FORENSCOPE SCIENTIFIC TEKNOLOJI LTD. ŞTI.

COMPREHENSIVE GLOBAL DATA PROTECTION & PRIVACY POLICY

Effective Date: May 4, 2026

---

1. INTRODUCTION & CONTROLLER IDENTITY

Forenscope Scientific Teknoloji Ltd. Şti. (“Forenscope”, “Company”, “we”, “us”, or “our”) is highly committed to safeguarding the privacy, confidentiality, and security of your personal data. We operate globally from our headquarters in the Istanbul Free Trade Zone, Turkey. This Comprehensive Privacy Policy is designed to comply with the strictest global data protection frameworks, including the European Union General Data Protection Regulation (GDPR) 2016/679, the Turkish Personal Data Protection Law No. 6698 (KVKK), and applicable United States laws such as the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). For the purposes of applicable data protection laws, Forenscope acts as the Data Controller regarding the personal data described in this policy.

2. CATEGORIES OF PERSONAL DATA COLLECTED

We process personal data transparently and limit collection to what is strictly necessary. Depending on your interaction with us, we may collect the following categories of personal data:

• IDENTITY DATA: First name, last name, title, and corporate affiliation.
• CONTACT DATA: Professional email address, telephone number, billing address, and delivery address.
• COMMERCIAL & TRANSACTIONAL DATA: Details regarding products/services purchased, demo requests, payment status, and history of correspondence.
• TECHNICAL & USAGE DATA: Internet Protocol (IP) address, browser type and version, time zone setting, browser plug-in types, operating system, device identifiers, and information about how you use our website.
• MARKETING & COMMUNICATIONS DATA: Your preferences in receiving marketing materials from us and your communication preferences.

3. COLLECTION METHODS

We collect data through the following methods:

• Direct Interactions: When you fill in forms on our website (e.g., demo requests), correspond with us by post, phone, email, or hand us your business card at congresses/events.
• Automated Technologies: As you interact with our website, we automatically collect Technical Data about your equipment, browsing actions, and patterns using cookies and server logs.
• Third Parties & Public Sources: We may receive data from analytics providers (e.g., Google), advertising networks (e.g., Meta), and authorized global distributors.

4. PURPOSES AND LEGAL BASIS FOR PROCESSING

Under GDPR Article 6 and 13, we must establish a valid legal basis to process your data. We rely on the following matrix:

Purpose/Activity	Data Categories	Lawful Basis for Processing
To register you as a new customer, manage demo requests, and fulfill product/service deliveries.	Identity, Contact, Commercial	Performance of a contract with you.
To manage our relationship with you (e.g., notifying you about changes to our terms, handling support queries and complaints).	Identity, Contact, Commercial	(a) Performance of a contract. (b) Necessary to comply with a legal obligation. (c) Necessary for our legitimate interests (to keep records updated).
To administer and protect our business and website (including troubleshooting, data analysis, testing, system maintenance, and logging).	Identity, Contact, Technical	(a) Necessary for our legitimate interests (running our business, network security). (b) Compliance with legal obligations (e.g., Law No. 5651).
To deliver relevant website content, newsletters, congress invitations, and advertisements to you.	Identity, Contact, Technical, Marketing	Explicit Consent (for direct electronic marketing and targeting cookies).

5. DISCLOSURES AND INTERNATIONAL DATA TRANSFERS

We may share your personal data with strictly vetted third parties, including IT service providers, global authorized distributors, professional advisers (lawyers, auditors), and regulatory authorities when mandated by law.

Cross-Border Transfers: As Forenscope is headquartered in Turkey, collecting personal data from individuals in the European Economic Area (EEA) constitutes a transfer outside the EEA. We ensure an equivalent degree of protection is afforded to it by implementing at least one of the following safeguards:

• We use specific contracts approved by the European Commission, known as Standard Contractual Clauses (SCCs), which give personal data the same protection it has in Europe.
• We transfer data to third-party processors (e.g., cloud storage, CRM, Mailchimp) based in jurisdictions that have received an Adequacy Decision, or subject them to SCCs.

6. DATA RETENTION POLICY

We will only retain your personal data for as long as reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements. Our specific retention periods are:

• Financial, Tax, and Commercial Records: Kept for up to 10 years following the end of the business relationship to comply with statutory accounting laws and commercial statutes of limitations.
• Product Liability & Warranty Records: Kept for up to 15 years to defend against potential legal claims regarding product performance and safety.
• Marketing Data: Retained until you withdraw your consent (opt-out). Inactive B2B records will be securely purged after 3 to 5 years of no engagement.

7. YOUR DATA SUBJECT RIGHTS (GDPR & CCPA/CPRA)

Under certain circumstances, you have rights under data protection laws in relation to your personal data:

• Request Access: Receive a copy of the personal data we hold about you.
• Request Correction: Have any incomplete or inaccurate data we hold about you corrected.
• Request Erasure: Ask us to delete personal data where there is no good reason for us continuing to process it (“Right to be Forgotten”).
• Object to Processing: Object where we are relying on a legitimate interest, or where we are processing for direct marketing purposes.
• Request Restriction: Ask us to suspend the processing of your personal data under certain scenarios.
• Withdraw Consent: Withdraw consent at any time where we are relying on consent to process your personal data.
• CCPA/CPRA Specific Rights: You have the right to know what data is collected, the right to opt-out of the sale or sharing of personal data, and the right to non-discrimination. Notice: Forenscope does not and will not sell your personal data.
• Right to Complain: If you are an EU/EEA resident, you have the right to make a complaint at any time to your relevant national Supervisory Authority (Data Protection Authority).

8. DATA SECURITY MEASURES

We have put in place robust security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. Access to your personal data is limited to those employees, agents, contractors, and other third parties who have a strict business need to know. They will only process your personal data on our instructions and are subject to a duty of confidentiality.

9. COOKIES AND TRACKING TECHNOLOGIES

Our website uses cookies to distinguish you from other users, which helps us provide a better experience. Strictly necessary cookies are deployed automatically. Non-essential cookies (such as analytics and targeting cookies like Meta Pixel) are deployed only if you grant explicit consent via our cookie banner. You can set your browser to refuse all or some browser cookies.

10. Administrative Contact & Requests

If you have any questions about this privacy policy or wish to exercise your legal rights, please contact our Legal & Compliance Department:

Email: legal@forenscope.com
Physical Address: Forenscope Scientific Teknoloji Ltd. Şti., Yeşilköy SB Mahallesi, Havalimanı Caddesi, C Blok Sokak C Blok No:3 34149 Bakırköy, ISTANBUL – TURKEY

We try to respond to all legitimate requests within 30 days as mandated by global laws.

---

Forenscope Scientific Teknoloji Ltd. Şti. | Global Privacy & Data Protection Compliance