Protection of Personal Data

ARSANMAK MAKİNA İMALAT SANAYİ VE TİCARET ANONİM ŞİRKETİ - POLICY ON THE PROCESSING AND PROTECTION OF PERSONAL DATA

ARSANMAK MAKİNA İMALAT SANAYİ VE TİCARET ANONİM ŞİRKETİ (the “Company”) shall comply with the policies set out in this document regarding the protection and processing of personal data, pursuant to Law No. 6698 on the Protection of Personal Data (the “Law”) and other applicable legislation.

The Company, having registered as a data controller (ARSANMAK MAKİNA İMALAT SANAYİ VE TİCARET ANONİM ŞİRKETİ) with the Data Controllers’ Registry Information System maintained by the Personal Data Protection Authority (“VERBIS”), shall process your personal data within the limits determined in this document.

This document is intended to ensure transparency and accountability, within its scope, regarding the collection, processing and protection of the personal data of the Company’s shareholders, the Company’s officers, the Company’s managers and employees, candidates who have applied for employment, visitors, persons and institutions with which the Company cooperates, the shareholders, officers, managers and employees of such persons and institutions, and third parties.

COLLECTION OF PERSONAL DATA

Your personal data are obtained through any verbal, written or electronic medium, in line with the purposes set out above, in order for the products and services offered by the Company to be provided within the prescribed legal framework and, in this context, for the Company to fulfill its contractual and statutory obligations fully and accurately.

PROCESSING OF PERSONAL DATA

Although your personal data may vary depending on the service, product or commercial activity provided by the Company, they may be collected verbally, in writing or electronically, by automatic or non-automatic methods, through offices, branches, dealers, the call center, the website, social media channels, mobile applications and similar means.

For as long as you benefit from the Company’s products and services, your personal data may be processed as they are created and updated.

Your personal data may be processed when you use our call center or our website with the intention of using the Company’s services, when you visit our Company or our website, and when you attend training programs, seminars or events organized by the Company.

Your collected personal data shall be processed for the purposes of carrying out, through our business units, the work necessary for you to benefit from the products and services offered by the Company; customizing the products and services offered by the Company according to your preferences, usage habits and needs and recommending them to you; ensuring the legal and commercial security of the Company and of persons who are in a business relationship with the Company; determining and implementing the Company’s commercial and business strategies; and ensuring the conduct of the Company’s human resources policies, within the following provisions specified in Articles 5 and 6 of the Law:

“Conditions for processing personal data

ARTICLE 5- (1) Personal data shall not be processed without the explicit consent of the data subject.

(2) Where one of the following conditions exists, it is possible to process personal data without seeking the explicit consent of the data subject:

a) It is expressly provided for by the laws.

b) It is necessary for the protection of the life or physical integrity of the person himself/herself or of any other person who is unable to express his/her consent due to actual impossibility, or whose consent is not recognized as legally valid.

c) Processing of personal data belonging to the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract.

ç) It is necessary for the data controller to be able to perform its legal obligation.

d) The data have been made public by the data subject himself/herself.

e) Data processing is necessary for the establishment, exercise or protection of a right.

f) Data processing is necessary for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject.

Conditions for processing special categories of personal data

ARTICLE 6- (1) Data relating to the race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures of persons, together with their biometric and genetic data, are special categories of personal data.

(2) It is prohibited to process special categories of personal data without the explicit consent of the data subject.”

They shall be processed within the conditions and purposes of personal data processing.

TRANSFER OF PERSONAL DATA

Your collected personal data may be transferred to our business partners, our suppliers, our shareholders, public institutions authorized by law and private persons, for the purposes of carrying out, through our business units, the work necessary for you to benefit from the products and services offered by the Company; customizing the products and services offered by the Company according to your preferences, usage habits and needs and recommending them to you; ensuring the legal and commercial security of the Company and of persons who are in a business relationship with the Company; determining and implementing the Company’s commercial and business strategies; and ensuring the conduct of the Company’s human resources policies, within the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law:

“Transfer of personal data

ARTICLE 8- (1) Personal data shall not be transferred without the explicit consent of the data subject.

(2) Personal data;

a) in the second paragraph of Article 5,

b) provided that adequate measures are taken, in the third paragraph of Article 6,

may be transferred without seeking the explicit consent of the data subject where one of the conditions specified above exists.

(3) Provisions contained in other laws relating to the transfer of personal data are reserved.

Transfer of personal data abroad

ARTICLE 9- (1) Personal data shall not be transferred abroad without the explicit consent of the data subject.

(2) Personal data, where one of the conditions specified in the second paragraph of Article 5 and in the third paragraph of Article 6 exists and, in the foreign country to which the personal data will be transferred;

a) adequate protection is provided,

b) where adequate protection is not provided, the data controllers in Turkey and in the relevant foreign country undertake in writing to provide adequate protection and the permission of the Board exists,

may be transferred abroad without seeking the explicit consent of the data subject.

(3) Countries in which adequate protection is provided shall be determined and announced by the Board.”

may be transferred within this framework.

PERSONAL DATA RETENTION PERIODS

Where retention is prescribed within the framework of the relevant legislation, the Company retains personal data for the period specified in that legislation.

Where no period is stipulated in the legislation, personal data are retained, in connection with the services the Company provides while processing those data, for as long as processing is required in accordance with the Company’s practices and the necessities of its commercial life, and are thereafter deleted, destroyed or anonymized.

