KVKK Policy

PERSONAL DATA PROCESSING INFORMATION TEXTPERSONAL DATA PROCESSING INFORMATION TEXT

1. INTRODUCTION

The security and/or protection of your personal data is among our priorities as Karataş Group of Companies. With this awareness, as a Company, we attach great importance to the processing and preservation of all personal data belonging to all persons associated with the Company, including those who benefit from our products and services, in accordance with the Personal Data Protection Law No. 6698. In this context, as the “Data Controller” as defined in the PDP Law and in accordance with Article 10 of the PDP Law and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform by the Personal Data Protection Board published in the Official Gazette No. 30356 dated 10 MARCH 2018, in order to fulfill the duty of informing personal data owners during the acquisition of personal data; We present this information regarding the identity of our Company, the purpose for which personal data will be processed, to whom and for what purpose the processed personal data may be transferred, the method and legal reason for collecting personal data, and the rights of the personal data owner within the scope of Article 11 of the PDP Law during the collection of personal data by our Company.

Expressions such as “we” and “our” in this Disclosure Text are used to refer to Karataş Group of Companies unless otherwise clearly stated.

2. PERSONAL DATA

2.1. Definition of Personal Data

Within the framework of Article 3/I(d) of the PDP Law, “personal data” refers to any information relating to an identified or identifiable natural person. In this context, personal data refers to any information relating to an identified or identifiable natural person. For example; your name, surname, TR identity number, address, telephone number, e-mail address, date of birth, the IP number you access, information regarding the transactions you have made, etc. information relating to you are your personal data. In addition, according to the Personal Data Protection Law; data related to the race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership in associations, foundations, unions, etc., health, sexual life, criminal conviction and security measures, and genetic data, etc. of individuals are special personal data. In this context, anonymous information, information that has been made anonymous and other data that cannot be associated with a specific person are not considered personal data in accordance with our Company’s Policy on this matter. 2.2. Concept of Processing of Personal Data

Processing of personal data within the framework of Article 3/I(e) of the Personal Data Protection Law refers to all kinds of operations performed on data such as obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, either fully or partially by automatic means or non-automatic means provided that it is part of any data recording system.

3. SCOPE OF INFORMATION

3.1. Identity of Data Controllers

According to the PDP Law, since the “Data Controller” refers to the real or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system, the Addressee “Data Controller” is the Legal Entities belonging to the Karataş Group of Companies in accordance with the PDP Law.

3.2. Collection, Processing and Purposes of Processing of Personal Data

Your Personal Data may vary depending on the service, product or commercial activity provided by our Company; It is processed for the purpose of ensuring work and workplace safety, ensuring business order, and ensuring that commercial relations are carried out in accordance with the law and in a secure manner, and is/may be collected verbally, in writing or electronically through automatic or non-automatic methods, offices, branches, websites, social media channels, mobile applications and similar means.

PDP Law Within the scope of Article 5.2 and Article 6.3 of the Law, to fulfill our legal obligations, to establish or execute a contract, to fulfill our legal obligations, to establish, exercise or protect a right, and to protect our legitimate interests without harming your fundamental rights and freedoms, and for the personal data you have made public, it can be processed without your explicit consent. Again, your personal data can be processed within the scope of the purposes specified in this Disclosure Text, provided that your explicit consent is obtained within the scope of Article 5.1 and Article 6.2 of the Personal Data Protection Law. Therefore, you give your explicit consent to the processing of your Personal Data, except for exceptional cases. Your collected personal data is/will be processed in accordance with the personal data processing conditions and purposes specified in Articles 5 and 6 of the Personal Data Protection Law and other applicable legal regulations for the purposes of ensuring that our business units carry out the necessary work to enable you to benefit from the products and services offered by our Company, that the products and services offered by our Company are customized and recommended to you according to your tastes, usage habits and needs, that the legal and commercial security of our Company and the persons who have a business relationship with our Company (administrative operations for communication carried out by our Company, ensuring the physical security and control of the Company’s locations, business partner/customer/supplier (authorized persons or employees) evaluation processes, legal compliance process, financial affairs, etc.), that the commercial and business strategies of our Company are determined and implemented, and that the human resources policies of our Company are carried out.

