşehir / Konya Requests will be responded to within 30 days. Identity verification may be required.