GDPR

ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ.

Policy on the Processing and Protection of Personal Data

Purpose and Scope of the Policy

Personal Data Protection Law No. 6698, which entered into force in 2016 after the protection of personal data became a Constitutional right in 2010, is a legal protection instrument developed in order to preserve the principle of the privacy of private life at the stage of the processing of personal data and to prevent fundamental rights and freedoms from being harmed, and which sets out the procedures and principles on this subject.

Pursuant to Article 16 of Law No. 6698 (“KVKK” or “the Law”), data controllers who are obliged to register with the Data Controllers' Registry have the obligation to prepare a policy on the protection and processing of personal data in accordance with the personal data processing inventory.

This Policy on the Protection and Processing of Personal Data has been prepared by ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. in its capacity as data controller, in order to determine the procedures and principles to be applied by ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. concerning the protection and processing of the personal data that we hold, pursuant to Law No. 6698 and the other applicable legislation.

DEFINITIONS

Registry; is the registry of data controllers kept by the Presidency of the Personal Data Protection Authority.

Explicit Consent; consent relating to a specific subject, based on information and declared with free will. Personal Data, any kind of information relating to an identified or identifiable natural person. Processing of Personal Data, any operation performed on data, such as obtaining, recording, storing, retaining, altering, rearranging, disclosing, transferring, taking over, making obtainable, classifying or preventing the use of personal data, by wholly or partly automated means or by non-automated means provided that it forms part of any data recording system. Disposal is the deletion, destruction or anonymization of personal data. Deletion of personal data is the operation of rendering the data unusable in any way. Destruction of personal data is the operation of rendering the data inaccessible, irretrievable and unusable by anyone in any way.

Data recording system; is the recording system in which personal data are processed by being structured according to specific criteria.

The Subjects Defined by the Personal Data Protection Law and by the Regulation

The data controller is the natural or legal person who determines the purposes and means of processing personal data and who is responsible for the establishment and management of the data recording system.

The Relevant User means the persons who process personal data within the organization of the data controller or in accordance with the authorization and the instructions received from the data controller, excluding the person or the unit responsible for the technical storage, protection and backup of the data.

The Recipient Group is the category of natural or legal persons to whom personal data are transferred by the data controller.

The data subject is the natural person whose personal data are processed.

The Inventory is the inventory that data controllers create by associating the personal data processing activities they carry out depending on their business processes with the purposes and the legal basis of personal data processing, the data category, the recipient group to which data are transferred and the group of persons who are the subject of the data, and that they set out in detail by explaining the maximum retention period necessary for the purposes for which the personal data are processed, the personal data whose transfer to foreign countries is envisaged and the measures taken concerning data security.

The reason for the introduction of the obligation to prepare an inventory is; to ensure compliance with the Law in all processes connected with the activities of data controllers, in other words, to make it easy to determine whether there is any processing of personal data contrary to the Law. In other words, it is a kind of self-audit by the data controller regarding the compliance of personal data processing activities with the Law.

Regulation on the Deletion, Destruction or Anonymization of Personal Data

ARTICLE 5 - (1) Data controllers who are obliged to register with the Data Controllers' Registry pursuant to Article 16 of the Law are obliged to prepare a personal data retention and disposal policy in accordance with the personal data processing inventory.

Pursuant to the Regulation on the Data Controllers' Registry, as ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. our inventory contains at a minimum;

• The data category,
• The purposes and the legal basis of personal data processing,
• The recipient / recipient groups to whom data are transferred,
• The groups of persons who are the subject of the data,
• The maximum retention period necessary for the purposes for which personal data are processed,
• The personal data whose transfer to foreign countries is envisaged,
• The technical and administrative measures taken concerning data security are included.

CONDITIONS FOR PROCESSING PERSONAL DATA

The processing of personal data is defined in Article 3 of the Law. Accordingly, as data controller, ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. regards as processing of personal data any operation performed on data, such as obtaining, recording, storing, retaining, altering, rearranging, disclosing, transferring, taking over, making obtainable, classifying or preventing the use of personal data, by wholly or partly automated means or by non-automated means provided that it forms part of any data recording system.

The conditions for processing personal data are enumerated in Article 5 of the Law, and acting accordingly, we lawfully process personal data where at least one of the following situations exists.

