Personal Data Protection and Processing Policy

Introduction

1.1. Purpose of the Policy Within the scope of the Personal Data Protection Law No. 6698 (“the Law”), as KMS DEMİR ÇELİK A.Ş. (“the Company”), processing and protecting personal data in accordance with the law is among our utmost priorities. We follow the same priority in all our planning and business activities. In this framework, in order to enlighten you in accordance with Article 10 of the Law; and to inform you of all administrative and technical measures we will implement regarding the processing and protection of personal data, we present this Personal Data Processing and Protection Policy (“Policy”) for your information.

1.2. Scope This Policy determines the conditions for the processing of personal data and sets forth the principles adopted by the Company in the processing of personal data. In this context, the Policy covers all personal data processing activities carried out by the Company within the scope of the Law, all personal data processed, and the data subjects (owners) of these data.

1.3. Definitions

·       Explicit Consent: Consent given freely, based on information, regarding a specific subject.

·       Anonymization: Rendering personal data impossible to link with an identified or identifiable natural person under any circumstances, even through matching with other data.

·       Employee Candidate: Natural persons who are not employed by the Company but hold the status of a job applicant.

·       Personal Data: Any information relating to an identified or identifiable natural person.

·       Data Subject: The natural person whose personal data is processed.

·       Processing of Personal Data: Any operation performed upon personal data such as collection, recording, storage, retention, alteration, re-organization, disclosure, transferring, taking over, making retrievable, classification or preventing the use thereof, fully or partially through automatic means or provided that the process is a part of any data registry system, through non-automatic means.

·       The Law: Personal Data Protection Law No. 6698, published in the Official Gazette dated April 7, 2016, and numbered 29677.

·       Special Categories of Personal Data: Data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade-unions, health, sexual life, criminal conviction and security measures, and biometrics and genetics.

·       Policy: Personal Data Processing and Protection Policy.

·       Company: KMS Demir Çelik A.Ş.

·       Data Processor: The natural or legal person who processes personal data on behalf of the data controller upon its authorization.

·       Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data filing system.

·       Data Filing System: The system where personal data are processed by being structured according to specific criteria.

·       Business Partners: Persons with whom the Company establishes a partnership within the scope of contractual relationships in the framework of its commercial activities.

1.4. Enforcement of the Policy This Policy, issued by the Company, entered into force on 31.03.2021 and was presented to the public. In case of a conflict between the current legislation, especially the Law, and the regulations included in this Policy, the provisions of the legislation shall apply. The Company reserves the right to make changes to the Policy in parallel with legal regulations. The current version of the Policy can be accessed on the Company’s (https://kmscelik.com.tr/) website.

2. Information on Personal Data Processing Activities Conducted by the Company2.1. Data Subjects The data subjects within the scope of the Policy are all natural persons, other than the Company employees, whose personal data are processed by the Company. In general, data subjects can be listed as follows:

The data subject categories described in the table above are specified for general information sharing purposes. The fact that the data subject does not fall within any of these categories does not eliminate their status as a data subject as specified in the Law.

2.2. Purposes of Processing Personal Data2.2.1. Carrying out the necessary work by the relevant business units and executing business processes to benefit the relevant persons from the products and services offered by the Company:

·       Planning and executing the sales processes of products and/or services,

·       Planning and/or executing after-sales support service activities,

·       Planning and executing customer relationship management processes,

·       Follow-up of contract processes and/or legal requests,

·       Follow-up of customer requests and/or complaints.

2.2.2. Planning and executing the Company’s human resources policies and processes:

·       Planning and executing talent-career development activities,

·       Fulfilling obligations arising from employment contracts and/or legislation for Company employees,

·       Planning and executing fringe benefits and interests for employees,

·       Planning and executing internal orientation activities,

·       Planning and executing personnel exit procedures,

·       Wage management,

·       Planning human resources processes,

·       Managing personnel recruitment processes,

·       Planning and executing internal appointment-promotion and separation processes,

·       Planning and executing employee performance evaluation processes,

·       Follow-up and/or supervision of employees’ work activities,

·       Planning and/or executing internal training activities,

·       Planning and executing employee satisfaction and/or loyalty processes,

·       Planning and executing the processes of receiving and evaluating suggestions for improving employees’ work and/or production processes,

·       Planning and/or executing intern and/or student procurement, placement, and operational processes.

