Candidate Employee and Intern Privacy Notice

1. Purpose, Scope and Data Controller

This Candidate Employee and Intern Privacy Notice has been prepared by Redstar Havacılık Hizmetleri A.Ş. ("Redstar" or the "Company") to inform employee and intern candidates about the processing of their personal data within the scope of the Law No. 6698 on the Protection of Personal Data ("KVKK") and the relevant legislation.

This Notice applies to employee and intern candidates who apply to Redstar for employment or an internship through the website, e-mail, career platforms, professional social networks, recruitment/consultancy firms, referrals or similar channels.

Your personal data is processed by Redstar Havacılık Hizmetleri A.Ş. in its capacity as data controller under the KVKK. Redstar takes the necessary technical and administrative measures in accordance with the applicable legislation to ensure the confidentiality and security of personal data.

2. Personal Data Processed

The following personal data may be processed within the scope of the application and assessment processes:

Identity information: Name, surname, date of birth, nationality, marital status, military service status and similar information shared by you in your résumé or during the application process.

Contact information: Telephone number, e-mail address, residential address and correspondence address.

Education and professional experience information: Educational background, school/department graduated from, certificates, foreign language proficiency, professional competencies, previous work experience, former employers, job descriptions, reference information and internship experience.

Application and assessment information: Position or internship programme applied for, application type, employment status, application source, your motivation for joining Redstar, résumé/CV, cover letter, interview notes, assessment results, test/inventory results and suitability-for-employment assessments.

Visual and audio records: A photograph, where included by the candidate in the résumé; and image and audio recordings that may be generated during an online interview. If interviews are recorded, candidates will be informed separately and their explicit consent will be obtained where required.

Reference information: Name and surname, position, company and contact details of reference persons provided by the candidate, together with assessment information obtained as a result of reference checks.

Transaction security and technical data: For applications submitted via the website, the IP address, application date and time, system log records, form submission information and similar technical records.

Where required due to the nature of the position applied for or obligations arising from applicable legislation and regulations, your health data indicating your health condition and/or disability status, as well as other special categories of personal data, will be processed only where the processing conditions set out in Article 6 of the KVKK are met and the necessary technical and administrative measures are taken. Where necessary, such data may be processed within the scope of assessments carried out by the workplace physician. Where the processing conditions prescribed by law do not apply, your explicit consent will be obtained.

3. Purposes and Legal Grounds for Processing Your Personal Data

Your personal data is processed for the following purposes and on the legal grounds specified in Articles 5 and 6 of the KVKK:

Processing Purpose	Categories of Data Processed	Legal Ground
Receiving, recording and assessing employment and internship applications	Identity, contact, education, professional experience, application and CV information	KVKK Art. 5/2-c: Directly related to the establishment or performance of a contract; KVKK Art. 5/2-f: Legitimate interests of the data controller
Communicating with candidates	Contact information	KVKK Art. 5/2-c and Art. 5/2-f
Assessing the candidate's suitability for the position or internship programme applied for	Education, professional experience, competencies, foreign language, certificates, interview and assessment information	KVKK Art. 5/2-f
Conducting interview, test, inventory, assessment and reference-check processes	Application, assessment, reference and professional experience information	KVKK Art. 5/2-f; explicit consent where required
Conducting the job-offer process and preparing for the establishment of an employment contract for successful applicants	Identity, contact, education, professional experience and application information	KVKK Art. 5/2-c
Conducting internship suitability and placement processes for intern candidates	Identity, contact, education, application and assessment information	KVKK Art. 5/2-c and Art. 5/2-f
Conducting human-resources planning and recruitment processes	Application, assessment, professional experience and competency information	KVKK Art. 5/2-f
Fulfilling legal obligations and responding to requests from authorised institutions	Identity, contact, application, transaction security and technical data	KVKK Art. 5/2-ç: Fulfilment of the data controller's legal obligations
Retaining records as evidence in potential disputes	Application records, interview notes, assessment information and log records	KVKK Art. 5/2-e: Establishment, exercise or protection of a right
Considering the candidate for suitable future positions in the candidate pool if the application is unsuccessful	CV, contact, application and assessment information	Explicit consent
Ensuring information and system security and the secure operation of the application platform	Transaction security and technical data	KVKK Art. 5/2-f and Art. 5/2-ç

Special categories of personal data may only be processed where the conditions specified in Article 6 of the KVKK are met and the necessary security measures are taken. Where required, the candidate's explicit consent may be obtained.

