Website Visitor Privacy Notice

This information notice has been prepared pursuant to Article 10 of the Personal Data Protection Law No. 6698 (“Law”) titled “Obligation to Inform of the Data Controller”, regarding your personal data collected, stored, and processed by Coca-Cola İçecek A.Ş. and/or Coca-Cola Satış ve Dağıtım A.Ş., acting as the “Data Controller” (both referred to as “our Company” or “CCI”).

Within the scope of our Company’s approach to conducting all of its activities in accordance with the principles of lawfulness, good faith, and transparency, we would like to state that the personal data you shared while visiting the website http://www.cci.com.tr/ and/or logging in as a user will be processed within the framework set out under the Law.

Your Processed Personal Data, Processing Purposes and Legal Basis

Transaction Security Data	IP address information, website login and logout information, log records
Online Visit Data	Cookie information

All of your personal data mentioned above is processed by our Company for the purposes of providing services to you, conducting information security processes, and fulfilling our legal obligations, within the scope of the Law, based on the processing conditions of “being mandatory for the data controller to fulfill its legal obligation” and “being mandatory for the establishment, exercise, or protection of a right.”

Method of Collecting Your Personal Data

Your personal data is collected through cookies used during your visit to our Company’s website and by automatic or partially automatic methods in electronic environments.

Parties to Whom Your Personal Data is Transferred and Purposes of Transfer

Domestic Transfer

For the purposes explained above and to ensure the proper performance of services, our Company transfers and shares your personal data with:

• information technology and infrastructure service providers for the operation of the website and ensuring data security,
• competent authorities, where necessary, for the purposes of (i) complying with administrative requests, court decisions, or legal obligations; (ii) defending our Company against claims/demands of third parties; and (iii) supporting fraud prevention or investigations.

Transfer Abroad

Your personal data is transferred to:

• software and analytics service providers located abroad for the purposes of measuring website performance and improving user experience,
• server, hosting, and cloud service providers located abroad for the purposes of website hosting, data storage, and backup activities.

During such transfers, the methods determined by the Personal Data Protection Board (“Board”) are used, and processes such as standard contractual clauses, binding corporate rules, or Board-approved data transfer protocols are implemented.

Your Rights Regarding the Protection of Your Personal Data

You may submit your requests regarding your personal data processed by our Company within the scope of Article 11 of the Law by applying in accordance with the Communiqué on the Principles and Procedures for the Request to the Data Controller. Your applications may be submitted in writing to the Human Resources Department at our Company’s address (Dudullu OSB Mah. Deniz Feneri Sok. No: 4 Ümraniye, İstanbul), or electronically via registered e-mail (KEP), secure electronic signature, mobile signature, or by using the e-mail address previously notified to our Company and registered in our systems, to the following addresses: cocacolaicecek@hs03.kep.tr for Coca-Cola İçecek A.Ş. and cocacolasatisvedagitim@hs03.kep.tr for Coca-Cola Satış ve Dağıtım A.Ş.

Updates

This Privacy Notice may be updated in line with changes in legislation and/or our Company’s data processing activities.

Shareholder Privacy Notice

This information notice has been prepared pursuant to Article 10 of the Personal Data Protection Law No. 6698 (“Law”) titled “Obligation to Inform of the Data Controller”, regarding your personal data collected, stored, and processed by Coca-Cola İçecek A.Ş. and/or Coca-Cola Satış ve Dağıtım A.Ş., acting as the “Data Controller” (both referred to as “our Company” or “CCI”).

Within the scope of our Company’s approach to conducting all of its activities in accordance with the principles of lawfulness, integrity, and transparency, we would like to state that your personal data shared with our Company will be processed within the framework set forth under the Law.

Your Processed Personal Data, Processing Purposes and Legal Basis

The data categories listed below are not processed for all shareholders to the same extent; only the personal data required for the relevant process is processed.