2.2.3. Carrying out the necessary work by the relevant business units to realize the commercial activities carried out by the Company and executing the related business processes:

·       Event management,

·       Planning and executing business activities,

·       Planning and executing corporate communication activities,

·       Planning and executing supply chain management processes,

·       Planning and executing production and/or operational processes,

·       Planning, auditing, and executing information security processes,

·       Establishing and managing information technology infrastructure,

·       Planning and executing business partners’ information access authorizations,

·       Follow-up of finance and/or accounting affairs,

·       Planning and executing corporate sustainability activities,

·       Planning and executing corporate governance activities,

·       Planning and/or executing business continuity activities,

·       Planning and executing logistics activities.

2.2.4. Planning and executing the activities required to customize the products and services offered by the Company according to the tastes, usage habits, and needs of the relevant persons and recommending and introducing them:

·       Identifying and/or evaluating the persons to be subject to marketing activities in line with consumer behavior criteria,

·       Designing and/or executing personalized marketing and/or promotional activities,

·       Designing and/or executing advertising and/or promotional and/or marketing activities in digital and/or other media,

·       Designing and/or executing activities to be developed for customer acquisition and/or value creation in existing customers in digital and/or other media,

·       Planning and/or executing data analytics studies for marketing purposes,

·       Planning and executing the marketing processes of products and/or services,

·       Planning and/or executing processes to create and/or increase loyalty to the products and/or services offered by the Company.

2.2.5. Planning and executing the Company’s commercial and/or business strategies:

·       Managing relationships with business partners.

2.2.6. Ensuring the legal, technical, and commercial occupational safety of the Company and the relevant persons in a business relationship with the Company:

·       Follow-up of legal affairs,

·       Planning and executing operational activities required to ensure that company activities are carried out in accordance with company procedures and/or relevant legislation,

·       Providing information to authorized institutions arising from legislation,

·       Creating and tracking visitor records,

·       Planning and executing emergency management processes,

·       Carrying out corporate and partnership law transactions,

·       Planning and executing company audit activities,

·       Planning and/or executing occupational health and/or safety processes,

·       Realizing credit process risk management,

·       Ensuring the security of company campuses and/or facilities,

·       Ensuring the security of company operations,

·       Planning and/or executing the financial risk processes of the Company,

·       Ensuring the security of the company’s fixtures and/or resources.

2.3. Categories of Personal Data In accordance with Article 4 of the Law, the Company engages in personal data processing activities in a manner that is lawful and in conformity with the rules of bona fides; accurate and, where necessary, up-to-date; for specific, explicit, and legitimate purposes; and related, limited, and proportionate to the purpose for which they are processed. The Company retains personal data for the period stipulated in the laws or as required for the purpose of personal data processing.

The personal data categorized below by the Company are processed in accordance with the personal data processing conditions set forth in the Law and relevant legislation:

3. Principles and Conditions for the Processing of Personal Data3.1. Principles for the Processing of Personal Data The Company informs data subjects in accordance with Article 10 of the KVK (Personal Data Protection) Law and, in cases where consent is required, requests their consent and processes these personal data based on the principles stated below.

3.1.1. Processing of Data Lawfully and in Conformity with the Rules of Bona Fides In the processing of personal data, the Company acts in accordance with the principles introduced by legal regulations and the general rule of trust and bona fides. In accordance with the principle of bona fides, the Company takes into account the interests and reasonable expectations of the relevant persons while trying to achieve its data processing goals.

3.1.2. Ensuring Personal Data is Accurate and Up-to-Date When Necessary Keeping personal data accurate and up-to-date is necessary for the Company in order to protect the fundamental rights and freedoms of the relevant person. The Company has a duty of active care to ensure that personal data is accurate and up-to-date when necessary. For this reason, all communication channels are open for the Company to keep the data subject’s information accurate and up-to-date.

3.1.3. Processing of Data for Specific, Explicit, and Legitimate Purposes The Company clearly and precisely determines its legitimate and lawful personal data processing purpose. It processes personal data only as much as connected to and necessary for the commercial activities it conducts.

