APPLICATION PRIVACY POLICY

Effective Date: 01.07.2026

Data Controller

Trade NameSunchronize

MERSIS No2880753977600001

Tax Office / NoKozyatağı / 7250214960

E-mailinfo@sunchronize.com

Webwww.sunchronize.com

01INTRODUCTION

Sunchronize (referred to as "Sunchronize") undertakes to protect the online privacy of the users of this Website/Application (the "Application"). For this reason, this Privacy Policy has been written to enable you to understand Sunchronize’s policy regarding your privacy, as well as how your personal information will be handled while using the Application. This Privacy Policy also contains information relating to your being informed about the processing of your personal data and, where necessary, the obtaining of your explicit consent.

In general, all information and data that you provide to Sunchronize through the Application in the context of the use of Sunchronize’s services, or that is otherwise collected by Sunchronize through the Application (the "Services", as described in the Terms of Use), will be processed by Sunchronize in a lawful, fair and transparent manner. To this end, and as explained in more detail below, Sunchronize takes into account internationally recognised principles relating to the processing of personal data, such as purpose limitation, compliance with retention periods, data minimisation, data quality and confidentiality.

02DATA CONTROLLER AND CONTACT

Sunchronize, whose corporate details appear at the beginning of this Privacy Policy, is the data controller of the personal data processing activities carried out through the Application.

You may address your questions regarding this Privacy Policy and our personal data processing activities to info@sunchronize.com.

03APPLICABLE DATA PROTECTION LEGISLATION

Sunchronize processes personal data in accordance with the applicable data protection legislation: in Türkiye, the Personal Data Protection Law No. 6698 (KVKK); in the European Union and the European Economic Area and in the United Kingdom, the General Data Protection Regulation (GDPR); and in other countries, the relevant local legislation. The rights held by the data subject may vary according to the legislation of the country in which they are located.

04PERSONAL DATA PROCESSED

When you use the Application, Sunchronize obtains and may process your personal data that may directly identify you or that, when combined with other information, may render you identifiable. Should you choose to share it with Sunchronize, Sunchronize may likewise collect and process information relating to other persons.

This information of yours is characterised as "Personal Data" and may be collected and processed both by being shared directly by you (for example, when you carry out a transaction through the relevant forms and screens on the application) and by means of the analysis of your behaviour on the Application.

The Personal Data that may be processed by Sunchronize through the Application is as follows:

05IDENTITY, CONTACT DETAILS AND OTHER PERSONAL DATA

In order to access Sunchronize’s Services offered through the Application (for example, contacting Sunchronize to request further information, or registering on our platform), Sunchronize may process your personal data such as identity information (first name, surname), contact information (e-mail address, telephone number), location (the location where the solar panel is installed, GPS location or coordinates) and images (visuals of the area where the solar panels are installed, camera access, photographs). For further information, you may refer to the Terms of Use.

06PERSONAL DATA OF OTHER PERSONS

Should you decide to share, through the Application, Personal Data relating to other persons, you will be regarded as an independent data controller in respect of such Personal Data and, by its very nature, all legal obligations and liabilities will rest with you. In addition to these matters, you are obliged to indemnify Sunchronize against any complaint, allegation or claim for compensation for damages that may arise from the processing of the Personal Data you provide to Sunchronize and/or that may be asserted by the third parties whose information you have provided.

Sunchronize does not collect this information directly from third parties; rather, it obtains such information indirectly from you. For this reason, before providing Sunchronize with any information relating to third parties, you must ensure that you have obtained the consent of those persons. Otherwise, you must ensure that you have another appropriate legal ground on which you may rely in order to lawfully transmit such information to Sunchronize.

07BROWSING DATA

The operation of the Application, as with other internet sites on the internet, requires the use of computer systems and software procedures that collect information about the users of the Application as part of their routine operations. Sunchronize does not collect this information for the purpose of associating it with specific users; nevertheless, it remains possible for such users to be identified directly through this information or indirectly through other information collected. For this reason, this information is also regarded as Personal Data.

This information includes several parameters relating to your operating system and information technology environment, including your IP address, your location (country), your computer’s domain names, the URI (Uniform Resource Identifier) addresses of the resources you request on the Application, the time of the requests made, the method used to transmit the requests to the server, the size of the file obtained in response to a request, and the numerical code indicating the status of the response sent by the server (successful, error, etc.).