Identity Data	Name, surname, Turkish identification number
Contact Data	Address, e-mail address, telephone number
Financial Data	Shareholding information, shareholding ratio, investor number
Legal Transaction Data	Power of attorney information, general assembly attendance records, list of attendants information

All of your data mentioned above is processed for the purposes of planning and conducting general assembly meetings, keeping and verifying shareholding records, fulfilling legal notification and reporting obligations, providing information to shareholders, managing shareholders’ information requests, fulfilling our Company’s legal obligations, responding to requests of authorized institutions and organizations, conducting corporate governance and investor relations processes, and carrying out analyst and investor information processes.

This processing is carried out within the scope of the Law based on the processing conditions of “being explicitly stipulated by law”, “being mandatory for the data controller to fulfill its legal obligation” and “being mandatory for the establishment, exercise, or protection of a right”.

Method of Collecting Your Personal Data

Your personal data is collected through power of attorney and participation documents, electronic general assembly system records, and records transmitted by the Central Securities Depository and Trade Repository of Türkiye, within the scope of conducting general assembly processes; as well as by being physically submitted by you or provided via e-mail, telephone, and other communication channels. Such data is collected through automatic or partially automatic methods in physical and electronic environments.

Parties to Whom Your Personal Data is Transferred and Purposes of Transfer

Domestic Transfer

For the purposes explained above and to ensure the proper performance of services, our Company transfers your personal data to:

• authorized public institutions and organizations for the purposes of planning and conducting general assembly meetings, verifying and maintaining shareholding records, preparing the list of attendants, conducting electronic general assembly processes, fulfilling our Company’s legal obligations, and responding to requests of authorized institutions and organizations,
• companies within the group to which our Company belongs and shareholder companies, for the purposes of ensuring coordination with group companies, fulfilling reporting requirements, and complying with legal obligations.

Transfer Abroad

Your personal data is transferred to:

• service providers located abroad offering cloud computing and information technology infrastructure services, for the purposes of conducting our Company’s activities and providing information technology infrastructure,
• companies within the group to which our Company belongs and shareholder companies, for the purposes of ensuring coordination with group companies, fulfilling reporting requirements, and complying with legal obligations.

During such transfers, the methods determined by the Personal Data Protection Board (“Board”) are used, and processes such as standard contractual clauses, binding corporate rules, or Board-approved data transfer protocols are implemented.

Your Rights Regarding the Protection of Your Personal Data

You may submit your requests regarding your personal data processed by our Company within the scope of Article 11 of the Law by applying in accordance with the Communiqué on the Principles and Procedures for the Request to the Data Controller. Your applications may be submitted in writing to the Human Resources Department at our Company’s address (Dudullu OSB Mah. Deniz Feneri Sok. No: 4 Ümraniye, İstanbul), or electronically via registered e-mail (KEP), secure electronic signature, mobile signature, or by using the e-mail address previously notified to our Company and registered in our systems, to the following addresses: cocacolaicecek@hs03.kep.tr for Coca-Cola İçecek A.Ş. and cocacolasatisvedagitim@hs03.kep.tr for Coca-Cola Satış ve Dağıtım A.Ş.

Updates

This Privacy Notice may be updated in line with changes in legislation and/or our Company’s data processing activities.

Customer Privacy Notice

This Privacy Notice has been prepared for the purpose of informing you regarding your personal data processed by Coca-Cola İçecek A.Ş. and/or Coca-Cola Satış ve Dağıtım A.Ş. (both referred to as the “our Company”) acting as the data controller, in accordance with the Personal Data Protection Law No. 6698 (“Law”).

Our Company respects your personal data within the scope of its approach to conducting all its activities in compliance with the principles of lawfulness, integrity, and transparency, and demonstrates the utmost care to ensure the security of your personal data in line with applicable legislation and universal values. Your personal data is processed lawfully and in accordance with the principles set forth in Article 4 of the Law.

Your Processed Personal Data, Collection Methods, Processing Purposes and Legal Basis

Within the scope of the commercial relationship you have established with our Company as a customer, your personal data shared with us or obtained through contracts, order and sales processes, communication channels, physical or electronic forms, and our Company’s information systems, as listed below, are collected through automatic, partially automatic, or non-automatic methods provided that they form part of a data recording system, and are processed for the purposes set forth below.