4. Methods of Collecting Your Personal Data

Your personal data may be collected through the following channels and methods:

• Employment and internship application forms on the Redstar website,
• Applications submitted by e-mail,
• Career platforms,
• LinkedIn and similar professional social networks,
• Recruitment and consultancy firms,
• Résumés, cover letters, certificates and other documents submitted by the candidate,
• Interviews, meetings, tests and assessment processes,
• Reference persons provided by the candidate,
• Authorised public institutions and organisations,
• Internal human resources and assessment processes,
• Technical/log records generated through application systems and digital platforms.

Your personal data may be processed by wholly or partly automated means, or by non-automated means provided that the processing forms part of a data filing system.

5. Transfer of Your Personal Data

Your personal data may be transferred, where necessary and proportionate, to the following persons, institutions and organisations for the purposes stated above and in accordance with Articles 8 and 9 of the KVKK:

• Authorised departments and managers involved in the recruitment process within Redstar,
• Business partners providing human resources, information technology, legal, audit and consultancy services,
• Providers of application, assessment, e-mail, data storage, cloud, software and technical infrastructure services,
• Group companies, the principal shareholder or affiliates involved in assessment processes relating to the position applied for, only where necessary,
• Reference persons provided by the candidate,
• Authorised public institutions and organisations,
• Courts, enforcement offices, administrative authorities and other authorised official bodies,
• Other persons and organisations permitted by law.

Your personal data may be transferred abroad due to the use by Redstar of digital systems, cloud services, e-mail infrastructures and software service providers in recruitment and business operations, as well as organisations providing services in training and certification processes and, where necessary, group companies.

Where your personal data must be transferred abroad, such transfers will be carried out on the basis of an adequacy decision, appropriate safeguards, standard contracts, binding corporate rules or other transfer mechanisms provided for by law, in accordance with Article 9 of the Law No. 6698 on the Protection of Personal Data and the relevant legislation.

Redstar takes the necessary technical and administrative measures under the KVKK when transferring your personal data domestically or abroad.

6. Retention of Your Personal Data

Your personal data will be retained for as long as required by the purposes stated in this Notice, taking into account the limitation, retention and evidentiary periods prescribed by the applicable legislation.

When the reasons requiring the processing of personal data cease to exist, your data will be deleted, destroyed or anonymised in accordance with the applicable legislation and Redstar's Personal Data Retention and Destruction Procedure.

7. Rights of the Data Subject and Application Method

Pursuant to Article 11 of the KVKK, you have the following rights in relation to your personal data:

• To learn whether your personal data is being processed,
• To request information if your personal data has been processed,
• To learn the purpose of processing your personal data and whether it is being used in accordance with that purpose,
• To know the third parties to whom your personal data has been transferred domestically or abroad,
• To request correction where your personal data has been processed incompletely or inaccurately,
• To request the deletion or destruction of your personal data under the conditions set out in the KVKK,
• To request that correction, deletion or destruction operations be notified to third parties to whom your personal data has been transferred,
• To object to the occurrence of a result against you through the analysis of your processed data exclusively by automated systems,
• To claim compensation for damages if you suffer loss due to the unlawful processing of your personal data.

You may submit your requests concerning your rights under the KVKK to Redstar by the following methods:

• By applying in person in writing at the Company address,
• Through a notary public,
• Using a secure electronic signature or mobile signature,
• Via our registered electronic mail (KEP) address: redstarhavacilik@hs01.kep.tr
• By sending an application to hr@redstar.com.tr using the e-mail address that you previously provided to our Company and that is registered in our systems.

Your applications will be concluded within the periods prescribed by the KVKK and the relevant legislation following identity verification.

To ensure that applications are evaluated accurately and securely, your request must include your name and surname, contact details, the subject of your request and the information required to verify your identity.