This data is used to compile statistical information regarding the use of the Application, as well as to ensure the correct operation of the Application and to detect any faults and/or misuse of the Application.

08SOLAR SYSTEM AND INTEGRATION DATA

Sunchronize processes technical data relating to your solar system (number of panels, capacity, installation date, inverter make and model), the energy production and performance data generated by the system, fault/alert records, and meteorological data relating to the site on which your system is installed. Some of this data is obtained automatically from the systems of the inverter manufacturer (for example SolarEdge, Fronius, Huawei, Enphase) where you have granted authorisation.

The third-party service credentials that you provide in order to establish this integration (API keys, access tokens and OAuth authorisations) are stored encrypted and are used solely for the purpose of retrieving data belonging to your system; they are not shared with third parties. You may withdraw the authorisation you have granted at any time through the relevant third-party service; in such case Sunchronize cannot access the relevant data.

09PAYMENT AND SUBSCRIPTION DATA

Your subscription status, credit balance, purchase and transaction records and invoice information are processed. Your credit card information is not processed by Sunchronize; such data is processed directly through the PCI-DSS compliant infrastructure of the relevant payment service provider (App Store, Google Play, or Paddle in its capacity as Merchant of Record). Only a record indicating that the transaction has taken place is transmitted to Sunchronize.

10DATA RELATING TO THE SERVICE PROVIDER

Should you register in the capacity of Service Provider, the name/title, business name, logo, contact details, tax office and tax number, permit/licence/authorisation and certification documents, equipment visuals and reference information that you share within the scope of the Professional Profile are processed.

11CONTENT DATA

The Service Request content, Quotations, reviews and ratings that you create through the Application, together with the records of the in-app communications you establish with other users or with Sunchronize, are processed.

12DEVICE AND NOTIFICATION DATA

Your device identifier, operating system and application version, and the notification token required in order for push notifications to be sent, are processed.

13PURPOSE OF PROCESSING

Service Provision: responding to your requests for further information, enabling accurate assessments to be made, and providing the other Services you may request through the Application (such as registering on our platform);

Marketing: carrying out promotional activities, including direct marketing, market research and the conduct of surveys.

Compliance: complying with laws that require Sunchronize to collect and/or further process certain types of Personal Data and, where necessary, for the establishment, exercise or defence of legal claims;

Analytics: analysing how users reach the Application and how they behave on the Application, in order for Sunchronize to optimise its business operations and the performance, content and features of this Application, and to offer more personalised features, content and recommendations in our products.

Anti-Misuse/Anti-Fraud: preventing and detecting misuse of the Application or fraudulent activities carried out through the Application.

Notifications: in-app and/or push notifications may be sent to users for the purpose of providing information regarding transactions carried out through the Application, such as Service Requests, the submission of a quotation, the acceptance or rejection of a quotation, reservations, cancellations and the like. The limited personal data required in this context may be processed.

Aggregated Analysis and Reporting: Sunchronize may produce statistical reports by anonymising or aggregating the data obtained from the use of the Application and may share such reports with third parties. Anonymised data does not qualify as Personal Data, as it cannot be associated with an identified or identifiable person.

14GROUNDS FOR PROCESSING AND THE MANDATORY / OPTIONAL NATURE OF THE PROCESSING

Sunchronize’s grounds for processing your Personal Data for the purposes set out above are as follows:

Service Provision: Processing for this purpose is necessary in order for the Services to be provided and is mandatory for the conclusion and performance of the contract established with you. The provision of the information marked as mandatory on the forms is necessary in order for the Services to be provided; if such information is not provided, the Service cannot be rendered. Completing the fields marked as optional is at your discretion. Should you submit a service request, some of your contact details will be shared with the Service Provider, to the extent mandatory for the planning and performance of the requested service, so that accurate quotations may be made to you and so that the Service Provider may contact you.

Notifications: The sending of transaction notifications relating to processes such as Service Requests, quotations, reservations and cancellations is necessary in order for the Services to be provided and falls within the scope of the performance of the contract. Commercial notifications, on the other hand, are sent solely on the basis of your explicit consent and may be turned off at any time from your device settings.