Identity Data	Name, surname, Turkish identification number, foreign identification number, tax identification number, date of birth, customer number, signature
Contact Data	Mobile phone number, e-mail address, address information
Customer Transaction Data	Order information, invoice information, current account information
Financial Data	Bank and account information, collateral information, payment information
Legal Transaction Data	Contract information, authorization documents, commercial activity records, lawsuit and enforcement file information in case of disputes
Request/Complaint Management Data	Submitted requests, complaints, feedback and related transaction records, call center records if you engage in communication
Training Data	Completion status of training and activities
Marketing Data	Order history information, survey records, campaign information, lottery information

Processed Personal Data and Purposes of Processing	Legal Basis
Identity, Contact, Customer Transaction and Financial Data Conducting commercial contract processes Conducting order, sales, distribution, and logistics operations Managing dealer and customer relationships Conducting invoicing, accounting, finance, and collection processes Planning and reporting of internal operations Conducting compliance and audit activities Fulfilling legal obligations Managing legal disputes	Explicitly stipulated by law Mandatory for the data controller to fulfill its legal obligation Mandatory for the establishment, exercise, or protection of a right Necessary for processing personal data of the parties to a contract, provided that it is directly related to the establishment or performance of the contract
Legal Transaction Data Conducting contract processes Audit, reporting, and dispute management Monitoring legal processes	Necessary for the establishment or performance of a contract Mandatory for the establishment, exercise, or protection of a right Mandatory for the data controller to fulfill its legal obligation
Request/Complaint Management Data Managing customer requests and complaints Conducting call center processes Improving service quality	Mandatory for the establishment, exercise, or protection of a right Mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject
Training Data Conducting and monitoring training and event activities	Mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject
Marketing Data Conducting marketing analysis activities Managing satisfaction processes regarding products and services Conducting customer relationship management processes Conducting advertising, campaign, and promotion processes	Your explicit consent

Parties to Whom Your Personal Data is Transferred and Purposes of Transfer

Your personal data processed lawfully by our Company as described above will be transferred to the parties listed below, domestically or abroad, in accordance with Articles 8 and 9 of the Law, for the realization of the purposes stated above.

Domestic Transfer

Your personal data is transferred to:

• group companies for the purposes of carrying out our Company’s corporate reporting processes,
• distributors, logistics and cargo companies, dealers, or authorized business partners providing shipment services within the scope of order processes,
• suppliers providing call center services for the purpose of conducting call center operations,
• suppliers and service providers for the purposes of operating information technology infrastructure, providing technical support, and performing operational processes,
• banks and financial institutions for the purposes of conducting finance and accounting processes, collection activities, and managing financial operations,
• independent audit firms, law firms, and third parties providing consultancy services for audit, consultancy, and compliance processes,
• authorized public institutions and organizations for the purpose of fulfilling legal obligations and responding to official requests.

Transfer Abroad

Your personal data is transferred to:

• group companies for the purposes of carrying out our Company’s corporate reporting processes,
• information technology service providers located abroad for the purposes of operating information technology systems, carrying out data storage activities, and ensuring global system infrastructure,
• information technology service providers located abroad within the scope of operating IT systems used to support order, finance, and accounting processes as well as audit and compliance activities.

During international transfers, the methods determined by the Personal Data Protection Board (“Board”) are used, and processes such as standard contractual clauses, binding corporate rules, or Board-approved data transfer protocols are implemented.

Your Rights Regarding the Protection of Your Personal Data

You may submit your requests regarding your personal data processed by our Company within the scope of Article 11 of the Law by applying in accordance with the Communiqué on the Principles and Procedures for the Request to the Data Controller. Your applications may be submitted in writing to the Human Resources Department at our Company’s address (Dudullu OSB Mah. Deniz Feneri Sok. No: 4 Ümraniye, İstanbul), or electronically via registered e-mail (KEP), secure electronic signature, mobile signature, or by using the e-mail address previously notified to our Company and registered in our systems, to the following addresses: cocacolaicecek@hs03.kep.tr for Coca-Cola İçecek A.Ş. and cocacolasatisvedagitim@hs03.kep.tr for Coca-Cola Satış ve Dağıtım A.Ş.

Updates

This Privacy Notice may be updated in line with changes in legislation and/or our Company’s data processing activities.