Data Protection Policy

As Anadolu Kimya, it is aimed to inform all authorized persons of real and legal entities whose personal data are processed by our Company, primarily Company Officials, Our Employees, Employee Candidates, Our Suppliers, Our Customers, Our Potential Customers, Our Visitors, Our Consultants and Third Parties, about the Law No. 6698 on the Protection of Personal Data (“Law”), to inform them about all administrative, technical and managerial measures we have taken regarding the processing and protection of personal data, to ensure full compliance of our Company with the relevant legislation, and to protect all rights of personal data owners arising from the legislation regarding personal data.

Pursuant to Article 20 of the Constitution of the Republic of Türkiye, “everyone has the right to request the protection of personal data concerning him/her. This right includes being informed about personal data concerning the person, accessing these data, requesting their correction or deletion, and learning whether they are used in line with their purposes. Personal data may be processed only in cases stipulated by law or with the explicit consent of the person.”

DEFINITIONS

• Explicit Consent:
  A positive declaration of consent given freely, based on information, and related to a specific subject.
• Personal Data:
  Any information relating to an identified or identifiable natural person.
• Anonymization:
  Rendering personal data in such a way that they cannot be associated with an identified or identifiable natural person under any circumstances, even by matching them with other data.
• Processing of Personal Data:
  Any operation performed on personal data such as obtaining, recording, storing, retaining, changing, rearranging, disclosing, transferring, taking over, making available, classifying or preventing their use, whether fully or partially by automatic means or by non-automatic means provided that it is part of any data recording system.
• Data Controller:
  The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.
• Data Recording System:
  The recording system in which personal data are processed by being structured according to certain criteria.
• Relevant Person:
  The natural person whose personal data are processed.

PROTECTION, PROCESSING AND TRANSFER OF PERSONAL DATA

Personal data are protected, processed and transferred in accordance with the procedures and principles specified in the Law on the Protection of Personal Data and other relevant legislation.

Processing of Personal Data

Our General Principles;

• Processing in Compliance with Law and the Principle of Good Faith:
  Our Company acts in accordance with the principles introduced by legal regulations and the general principle of trust and good faith in the processing of personal data.
• Ensuring Accuracy and Currency of Personal Data When Necessary:
  Our Company ensures that the personal data it processes are accurate and up to date, taking into account the fundamental rights of personal data owners and its own legitimate interests.
• Processing for Specific, Explicit and Legitimate Purposes:
  Our Company determines the legitimate and lawful purpose of personal data processing clearly and precisely.
• Being Relevant, Limited and Proportionate to the Purpose for Which They Are Processed:
  Our Company processes personal data in line with the determined purpose and avoids processing personal data that are outside the purpose or not required.
• Retention for the Period Required by the Relevant Legislation or for the Purpose for Which They Are Processed:
  Our Company retains personal data only for the period specified in the relevant legislation or required for the purpose for which they are processed. At the end of the period, the relevant personal data are deleted and/or destroyed securely.

Conditions for Processing Personal Data

Necessary care is shown regarding obtaining the explicit consent of the data subject concerning personal data. In certain cases, as stated in the Law and specified below, the relevant data are processed by the data controller without obtaining the explicit consent of the data subject.

• Explicitly stipulated in the laws. For example, indicating the personal data of the addressee on invoices issued by our Company.
• Being mandatory for the protection of the life or physical integrity of the person who is unable to express consent due to actual impossibility or whose consent is not legally valid, or of another person. For example, sharing personal information when emergency medical intervention is required due to health reasons.
• Being directly related to the establishment or performance of a contract, provided that the processing of personal data belonging to the parties of the contract is necessary. For example, sharing notification addresses and bank information of the parties.
• Being mandatory for the data controller to fulfill its legal obligation.
• Being made public by the relevant person himself/herself. In cases where the data subject has already disclosed his/her own data to the public, there remains no legal interest to be protected.
• Being mandatory for the establishment, exercise or protection of a right.
• Being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person.

Conditions for Processing Special Category Personal Data

Special category personal data, such as data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, membership of associations, foundations or trade unions, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data, are processed with the explicit consent of the data subject.

Processing of special category personal data is prohibited. However, processing of such data is possible in the following cases:

• If the explicit consent of the relevant person exists,
• If explicitly stipulated in the laws,
• If it is mandatory for the protection of the life or physical integrity of the person who is unable to express consent due to actual impossibility or whose consent is not legally valid, or of another person,
• If it relates to personal data made public by the relevant person and is in line with the intention of making them public,
• If it is mandatory for the establishment, exercise or protection of a right,
• If it is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services by persons under the obligation of confidentiality or authorized institutions and organizations,
• If it is mandatory for fulfilling legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance,
• If it relates to current or former members and affiliates or persons who are in regular contact with foundations, associations and other non-profit organizations or formations established for political, philosophical, religious or trade union purposes, provided that it is in accordance with their legislation and purposes, limited to their fields of activity and not disclosed to third parties.
• Necessary procedures are carried out to take the measures determined by the Board in the processing of special category personal data.

Deletion, Destruction or Anonymization of Personal Data

• Although personal data have been processed in accordance with the Law and other relevant legislation, if the reasons requiring their processing cease to exist, personal data are deleted, destroyed or anonymized ex officio or upon the request of the relevant person.
• Personal data are deleted and destroyed in such a way that they cannot be reused or restored. Accordingly, data are deleted from media such as documents, files, CDs, diskettes and hard disks in which they are recorded, in a non-recoverable manner.