3.3. To Whom and for What Purpose Can the Processed Personal Data Be Transferred Domestically and/or Abroad

Your Collected Personal Data; For the purposes of carrying out the necessary work by our business units to benefit from the products and services offered by our Company, to customize the products and services offered by our Company according to your tastes and needs and to recommend them to you, to ensure the legal and commercial security of our Company and the people who have a business relationship with our Company (administrative operations for communication carried out by our Company, to ensure the physical security and control of the Company’s locations, business partner/customer/supplier (authorized or employees) evaluation processes, legal compliance process, financial affairs, etc.), to determine and implement our Company’s commercial and business strategies and to ensure the execution of our Company’s human resources policies,

To the administrative and official authorities to which it must be legally transferred, to the relevant persons and institutions as required by the legislation and for the fulfillment of legal obligations, to independent auditing companies due to legal obligations and within the framework of legal limitations, to tax consultants and other external professional consultants, lawyers, insurance companies, banks operating in Turkey, their partners, domestic and foreign third parties from whom or from whom services are received, our shareholders, business partners, suppliers, is/may be transferred to authorized public institutions and private persons within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the PDP Law and other legal legislation. Your collected personal data is/may be transferred to foreign countries declared to have sufficient protection by the PDP Board or, in the absence of sufficient protection, to foreign countries where the data controllers in Turkey and the relevant foreign country have undertaken in writing to provide sufficient protection and where the PDP Board has given its permission. In this regard, our company acts/will act in accordance with the regulations stipulated in Article 9 of the PDP Law and other legal legislation.

3.4. Method and Legal Reason for Collecting Personal Data

Your personal data is obtained through our audit and consultancy services, written/digital applications made to our Company employees, our website, calls to our phone numbers, social media, SMS channels, and other verbal, written or electronic media, automatic or non-automatic methods and other channels through which our Company communicates with you or may communicate with you in the future, in order to carry out our activities and to fulfill our contractual and legal obligations with you, and the personal data obtained is stored within the legal periods in accordance with the relevant Legislation.

3.5. Rights of the Personal Data Owner Listed in Article 11 of the Personal Data Protection Law

As personal data owners, if you submit your requests regarding your rights to our Company through the methods set out below in this Disclosure Text, our Company will finalize the request free of charge within thirty days at the latest, depending on the nature of the request. However, if a fee is foreseen by the Personal Data Protection Board, the fee in the tariff determined by our Company will be charged. In this context, personal data owners have the right, in accordance with Article 11 of the Personal Data Protection Law; to learn whether their Personal Data has been processed, to request information about it if it has been processed, to learn the purpose of processing their Personal Data and whether it is used in accordance with its purpose, to know the third parties to whom their personal data has been transferred domestically or abroad, to request correction of their personal data if it has been processed incompletely or incorrectly, to request deletion or destruction of their personal data if the reasons requiring processing are eliminated, to be evaluated within the principles of purpose, duration and legitimacy, to request notification of these transactions to third parties to whom their personal data has been transferred in the event that their Personal Data is corrected, deleted or destroyed, to object to a result that is against them if their processed personal data is analyzed exclusively through automated systems, and to request compensation for the damages if their Personal Data is processed unlawfully and they suffer damages for this reason. Pursuant to Article 13, paragraph 1 of the PDP Law, you may submit your request regarding the exercise of your rights specified above to our Company in writing or through other methods determined by the Personal Data Protection Board. Since the Personal Data Protection Board has not determined any method at this stage, you must submit your application to our Company in writing in accordance with the PDP Law. In this context, the channels and procedures through which you will submit your written application for applications to our Company within the scope of Article 11 of the PDP Law are explained below:

In order to exercise your rights specified above, you may submit your request including the necessary information identifying your identity and explanations regarding the right you request to exercise from among the rights specified in Article 11 of the PDP Law; You may apply through our kep addresses in our company information, or you may apply in person to our company’s head office addresses with your signed petition containing your request, together with documents identifying your identity, or you may send it through the notary public.