3.1.4. Data Being Relevant, Limited, and Proportionate to the Purposes for which they are Processed The Company processes personal data within the scope of the purposes related to its field of activity and necessary for the conduct of its business. For this reason, it processes personal data in a manner suitable for realizing the specified purposes and avoids processing personal data that is unrelated to the realization of the purpose or is not needed.

3.1.5. Retaining Data for the Period Stipulated by Relevant Legislation or Required for the Purpose for which they are Processed The Company retains personal data only for the period specified in the relevant legislation or required for the purpose for which they are processed. In this context; it first determines whether a period is stipulated in the relevant legislation for the storage of personal data, complies with this period if one is determined, and if no period is determined, it stores the personal data for the period required for the purpose for which they are processed. Upon the expiration of the personal data processing purpose or the expiration of the period stipulated in the legislation, personal data are deleted, destroyed, or anonymized by the Company.

3.2. Conditions for the Processing of Personal Data Your personal data are processed by the Company if at least one of the personal data processing conditions specified in Article 5 of the Law exists.

3.2.1. Existence of the Explicit Consent of the Personal Data Subject One of the conditions for processing personal data is the explicit consent of the data subject. The explicit consent of the personal data subject must be related to a specific subject, based on information, and declared with free will. To process personal data based on explicit consent, explicit consent is obtained from customers, potential customers, and visitors through relevant methods.

3.2.2. Personal Data Processing Activities Explicitly Envisaged in the Laws The personal data of the data subject may be processed lawfully without the explicit consent of the data subject if it is explicitly provided for in the law.

3.2.3. Inability to Obtain Explicit Consent Due to Actual Impossibility Personal data of the data subject may be processed if processing is mandatory to protect the life or physical integrity of the person or another person, who is unable to express their consent due to actual impossibility or whose consent is not legally recognized.

3.2.4. Personal Data Being Directly Related to the Establishment or Performance of a ContractIt is possible to process personal data if it is necessary to process the personal data of the parties to a contract, provided that it is directly related to the establishment or performance of the contract.

3.2.5. The Company Fulfilling its Legal Obligation The personal data of the data subject may be processed if processing is mandatory for the Company to fulfill its legal obligations as a data controller.

3.2.6. Personal Data Being Made Public by the Data Subject If the data subject has made their personal data public by themselves, the relevant personal data may be processed.

3.2.7. Data Processing Being Mandatory for the Establishment or Protection of a Right The personal data of the data subject may be processed if data processing is mandatory for the establishment, exercise, or protection of a right.

3.2.8. Data Processing Being Mandatory for the Legitimate Interests of the Company The personal data of the data subject may be processed if data processing is mandatory for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the personal data subject.

3.3. Processing of Special Categories of Personal Data In the processing of personal data determined as “special category” by the KVK Law, the Company meticulously complies with the regulations envisaged in the KVK Law. Special categories of personal data are processed by the Company in the following cases, provided that adequate measures determined by the KVK Board are taken:

·       If the personal data subject has explicit consent, or

·       If the personal data subject does not have explicit consent;

o   Special categories of personal data other than the health and sexual life of the data subject are processed in cases stipulated by law.

o   Special categories of personal data concerning the health and sexual life of the data subject are processed only by persons subject to confidentiality obligations or competent public institutions and organizations, for the purposes of protection of public health, operation of preventive medicine, medical diagnosis, treatment, and care services, planning and management of health services and financing.

4. Transfer of Personal Data The Company may transfer the personal data and special categories of personal data of the data subject to third parties domestically or abroad by taking the necessary security measures in line with lawful personal data processing purposes. In this direction, the Company acts in accordance with the regulations stipulated in Article 8 of the KVK Law.

4.1. Transfer of personal data to third parties domesticallyYour personal data may be transferred by the Company in the presence of at least one of the data processing conditions set forth in Articles 5 and 6 of the Law and explained under Title 3 of this Policy, provided that the fundamental principles regarding the data processing conditions are complied with.