• The existence of the explicit consent of the data subject,
• Being expressly prescribed by the laws,
• Being compulsory for the protection of the life or the bodily integrity of the person who is unable to declare his or her consent owing to actual impossibility or whose consent is not recognized as legally valid, or of another person,
• Being necessary to process the personal data of the parties to a contract, provided that it is directly related to the establishment or the performance of that contract,
• Being compulsory in order for the data controller to be able to fulfil its legal obligation,
• Having been made public by the data subject himself or herself,
• Being compulsory to process data for the establishment, the exercise or the protection of a right,
• Being compulsory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject. The conditions for processing personal data, that is to say the cases of lawfulness, have been determined in the Law by way of enumeration, and these conditions cannot be extended.
• In our capacity as data controller, as ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. we process data by satisfying the conditions enumerated above.

I. EXPLICIT CONSENT

As data controller, ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. we first assess, when carrying out a data processing activity, whether it is possible to rely on one of the other conditions for processing data, and if none of them exists, we resort to obtaining the explicit consent of the data subject.

II. BEING EXPRESSLY PRESCRIBED BY THE LAWS

One of the conditions for processing data is that it is expressly prescribed by the laws. A provision in the laws to the effect that personal data may be processed will constitute a condition for processing. For example, the keeping of personnel files of employees pursuant to the relevant legislation, the taking of the fingerprints of suspects by law enforcement on account of a criminal investigation pursuant to Article 5 of the Law No. 2559 on the Duties and Powers of the Police (PVSK), and the processing by the Ministry of Justice of data relating to the criminal convictions of persons pursuant to the Law No. 5352 on Criminal Records fall within this scope.

III. ACTUAL IMPOSSIBILITY

Where it is compulsory for the protection of the life or the bodily integrity of the person himself or herself or of another person, the personal data of the person who is unable to declare his or her consent owing to actual impossibility or whose consent is not recognized as legally valid may be processed.

IV. BEING NECESSARY FOR THE ESTABLISHMENT AND THE PERFORMANCE OF A CONTRACT

Where it is compulsory to process the personal data of the parties to a contract, provided that it is directly related to the establishment or the performance of that contract, the processing of the personal data of the data subjects is possible limited to this purpose.

V. BEING COMPULSORY IN ORDER FOR THE DATA CONTROLLER TO BE ABLE TO FULFIL ITS LEGAL OBLIGATION

In the cases where the processing of data is compulsory in order for the data controller to be able to fulfil its legal obligation, the personal data of the data subject may be processed.

As ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. the obtaining and the processing of data such as the employee's bank account number, the persons he or she is obliged to support, whether his or her spouse works and his or her social security number, in order to be able to pay salaries to employees, may be given as an example of this situation.

Our submitting, in our capacity as employer, the information belonging to our employees for the examination of the relevant public officials during a tax audit may also be assessed within this scope.

VI. PERSONAL DATA HAVING BEEN MADE PUBLIC BY THE DATA SUBJECT

Personal data made public by the person himself or herself, in other words disclosed to the public in any manner, may be processed. An example of this situation is a person publicly announcing his or her contact details in order to be contacted in certain cases. It may also be spoken of as making public where, on corporate websites, the workplace telephone numbers and the corporate electronic mail addresses of employees are shared in a manner open to the access of third parties. However, in order for personal data to be considered public, the person to whom they belong must wish them to be public. In other words, for making public to take place, the will to make public must exist.

These grounds in principle do not regard the fact that a person's personal data are in a place where everyone can see them as making them public, and accept that the person has made the data he or she shared public only for that purpose.

VII. THE PROCESSING OF PERSONAL DATA BEING COMPULSORY FOR THE ESTABLISHMENT OR THE EXERCISE OF A RIGHT

Where it is compulsory for the establishment, the exercise or the protection of a right, the processing of the personal data of the data subject is possible.

As ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. the retention for these purposes of documents such as invoices, contracts and surety bonds, until the end of the limitation period against possible legal proceedings, after the contracts we have established have come to an end, will be assessed within this scope.

VIII. THE PROCESSING OF DATA BEING COMPULSORY FOR THE LEGITIMATE INTERESTS OF THE DATA CONTROLLER, PROVIDED THAT IT DOES NOT HARM THE FUNDAMENTAL RIGHTS AND FREEDOMS OF THE DATA SUBJECT

Where the processing of data is compulsory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject, the processing of personal data is possible.

In some cases, data processing may be in question in terms of the legitimate interest of the data controller. For example, provided that it does not harm the fundamental rights and freedoms of our employees, we assess the processing of our employees' personal data with a view to serving as a basis for their promotions, their salary increases or the arrangement of their social benefits, or for the distribution of duties and roles during the restructuring process of the enterprise, as falling within the scope of the legitimate interest of the data controller.