Marketing: Processing for this purpose is generally based on your explicit consent. You are not obliged to give Sunchronize permission for your Personal Data to be used for these purposes, and should you choose not to do so, you will not face any adverse consequence (other than being unable to receive further marketing communications from Sunchronize). Any consent given may also be withdrawn at a later stage. In addition, should you provide your e-mail address while receiving any service from Sunchronize, that e-mail address may be used to send you direct marketing communications relating to Sunchronize’s own similar products or services. You will be given the opportunity to exercise your right to object when you provide your e-mail address and in every marketing communication sent to you.

Compliance: Processing for this purpose is necessary in order for Sunchronize to fulfil its legal obligations. When you provide any Personal Data to Sunchronize, Sunchronize must process it in accordance with the laws applicable to it; those laws may also include the retention of your Personal Data and its notification to official authorities for the purposes of compliance with tax, customs or other legislation. Sunchronize may also process Personal Data where necessary for the establishment, exercise or defence of any legal claim.

Analytics: Processing for this purpose is carried out by means of analytics cookies on the website and analytics measurement tools in the mobile application, and solely on the basis of your explicit consent (cookies are placed with the consent you give by clicking a button in the notification window displayed to you or by setting your cookie preferences). You are not obliged to give Sunchronize consent for your Personal Data to be used for this purpose, and should you choose not to do so, you will not face any consequence. Any consent given may also be withdrawn at a later stage (for further information, see the section of this Policy entitled "Rights of the Data Subject").

Anti-Misuse/Anti-Fraud: Processing for this purpose is based on Sunchronize’s legitimate interest, namely the prevention and detection of fraudulent activities or misuse of the Application and the ensuring of the security of the Application.

15RECIPIENTS OF PERSONAL DATA / DATA RECIPIENTS

Your Personal Data may be shared with the persons/institutions set out below (the "Recipients"):

Organisations, suppliers and business partners engaged to assist in carrying out, on our behalf, processing activities relating to the provision of the Services or to marketing, anti-misuse/anti-fraud and/or analytics (for example marketing agencies, customer relations managers);

Persons authorised to carry out technical maintenance (including the maintenance of network equipment and electronic communications networks);

Cloud infrastructure service providers: Your Personal Data is hosted and stored on the Amazon Web Services (AWS) infrastructure;

Payment service providers: the Apple App Store and Google Play for subscription and credit purchases; and Paddle, in its capacity as Merchant of Record, for purchases made through the website and for service fee payments;

Inverter manufacturers and monitoring platforms: solely within the scope of your authorisation and limited to the purpose of retrieving your solar system data;

Personal data of Service Recipients, such as name, full address and telephone number, is not shared with Service Providers at the stage of creating a Service Request or submitting a Quotation. However, where the Service Provider opens the lead by spending credit for the relevant Service Request through the application, the Service Recipient’s name, full address and telephone number become visible to the Service Provider, limited solely to the relevant service, for the purposes of planning and performing the service and enabling the parties to communicate;

Public institutions, bodies, authorities or official bodies with which your Personal Data may be shared in accordance with the applicable laws or with the binding orders and requests of such institutions, bodies or authorities;

Analytics and measurement service providers (for example third-party cookies and mobile measurement tools such as Google Analytics / Firebase).

16TRANSFER OF PERSONAL DATA ABROAD

As the Application is open to global access and its cloud infrastructure is located abroad, your Personal Data may be transferred abroad. The data is hosted on the Amazon Web Services (AWS) infrastructure and may be processed at, or transferred to, AWS data centres outside the country in which you are located. In addition, payment service providers and the inverter manufacturers you have authorised may also be established abroad.

In these transfers, Sunchronize applies the transfer conditions stipulated by the KVKK and the appropriate safeguards under the GDPR (for example the European Commission’s Standard Contractual Clauses – SCC).

17RETENTION OF PERSONAL DATA

In respect of Personal Data processed on the basis of consent, where consent is withdrawn, such data is no longer used for the relevant purposes; however, Sunchronize may continue to retain such data to the extent necessary in order to protect its potential legal liabilities and rights relating to such processing.

Personal Data processed for the purpose of the Provision of the Services is retained for as long as your account is active and for as long as it is necessary for the provision of the Services. Sunchronize may continue to retain such data, in accordance with the legislation, to the extent necessary in order to protect its potential legal liabilities and rights relating to the provision of the Services and for the mandatory retention periods stipulated in the relevant legislation; at the end of such periods, the data is deleted, destroyed or anonymised in accordance with the KVKK.