4.2. Transfer of personal data to third parties abroad The Company may transfer the personal data and special categories of personal data of the data subject to third parties abroad by taking the necessary security measures in the presence of at least one of the data processing conditions explained under Title 3 of this Policy. Personal data are transferred by the Company; to foreign countries declared to have adequate protection by the KVK Board (“Foreign Country with Adequate Protection”), or in the absence of adequate protection, to foreign countries where the data controllers in Turkey and in the relevant foreign country undertake adequate protection in writing and where the permission of the KVK Board exists (“Foreign Country where the Data Controller Undertaking Adequate Protection is Located”). In this direction, the Company acts in accordance with the regulations stipulated in Article 9 of the KVK Law.

4.3. Third parties to whom personal data is transferred and the purposes of transfer Within the framework of the general principles of the Law and the data processing conditions in Articles 8 and 9, the Company may transfer data to the parties categorized in the table below:

5. Rights of the Data Subject and the Exercise of Relevant Rights5.1. Rights of the personal data subject:

·       To learn whether personal data is processed or not,

·       To request information if personal data has been processed,

·       To learn the purpose of processing personal data and whether they are used appropriately for their purpose,

·       To know the third parties to whom personal data is transferred domestically or abroad,

·       To request correction of personal data if it is incomplete or incorrectly processed and to request that the transaction carried out in this context be notified to third parties to whom personal data has been transferred,

·       To request the deletion or destruction of personal data in the event that the reasons requiring its processing disappear, although it has been processed in accordance with the provisions of the KVK Law and other relevant laws, and to request that the transaction carried out in this context be notified to the third parties to whom personal data has been transferred,

·       To object to the occurrence of a result against the person themselves by analyzing the processed data exclusively through automated systems,

·       To request compensation for the damage arising from the unlawful processing of personal data.

In case personal data is not obtained directly from the data subject; the Company carries out activities to inform data subjects (1) within a reasonable period from the acquisition of personal data, (2) if personal data is to be used for communication with the data subject, during the first communication, (3) if personal data is to be transferred, at the latest when the personal data is transferred for the first time.

5.2. Circumstances where the personal data subject cannot assert their rights: Personal data subjects cannot assert their rights listed in 5.1 in these matters, as the following cases are kept outside the scope of the KVK Law pursuant to Article 28 of the KVK Law:

·       Processing of personal data by natural persons within the scope of activities exclusively related to themselves or their family members living in the same residence, provided that they are not disclosed to third parties and obligations regarding data security are complied with,

·       Processing of personal data for purposes such as research, planning, and statistics by anonymizing them with official statistics,

·       Processing of personal data for artistic, historical, literary, or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public security, public order, economic security, right to privacy, or personal rights, or constitute a crime,

·       Processing of personal data within the scope of preventive, protective, and intelligence activities carried out by public institutions and organizations assigned and authorized by law to ensure national defense, national security, public security, public order, or economic security,

·       Processing of personal data by judicial authorities or execution authorities in relation to investigation, prosecution, trial, or execution procedures.

Pursuant to Article 28.2 of the KVK Law; in the cases listed below, personal data subjects cannot assert their other rights listed in 5.1, except for the right to demand compensation for damages:

·       Personal data processing being necessary for the prevention of committing a crime or for a criminal investigation,

·       Processing of personal data made public by the personal data subject themselves,

·       Personal data processing being necessary for the execution of supervisory or regulatory duties and for disciplinary investigation or prosecution by authorized and assigned public institutions and organizations and professional organizations in the nature of public institutions, based on the authority granted by law,

·       Personal data processing being necessary for the protection of the economic and financial interests of the State regarding budget, tax, and financial matters.

6. Deletion, Destruction, Anonymization of Personal Data As regulated in Article 138 of the Turkish Penal Code and Article 7 of the KVK Law, although it has been processed in accordance with the relevant law provisions, personal data is deleted, destroyed, or anonymized based on the Company’s decision or upon the request of the personal data subject if the reasons requiring its processing disappear. In this context, the Company, by taking the necessary technical and administrative measures within the Company to fulfill its relevant obligation, has developed the necessary operational mechanisms in this regard; it trains, assigns, and ensures the awareness of the relevant business units to comply with these obligations.