Conditions for Transfer of Personal Data Domestically / Abroad

• Personal data are transferred with the explicit consent of the data subject during the execution of domestic / international operational activities, to the extent permitted by the Law and other relevant legislation. (Exceptional provisions in the Law and other legislation are reserved.)
• The provisions stipulated in the Law are complied with during the transfer of personal data.

PROCESSED PERSONAL DATA

• If you contact us for your satisfaction, complaints, questions and suggestions, your name, surname, e-mail, telephone number data;
• If you use our websites, IP address and browser information obtained via cookies;
• If you visit our Company, visitor entry and exit information, name surname, identity number, signature, e-mail, telephone number, vehicle plate and camera recording images;
• If you participate in our promotions, advertisements, campaigns, social responsibility projects and organizations, your identity and visual/auditory data;
• If you apply for a job, other personal data including your résumé directly submitted by you.

• Natural or legal persons who purchase our products and services;
• Persons who contact as potential customer/supplier/business partner/subcontractor for any purpose;
• Security cameras are used and personal data are processed through this means.

PURPOSE OF PROCESSING PERSONAL DATA

Your personal data obtained within the scope of your relationship with Anadolu Kimya are processed for the purposes listed below:

• Conducting Emergency Management Processes
• Conducting Information Security Processes
• Conducting Application Processes of Job Candidates
• Audits and Ethical Review Activities
• Conducting Activities in Compliance with Legislation
• Ensuring Physical Space Security
• Conducting Communication Activities
• Planning and Conducting Human Resources Processes
• Conducting / Auditing Business Activities
• Conducting After-Sales Support Services for Goods / Services
• Conducting Customer Relationship Management Processes
• Conducting Activities for Customer Satisfaction
• Organization and Event Management
• Conducting Marketing Analysis Studies
• Conducting Social Responsibility and Civil Society Activities
• Following Requests / Complaints
• Ensuring the Security of Data Controller Operations
• Providing Information to Authorized Persons, Institutions and Organizations
• Creating and Following Visitor Records
• Ensuring full and proper fulfillment of our contractual and legal obligations,
• Keeping and monitoring log records required to be stored within the scope of legislation and security analysis,
• Responding to information requests from judicial and administrative authorities.

METHODS AND LEGAL GROUNDS FOR COLLECTING PERSONAL DATA

Your personal data are processed by automatic and non-automatic means listed in Articles 5, 6, 8 and 9 of the Law, based on the legal grounds that it is necessary for the processing of personal data belonging to the parties of the contract, provided that it is directly related to the establishment or performance of a contract during the establishment of your legal relationship with our Company and throughout the continuation of the said relationship, that it is mandatory for the data controller to fulfill its legal obligation, and that data processing is mandatory for the establishment, exercise or protection of a right; from you, third parties and legal authorities, via website, various contracts, mobile applications, electronic mail, telephone or application forms, and through physical, verbal, written or electronic environments, within the purposes specified above.

RETENTION PERIOD OF PERSONAL DATA

Personal data are kept within the Company for the relevant legal retention periods and are stored for the period necessary for the realization of the activities related to these data and the specified purposes. Personal data whose purpose of use has ended and whose legal retention period has expired are deleted, destroyed or anonymized by the Company in accordance with Article 7 of the KVKK.

TRANSFER OF PROCESSED PERSONAL DATA

Your personal data may be transferred, within the scope of the provisions of the KVKK regarding the transfer of personal data, for the purposes stated in Article 2 of this Information Notice, domestically; to official institutions and organizations, to our business partners, and to the servers of our business partners located abroad within the framework of cloud technology.

RIGHTS OF THE RELEVANT PERSON WHOSE PERSONAL DATA ARE PROCESSED

Pursuant to the provisions of Article 11 of the Law, you have the following rights regarding your personal data:

• To learn whether personal data are processed,
• To request information if personal data have been processed,
• To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
• To know the third parties to whom personal data are transferred domestically or abroad,
• To request correction of personal data if they are processed incompletely or incorrectly,
• To request deletion or destruction of personal data,
• To request notification of these operations to third parties to whom personal data have been transferred,
• To object to the emergence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems,
• To request compensation for the damage in case of loss due to unlawful processing of personal data.

METHOD TO BE FOLLOWED BY THE PERSONAL DATA OWNER WHEN EXERCISING HIS/HER RIGHT

The data subject may submit his/her requests regarding the implementation of the Law by sending them in writing with an application form, by secure electronic signature, or by other methods to be determined by the Personal Data Protection Board (“B                oard”) to the address specified in the application form.

Requests included in the application are finalized as soon as possible and at the latest within thirty days, in accordance with the principles stipulated by the Law, depending on the nature of the request.

The Company has the right to accept the request in the application or to reject it by explaining its reason; and notifies the relevant person of its response in writing or electronically. In case the request in the application is accepted, the Company fulfills the requirement in line with the request of the data subject.

In cases where the application is rejected, the response is found insufficient, or the application is not responded to in due time, the data subject has the right to file a complaint with the Board within thirty days from the date he/she learns the response and in any case within sixty days from the application date.

AMENDMENTS AND UPDATES THAT MAY BE MADE IN THE POLICY

Changes or updates may be made in this policy in line with legal regulations and company policy. Necessary information regarding the new policy text reflecting all such changes and updates is provided to the relevant persons via the website.