FUNDAMENTAL PRINCIPLES CONCERNING THE PROCESSING OF PERSONAL DATA

ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. adopts the fundamental principles enumerated below within the scope of ensuring and maintaining compliance with the personal data protection legislation:

There are fundamental principles concerning the processing of personal data which have been accepted in international instruments and reflected in the practice of many countries. In Article 4 of the Law, the procedures and principles concerning the processing of personal data have been laid down in parallel with Convention No. 108 and with European Union Directive 95/46/EC.

Accordingly, the general (fundamental) principles enumerated in the Law for the processing of personal data are as follows:

• Being in compliance with the law and the rules of good faith,
• Being accurate and, where necessary, up to date,
• Being processed for specific, explicit and legitimate purposes,
• Being connected with, limited to and proportionate to the purposes for which they are processed,
• Being retained for the period prescribed in the relevant legislation or necessary for the purpose for which they are processed. The principles concerning the processing of personal data must lie at the heart of all personal data processing activities, and all personal data processing activities must be carried out in accordance with these principles.

A) The Principle of Being in Compliance with the Law and the Rules of Good Faith

Being in compliance with the law and the rule of good faith expresses the obligation to act, in the processing of personal data, in accordance with the principles introduced by the laws and by the other legal regulations.

Pursuant to the principle of being in compliance with the rule of good faith, in our capacity as data controller ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ., we always take into account the interests and the reasonable expectations of the data subjects while seeking to attain our objectives in data processing. Moreover, we act in principle in a manner that prevents the emergence of results which the data subject does not expect and need not expect. Pursuant to the said principle, we also ensure that the data processing activity in question is transparent for the data subject and, in our capacity as data controller ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ., we always act in compliance with our obligations of information and warning.

B) The Principle of Being Accurate and, Where Necessary, Up to Date

As ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. we are aware that we bear an active duty of care as regards ensuring that personal data are accurate and, where necessary, up to date. Accordingly, we always keep open the channels that will ensure that the information of the data subject is accurate and up to date.

C) The Principle of Being Processed for Specific, Explicit and Legitimate Purposes

• The principle that the purposes of processing personal data must be specific, legitimate and explicit;
• Ensures that personal data processing activities are clearly understandable by the data subject,
• Ensures that it is determined on which legal processing condition the personal data processing activities are carried out,
• Ensures that the personal data processing activity and the purpose for which this activity is carried out are set out in such detail as to establish their specificity.

In this respect, as ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. we display a high degree of care in complying with the principle of specificity and clarity in the legal transactions and texts in which the purposes of processing personal data are explained (explicit consent, information, responding to the applications of the data subject, the application to the data controllers' registry), and, when presenting the said legal texts to the other party, we keep the use of technical and legal terminology to a minimum level so that they may easily be understood by everyone.

Acting in accordance with this principle is also important as regards compliance with the principle of good faith.

D) The Principle of Being Connected with, Limited to and Proportionate to the Purposes for which They are Processed

As ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. we ensure that the data processed are suitable for the realization of the determined purposes and we avoid the unnecessary processing of personal data that are not related to the realization of the purpose or that are not needed. At this point, we process personal data at a minimum level so that they may serve the determined purpose.

Likewise, no recourse is had to the processing of data for the purpose of meeting needs that are likely to arise subsequently. Moreover, the data processed will be limited to the personal data that are necessary solely for the realization of the purpose. ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. in principle avoids, once sufficient data for the realization of the purpose have been obtained, the processing of data that are not necessary for any purpose beyond that.

E) The Principle of Being Retained for the Period Prescribed in the Relevant Legislation or Necessary for the Purpose for which They are Processed

ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. retains personal data in accordance with the period necessary for the purpose for which they are processed, as a requirement of the “purpose limitation principle”. As is also stated in Article 12 of the Law, the data controller is obliged to take all necessary technical and administrative measures in order to ensure an appropriate level of security, with a view to preventing the unlawful processing of personal data, preventing unlawful access to personal data and ensuring the retention of personal data. On this matter, as ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. we are aware that we are obliged to take the administrative and technical measures.

In addition to the retention periods determined, in our capacity as data controller, as ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. pursuant to the purpose limitation principle for the retention of personal data, there are also retention periods that we have determined within the scope of the relevant legislation to which we are subject. Accordingly, as data controller, as ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ., if there is a period prescribed in the legislation for the personal data concerned we will observe that period; if no such period is prescribed, we retain the data only for the period necessary for the purpose for which they are processed.

