Code of Business Ethics Procedure

• Ensuring that legal processes are initiated on time to secure intellectual property rights for newly developed products, processes, and software, and respecting third-party IP rights.
• Including intellectual property infringement liability clauses in supplier contracts and signing confidentiality agreements.
• Increasing awareness through annual IP training programs (priority for R&D, Production, Procurement, and Sales teams).
• Ensuring that critical designs and documents are stored in locked physical archives or authorized digital environments, and monitoring continuity through internal audits.

• Ensuring that all legal records are kept complete and accurate, and not disclosing any confidential information without senior management approval.
• Implementing data security processes in compliance with the PDPL and ISO 27001, and enhancing awareness levels through annual training programs.
• Not responding to requests from third parties for information classified as confidential for the Company without senior management approval.
• Exercising due care to ensure that the Company's disclosures and reports are accurate and reflect the truth.

• Taking necessary measures to protect Company employees, information and information systems, and factory and administrative facilities against potential terrorism, natural disasters, and malicious acts.
• Developing emergency crisis management plans for events such as terrorism or natural disasters, ensuring business continuity with minimal disruption during a crisis.
• Implementing all necessary precautions to prevent theft or damage to Company assets.
• Testing crisis management and business continuity plans at least once a year through drills, and documenting the results.
• Providing all employees with annual emergency preparedness training. For new hires, this training is a mandatory part of the orientation program.
• Implementing physical access controls in critical infrastructures (e.g., server rooms, production lines) and restricting access to authorized personnel only.

• Financial and commercial secrets of the Company, information that could weaken competitive advantage, employee rights and data, and contracts and information related to business partners are confidential; all employees are responsible for maintaining this confidentiality.
• Confidential documents are stored in digital systems with defined access rights or in locked physical archives; access permissions are periodically reviewed, and unauthorized access controls are enforced.
• Confidential information obtained in the course of work must not be shared with unauthorized internal or external individuals or authorities, and must not be used directly or indirectly for speculative purposes.
• Before sharing information with third parties, the scope must be defined, approval must be obtained from the relevant manager and/or HR Department, and a confidentiality agreement must be signed.
• Critical data is regularly backed up, and the integrity of backups is tested at defined intervals. Relevant records are retained for the periods specified in the Record Retention Table.
• Personal data is processed for specific, explicit, and legitimate purposes in accordance with the PDPL; data minimization principles are applied, and retention periods are managed in compliance with the PDPL.
• Any suspected breach of confidentiality must be reported immediately to managers and/or the HR Department; if necessary, the Ethics Committee and Information Security processes are activated, and the Disciplinary Procedure is applied.

Employees may not use their position, authority, or title to obtain any benefit for themselves, their relatives, or third parties. Any conflicts of interest arising from personal investments or relationships must be disclosed and managed proactively.

• Pre-employment disclosure: Ownership, shares, or investments in other companies must be disclosed during the hiring process and are reviewed during candidate interviews. Any subsequent changes must be reported in writing by the employee to their manager and the Human Resources Department.
• Prohibition of improper benefit: Employees may not use their title or authority to gain advantages for themselves, relatives, or third parties.
• Personal investments and secondary activities: These must be conducted in a manner that does not create conflicts of interest with the Company or hinder job performance and focus.
• Familial relationships: If an employee has a first-degree relative in a decision-making position on the customer or supplier side, this must be reported immediately to the direct manager; delegation of duties or authority may be implemented if necessary.
• Learned benefit ties: If it is discovered that relatives hold shares or interests in companies with which the Company has business relations, immediate disclosure is required.
• Risk management in ongoing positions: Employees occupying positions with potential conflicts of interest must notify Human Resources. A risk assessment is conducted, the issue is recorded in the risk analysis table, and rotations may be implemented when necessary.
• Non-compliance management: When required, the matter is escalated to the Ethics Committee; the CAPA process may be initiated, and the provisions of the Disciplinary Procedure may be applied.

• General rule: Except for conferences, receptions, seminars, or other events open to the general public, participation in invitations such as sporting activities or domestic/international trips that may influence business decisions requires approval from the relevant department manager.
• Prohibited invitations: Invitations that are luxurious, excessive, or frequently recurring and could influence business decisions are not accepted.
• Non-compliance management: Suspicious or inappropriate situations reported to Human Resources are escalated to the Ethics Committee; the CAPA process may be initiated if necessary, and the provisions of the Disciplinary Procedure are applied.

A gift is an item that does not require a monetary payment and is generally given by individuals or customers with whom a business relationship exists, as a gesture of appreciation or commercial courtesy. The principles regarding gifts are also outlined in the 'Gifts' section of the EAE Elektrik Anti-Bribery and Anti-Corruption Policy.

Furthermore, in managing relationships with private or public individuals and organizations that wish to establish or maintain business relations with the Company, adherence to the following principles is required:

• Gifts other than promotional items that may create a perception of dependency must not be accepted or offered.
• Improper benefits from suppliers, dealers, customers, group companies, or third parties must not be accepted; if offered, they must be refused and reported to the Ethics Committee.
• In cases of uncertainty, employees must consult the Ethics Committee in writing; no action may be taken without approval.

Engaging in business with EAE Group companies after leaving a position—whether by establishing a company or becoming a partner in an existing company to provide services such as sales, contracting, consulting, brokerage, representation, dealership, or similar activities—is a highly sensitive matter that may create negative perceptions. Throughout such processes, before or after employment, individuals must act in the best interests of the EAE Group, adhere to moral and ethical standards, and ensure that no conflicts of interest arise.

For a supplier in such a situation, the relevant manager must contact the EAE Group company where the supplier was previously employed, prepare a report confirming that no improper situation exists, and inform their superior. If any inappropriate situation is identified, no business relationship should be established with the individual.

Exceptions and the relationships established are reviewed annually by the Ethics Committee.

Except for exceptional cases requiring Board approval, to prevent negative perceptions, approval for such business relationships must not be granted until at least two years have passed since the employee left the EAE Group.

This period aligns with the waiting periods applied under the Anti-Corruption Guide and Competition Law to effectively eliminate conflicts of interest.

When a business relationship is established, contracts must include clauses on conflicts of interest, prohibition of bribery and gifts, transparency, and termination; in case of violation, the contract may be terminated immediately.

It must be understood that attempting to obtain any commercial benefit by using or disclosing any confidential information belonging to the Company or the EAE Group to third parties is a legal offense and must never be attempted.

Furthermore, employees and suppliers must access confidential information strictly for business purposes, and in the event of data leakage or improper disclosure, they are required to report it through the internal reporting mechanisms ([email protected] and/or the Grievance and Complaint System).

Information security risks are periodically assessed, technical and administrative controls are implemented to prevent unauthorized access, and in the event of non-compliance, the CAPA (Corrective and Preventive Action) process is initiated.