Personal Data Protection Disclosure

At WattSkor, we place great importance on the protection of your personal data under the Personal Data Protection Law No. 6698 ("KVKK"). This disclosure text explains the purposes for which your personal data is processed, to whom it is transferred, and your rights under the KVKK.

1. Data Controller

Data controller under the Personal Data Protection Law No. 6698 ("KVKK"): Name: Ilker Mustafa Abut Platform: WattSkor (wattskor.com) Address: Luleburgaz, Kirklareli, Turkey Email: info@wattskor.com Phone: +90 536 870 39 06

2. Personal Data Processed

The following personal data is processed within the WattSkor platform: Identity Information: - First name, last name - Email address - Phone number Account Information: - Username and password (stored encrypted) - Registration date and last login time - Subscription plan and payment status Business Information: - Company/facility name - Facility location - Transformer and meter configurations Technical Data: - IP address - Browser type and version - Operating system - Session cookies Energy Data: - Measurement data from energy meters (current, voltage, power, energy consumption, harmonics) - This data is not directly personal data and is processed on a per-facility basis.

3. Purpose of Processing Personal Data

Your personal data is processed for the following purposes: - Completing membership and account creation processes - Providing platform services (energy monitoring, analysis, reporting) - Managing subscription and payment processes - Providing technical support and customer services - Sending alarms and notifications (email, Telegram) - Ensuring platform security and preventing unauthorized access - Fulfilling legal obligations - Improving service quality and developing new features

4. Transfer of Personal Data

Your personal data may be transferred to third parties domestically and/or internationally in the following cases: International Transfer: - Supabase (database and authentication — EU region) - Vercel (hosting and server infrastructure) - Stripe (payment processing) - Google Analytics (anonymous usage statistics) - Sentry (error tracking — anonymous technical data) Domestic Transfer: - iyzico (payment processing — post-integration) Transfer Justifications: - Providing technical infrastructure for the service (KVKK Art.5/2-c: performance of the contract) - Fulfilling legal obligations (KVKK Art.5/2-a) - Your explicit consent (KVKK Art.5/1) Your personal data will under no circumstances be sold to or shared with third parties for marketing or advertising purposes.

5. Data Retention Period

Your personal data is retained for the duration required by the processing purpose: - Account information: During membership + 30 days from account deletion request - Payment information: Legal retention period (10 years, Turkish Commercial Code) - Energy data: 3 months to 1 year depending on subscription plan - Log records: 1 year (as required by Law No. 5651) - Cookie data: Session cookies — end of session; persistent cookies — up to 1 year Data whose retention period has expired is deleted, destroyed, or anonymized as part of periodic disposal processes.

6. Data Security Measures

The following technical and administrative measures are taken to ensure the security of your personal data: Technical Measures: - Data transmission with TLS/SSL encryption - Database encryption - Strong password policy and hashing (bcrypt) - Role-based access control (RBAC) - Automatic backup Administrative Measures: - Data processing inventory - Access authorization matrix - Data breach notification procedure - Periodic data review and disposal

7. Data Subject Rights

Pursuant to Article 11 of the KVKK, you have the following rights: a) To learn whether your personal data is being processed b) To request information if your personal data has been processed c) To learn the purpose of processing your personal data and whether it is used in accordance with its purpose d) To know the third parties to whom personal data is transferred domestically or internationally e) To request correction of personal data if it has been processed incompletely or incorrectly f) To request deletion or destruction of personal data within the framework of the conditions set forth in Article 7 of the KVKK g) To request that operations carried out pursuant to paragraphs (e) and (f) be notified to third parties to whom personal data has been transferred h) To object to a result that arises against the person through the exclusive analysis of processed data by automated systems i) To claim compensation for damages incurred due to unlawful processing of personal data

8. Application Method

You may apply through the following methods to exercise your rights under the KVKK: Via Email: You may apply to info@wattskor.com with documents verifying your identity. Simply write "KVKK Application" in the email subject line. Written Application: You may apply to the address Luleburgaz, Kirklareli, Turkey via notary public or registered mail with return receipt. Your applications will be answered free of charge within 30 days at the latest. If the process requires an additional cost, the fee determined by the Personal Data Protection Board may be charged. This disclosure text entered into force on March 24, 2026.