Where there is no valid ground for retaining a piece of data any longer, that data will be deleted, destroyed or anonymized. It was mentioned above that no recourse may be had to the retention of personal data on the ground that they might be used again in the future or for any other reason.

Furthermore, in our capacity as data controller, as ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. while making the application for registration with the registry pursuant to Article 16 of the Law, we determined the maximum period necessary for the purpose of processing personal data by taking into account Article 9 of the Regulation on the Data Controllers' Registry, and the necessary periods have been published in our legal texts.

CONDITIONS FOR PROCESSING PERSONAL DATA OF SPECIAL NATURE

Personal data of special nature are data of such a nature that, if they are learned, they may give rise to discrimination against or the victimization of the data subject. For this reason, as ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. we are aware that, as regards the protection and the processing of data of the said nature, such data must be protected far more strictly than other personal data. Indeed, the law attributes special importance to these data and introduces a different set of rules concerning them. The law regards them as personal data of special nature or as sensitive data. Personal data of special nature may be processed with the explicit consent of the data subject or in the limited cases enumerated in the Law.

Pursuant to the Law, as ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. we process personal data of special nature by obtaining the explicit consent of the data subject.

However, pursuant to the Law, the processing of personal data of special nature is also possible, apart from the explicit consent of the data subject, in the following cases:

• Personal data of special nature other than those relating to health and sexual life, only in the cases prescribed by the laws,
• Personal data relating to health and sexual life may only be processed, for the purposes of the protection of public health, preventive medicine, medical diagnosis, the carrying out of treatment and care services, and the planning and management of health services and their financing, by persons under an obligation of secrecy or by authorized institutions and organizations.

PERSONAL DATA CATEGORIES

A) Identity Information:

These are the personal data containing information relating to the identity of the person; documents such as a driving licence, an identity card and a passport containing information such as name and surname, Republic of Turkey identity number, nationality information, mother's name and father's name, place of birth, date of birth and gender, as well as information such as tax number, social security (SGK) number, signature information, vehicle plate number, etc.

B) Contact Information

Contact information; personal data such as telephone number, address, e-mail address and fax number.

C) Physical Space Security Information

Personal data relating to the records and the documents taken upon entry into a physical space and during the stay within the physical space; camera records, fingerprint records and records taken at the security point, etc.

D) Professional Experience

Personal data containing, at the stages of the conduct and the completion of the job application processes of candidate employees, information relating to the previous employment, experience and careers and to the curricula vitae of Employees, as well as information relating to the certificates and the courses they have obtained.

E) Financial Information

Personal data processed in relation to any information, documents and records showing any financial result created within the scope of the legal relationship between ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. and the data owner, as well as personal data such as bank account number, IBAN number, credit card information, financial profile, asset data and income information.

F) Personnel File

This DATA category consists of the personal data containing documents such as payroll information, the employment entry and exit document, the unemployment registration document, the occupational accident report, the deed of release, the personnel leave form, etc.

G) Personal Data of Special Nature

The data specified in Article 6 of the Personal Data Protection Law (for example: health data including blood group, biometric data, religion and information on the association of which the person is a member).

H) Criminal Convictions and Security Measures

Information relating to criminal record and to security measures

I) Information on Family Members and Relatives

Personal data concerning the family members (for example: spouse, mother, father, child) and the relatives of the personal data owner, within the framework of the operations carried out by the business units of ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ., for the purpose of protecting the legal interests of ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. and of the data owner.

J) Customer Transaction

These are the personal data containing the tax number and the invoice, cheque and promissory note information of the customer or of the person purchasing a Product or a Service.

K) Marketing

Shopping history information, surveys, cookie records, information obtained through campaign work, etc.

L) Transaction Security

IP address information, website entry and exit information, password and passcode information, etc.

M) Location

Location information of the place where you are, etc.

N) Risk Management

Information processed for the management of Commercial, Technical and Administrative Risks, etc.