Personal Data processed for the purpose of Notifications is retained for as long as your account is active and your notification preference remains enabled.

Personal Data processed for Marketing purposes is retained from the moment consent is given until the moment you withdraw your consent.

Personal Data processed for Analytics purposes is aggregated or anonymised as soon as possible. Such data that is not aggregated or anonymised is retained from the moment you give consent until the moment you withdraw consent.

Personal Data processed for Compliance purposes is retained by Sunchronize for the period required by the specific legal obligation or the applicable law, or for the period that may be necessary for the establishment, exercise or defence of legal claims.

Personal Data processed for Anti-Misuse/Anti-Fraud purposes is retained for the period deemed strictly necessary to fulfil the purposes for which it was collected, unless you validly object to its processing for these purposes.

Detailed retention periods on a process and legislation basis are set out in the section of the Privacy Notice entitled "Retention Periods for Personal Data".

18DATA SECURITY

Sunchronize takes reasonable technical and administrative measures aimed at ensuring an appropriate level of security, in order to prevent the unlawful processing of Personal Data and unlawful access to the data, and to ensure the preservation of the data. Such measures may include the encryption of data during transfer and storage, the limitation of access permissions and the monitoring of infrastructure security.

In the event that Personal Data is obtained by others through unlawful means, Sunchronize shall inform the relevant persons and the competent supervisory authority in accordance with the periods and procedures stipulated in the legislation.

19COOKIES

The cookies used on the Application and the Website, the types of cookies and how you may manage your preferences are set out in detail in the section of the Privacy Notice entitled "Cookies".

20PERSONAL DATA OF CHILDREN

Pursuant to the Terms of Use, the Application is intended solely for use by persons who have reached the age of 18. Sunchronize does not knowingly collect Personal Data belonging to persons under the age of 18. Where it is determined that data has been collected in this context, the relevant data is deleted without delay.

21RIGHTS OF THE DATA SUBJECT

As a data subject, you have the right to exercise the following rights before Sunchronize at any time:

to access your Personal Data processed by Sunchronize (and/or a copy of such Personal Data), as well as information relating to the processing of your Personal Data;

to rectify or update your Personal Data processed by Sunchronize where it may be inaccurate or incomplete;

to request the erasure of your Personal Data being processed by Sunchronize where you consider the processing to be unnecessary or otherwise unlawful;

to request the restriction of the processing of your Personal Data where you consider that the Personal Data processed is inaccurate, unnecessary or unlawfully processed, or where you object to its processing;

to exercise your right to data portability: in respect of your Personal Data processed by automated means on the basis of your explicit consent or the performance of a contract, to the extent applicable, you have the right to receive a copy of such data in a structured, commonly used and machine-readable format and to transmit it to another data controller;

to object to the processing of your Personal Data processed for Anti-Misuse/Anti-Fraud purposes, on grounds relating to your particular situation on the basis of which you believe that Sunchronize should cease processing your Personal Data;

to withdraw your explicit consent (for example for Marketing and Analytics purposes);

to object to a result arising to your detriment through the analysis of your processed Personal Data exclusively by automated systems;

to request the remedy of the damage where you suffer damage due to the unlawful processing of your Personal Data.

You may withdraw the consent you have given for Marketing purposes, or object to the processing, by selecting the appropriate link at the bottom of each marketing e-mail message sent to you. In order to object, it is sufficient to send a notification to info@sunchronize.com.

For Analytics, you may withdraw your consent by changing your cookie preferences.

In addition to the methods above, in order to exercise your rights you may send a written request to Sunchronize using the contact details set out in the corporate details at the beginning of this Policy.

In any event, as a data subject, if you consider that the processing of your Personal Data through the Application is unlawful, you have the right to lodge a complaint with the competent supervisory authority (in Türkiye, the Personal Data Protection Authority).

22AMENDMENTS

This Privacy Policy entered into force on 01.07.2026. Sunchronize reserves the right to amend this Privacy Policy in whole or in part, or to update its content, for example as a result of changes in the applicable law. Sunchronize will inform you of any material changes made at the moment they enter into force (by in-app notification and/or e-mail). The amendments will be binding as of the moment they are published on the Application.

To Contact Us

You may send an e-mail to info@sunchronize.com.