RIGHTS OF DATA SUBJECTS

Data subjects have the rights regulated in Article 11 of the Law:

Rights of the data subject

ARTICLE 11- (1) Everyone, by applying to the data controller, has the following rights in relation to himself/herself:

a) to learn whether personal data are processed,

b) to request information relating thereto if personal data have been processed,

c) to learn the purpose of the processing of personal data and whether they are used in compliance with that purpose,

ç) to know the third parties to whom personal data are transferred in the country or abroad,

d) to request the rectification of personal data where they have been processed incompletely or inaccurately,

e) to request the erasure or destruction of personal data within the framework of the conditions provided for in Article 7,

f) to request that the operations carried out pursuant to subparagraphs (d) and (e) be notified to third parties to whom the personal data have been transferred,

g) to object to the occurrence of a result against the person himself/herself by means of the analysis of the processed data exclusively through automated systems,

ğ) to request compensation for the damage where damage is suffered due to the unlawful processing of personal data,

and is entitled to these rights.

Data subjects may exercise these rights by completing the “KVKK DATA SUBJECT APPLICATION FORM” in the KVKK section of the Company’s website. Detailed information on how to complete the form and how to send it to the Company is contained in the form.

Where the data subject’s application is rejected, the response given is found insufficient, or the application is not answered within the prescribed time, the data subject, pursuant to Article 14 of the Law:

Complaint to the Board

ARTICLE 14- (1) Where the application is rejected, the response is found insufficient, or the application is not answered within the prescribed time, the data subject may lodge a complaint with the Board within thirty days from the date on which he/she learns of the data controller’s response and, in any event, within sixty days from the date of the application.

(2) A complaint may not be lodged before the application procedure under Article 13 has been exhausted.

(3) The right to compensation of those whose personal rights have been violated is reserved under the general provisions.

The right to lodge a complaint with the Board is reserved.

THE COMPANY’S RIGHT TO REJECT THE DATA SUBJECT’S APPLICATION

The Company may reject the application of the data subject who has applied, by explaining its grounds, in the following cases:

Processing of personal data within the scope of preventive, protective and intelligence activities conducted by public institutions and organizations that are assigned duties and powers by law in order to ensure national defense, national security, public security, public order or economic security,
Processing of personal data for purposes such as research, planning and statistics through official statistics and by anonymization,
Processing of personal data for artistic, historical, literary or scientific purposes, or within the scope of freedom of expression, provided that national defense, national security, public security, public order, economic security, the privacy of private life or personal rights are not violated, or that the processing does not constitute a crime,
Processing of personal data by judicial authorities or execution authorities in relation to investigation, prosecution, judicial proceedings or execution proceedings,
The requested information being information open to the public,
Processing of personal data being necessary for the prevention of a crime or for a criminal investigation,
Processing of personal data being necessary, on the basis of the authority granted by law, for the conduct of supervisory or regulatory duties and for disciplinary investigation or prosecution by the competent and authorized public institutions and organizations and by professional organizations with public institution status,
Processing of personal data being necessary for the protection of the economic and financial interests of the State in relation to budgetary, tax and financial matters,
Processing of personal data made public by the data subject himself/herself,
The likelihood that the data subject’s request would obstruct the rights and freedoms of other persons,
Requests requiring disproportionate effort having been made

ARSANMAK MAKİNA İMALAT SANAYİ VE TİCARET ANONİM ŞİRKETİ - CLOSED-CIRCUIT CAMERA RECORDING SYSTEM INFORMATION NOTICE

This Information Notice has been prepared pursuant to Law No. 6698 on the Protection of Personal Data (the “Law”), for the purpose of informing data subjects of the procedures and principles regarding the processing of personal data collected through the closed-circuit camera recording systems used by ARSANMAK MAKİNA İMALAT SANAYİ VE TİCARET ANONİM ŞİRKETİ (the “Company”).

PROCESSING OF PERSONAL DATA

Personal data collected as image recordings are processed within the framework of the personal data processing conditions specified in Articles 5 and 6 of the Law;

“Conditions for processing personal data

ARTICLE 5- (1) Personal data shall not be processed without the explicit consent of the data subject.

(2) Where one of the following conditions exists, it is possible to process personal data without seeking the explicit consent of the data subject:

a) It is expressly provided for by the laws.

c) Processing of personal data belonging to the parties of a contract is necessary, provided that it is directly related to the establishment or performance of the contract.

ç) It is necessary for the data controller to be able to perform its legal obligation.

d) The data have been made public by the data subject himself/herself.

e) Data processing is necessary for the establishment, exercise or protection of a right.

f) Data processing is necessary for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject.

Conditions for processing special categories of personal data

(2) It is prohibited to process special categories of personal data without the explicit consent of the data subject.”

Provided that processing remains limited solely to the cases listed below:

Conducting emergency processes,
Ensuring the security of physical premises,
Conducting internal audit/investigation activities,
Resolving legal disputes,
are processed for these purposes.

TRANSFER OF PERSONAL DATA

The collected personal data, under the conditions specified in Articles 8 and 9 of the Law:

“Transfer of personal data

ARTICLE 8- (1) Personal data shall not be transferred without the explicit consent of the data subject.

(2) Personal data;

a) in the second paragraph of Article 5,

b) provided that adequate measures are taken, in the third paragraph of Article 6,

may be transferred without seeking the explicit consent of the data subject where one of the conditions specified above exists.

(3) Provisions contained in other laws relating to the transfer of personal data are reserved.

Transfer of personal data abroad

ARTICLE 9- (1) Personal data shall not be transferred abroad without the explicit consent of the data subject.

a) adequate protection is provided,

may be transferred abroad without seeking the explicit consent of the data subject.

(3) Countries in which adequate protection is provided shall be determined and announced by the Board.”

under these personal data processing conditions; and

Conducting emergency processes,
Ensuring the security of physical premises,
Conducting internal audit/investigation activities,
Resolving legal disputes,
are shared with the law firm from which the Company receives services and with authorized institutions and organizations.