O) Legal Transaction

Information in the correspondence conducted with Judicial Authorities and information contained in case files, etc

INFORMING PERSONAL DATA OWNERS

ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. carries out the necessary processes in order to ensure that the data owners are informed during the obtaining of personal data, in accordance with Article 10 of the Personal Data Protection Law and with the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform. Within this scope, the information texts presented to the data owners by ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. contain the information enumerated below:

(1) The address and contact details of ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. as data controller

(2) Which personal data of the data owners will be processed by ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. and for what purpose,

(3) To whom and for what purpose the processed personal data may be transferred,

(4) The method of collecting personal data and the legal basis therefor,

(5) The rights of the data owner, namely;

• To learn whether his or her personal data are processed,
• If his or her personal data have been processed, to request information in this regard,
• To learn the purpose of the processing of personal data and whether they are used in accordance with their purpose,
• To know the third parties to whom personal data are transferred domestically or abroad,
• In the event that personal data have been processed incompletely or incorrectly, to request their rectification and to request that the operation carried out be notified to the third parties to whom the personal data have been transferred,
• To request the deletion or the destruction of personal data within the framework of the prescribed conditions and to request that the operation carried out be notified to the third parties to whom the personal data have been transferred,
• To object to the emergence of a result to the detriment of the person himself or herself by means of the analysis of the processed data exclusively through automated systems,
• To request the compensation of the damage in the event that he or she suffers damage on account of the unlawful processing of personal data

RESOLUTION OF THE REQUESTS OF PERSONAL DATA OWNERS BY ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ.

Where the data owners transmit their requests concerning their personal data to ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. in writing or by the other methods determined by the KVK Board, the requests that the data subject has transmitted to us in order to exercise, in accordance with Article 13 of the Law, any of the rights set out in Article 11 of the Law are concluded by ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. in its capacity as data controller within 30 (thirty) days at the latest, and the data subject is informed.

The data owners must make their requests concerning their personal data in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller.

ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. may, within the scope of ensuring data security, request information in order to determine whether the person making the application is the owner of the personal data that are the subject of the application. It may also put questions to the personal data owner concerning his or her application in order to ensure that the application of the personal data owner is concluded in a manner consistent with the request.

ENSURING THE SECURITY AND THE CONFIDENTIALITY OF PERSONAL DATA BY ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ.

ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. takes, as far as possible and according to the nature of the data to be protected, every kind of necessary measure in order to prevent the unlawful disclosure of personal data, unlawful access to them, their unlawful transfer or security deficiencies that may arise in other ways.

Within this scope, every kind of necessary (i) administrative and (ii) technical measure is taken by ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ., (iii) an audit system is established within its structure and (iv) in the event of the disclosure of personal data by unlawful means, action is taken in accordance with the measures prescribed in the Personal Data Protection Law

(1) The Administrative Measures Taken by ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. in order to Ensure the Lawful Processing of Personal Data and to Prevent Unlawful Access to Personal Data;

• ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. trains its employees on the legislation concerning the protection of personal data and ensures that they are made aware of it.
• In the cases where personal data are the subject of a transfer, ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. ensures that provisions to the effect that the party to whom the personal data are transferred will fulfil its obligations aimed at ensuring data security are added to the contracts concluded with the persons to whom the personal data are transferred.
• The personal data processing activities carried out by ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. are examined in detail and, within this scope, the steps that must be taken in order to ensure compliance with the personal data processing conditions prescribed in the Personal Data Protection Law are determined.
• ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. determines the practices that must be implemented in order to ensure compliance with the Personal Data Protection Law and regulates these practices by means of internal policies.

(2) The Technical Measures Taken by ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. in order to Ensure the Lawful Processing of Personal Data and to Prevent Unlawful Access to Personal Data;

• Technical measures appropriate to the technology are taken in order to prevent access to the systems and the locations where personal data are stored, and the measures taken are updated periodically.
• ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. designs and puts into operation the technical processes of access and authorization in accordance with the legal compliance requirements determined on a business unit basis.
• The relevant software and systems, including the software and hardware containing virus protection systems and firewalls, have been installed.
• The employees within ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. have been trained on the technical measures taken within this scope.
• ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. obtains from its employees an undertaking that they will not disclose to others the personal data they have learned contrary to the provisions of the KVKK and that they will not use them outside the purpose of processing. This undertaking will continue after they leave employment as well.
• Provisions concerning the taking of the security measures necessary for the purpose of protecting personal data have been added to the contracts concluded by ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. with the persons to whom personal data are transferred.
• The administrative and technical measures that we have taken as ERBATUR FOOD, GLASS, ELECTRONICS, CONSTRUCTION, TEXTILE, PLASTIC INDUSTRY AND MARKETING IMPORT EXPORT LTD. ŞTİ. concerning the protection and the confidentiality of personal data are explained in greater detail in our “Personal Data Retention and Disposal Policy”.