KVKK Clarification Text

SİFF ELEKTROMEKANİK SAN. TİC. LTD. ŞTİ.

CLARIFICATION TEXT ON THE PROCESSING OF PERSONAL DATA

This Clarification Text has been prepared by SİFF ELEKTROMEKANİK SAN. TİC. LTD. ŞTİ. (“the Company”) in order to inform the Company’s customers regarding the processing of their personal data by the Company within the scope of the Personal Data Protection Law No. 6698 (“the Law”).

For detailed information on the processing of your personal data within the scope of this Clarification Text, you can refer to the SİFF ELEKTROMEKANİK SAN. TİC. LTD. ŞTİ. Personal Data Protection and Processing Policy available at [www.siff.com].

a) Methods of Obtaining Personal Data and Legal Reasons

Your personal data is collected electronically or physically. Your personal data collected for the legal reasons specified in this Clarification Text can be processed and shared within the framework of the personal data processing conditions specified in Articles 5 and 6 of the Law.

b) Purposes of Processing Personal Data

Within the framework of the personal data processing conditions specified in Articles 5 and 6 of the Law, your personal data is processed for the following purposes: planning and execution of the activities required to customise the products and services offered by the Company according to the tastes, usage habits and needs of the persons concerned and to recommend and promote them to those persons; carrying out the necessary work by the business units so that the persons concerned can benefit from the products and services offered by the Company, and running the related business processes; carrying out the necessary work by the relevant business units for the realisation of the commercial activities carried out by the Company, and running the related business processes; planning and execution of the Company’s commercial and/or business strategies; and ensuring the legal, technical and commercial-occupational security of the Company and of the persons who have a business relationship with the Company.

c) Parties to Whom Personal Data May Be Transferred and Purposes of Transfer

Within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law, your personal data may be shared with the Company’s business partners and suppliers, with legally authorised institutions and organisations, and with legally authorised private law legal entities, for the following purposes: planning and execution of the activities required to customise the products and services offered by the Company according to the tastes, usage habits and needs of the persons concerned and to recommend and promote them to those persons; carrying out the necessary work by the business units so that the persons concerned can benefit from the products and services offered by the Company, and running the related business processes; carrying out the necessary work by the relevant business units for the realisation of the commercial activities carried out by the Company, and running the related business processes; and planning and execution of the Company’s commercial and/or business strategies and ensuring the legal, technical and commercial-occupational security of the Company and of the persons in a business relationship with the Company.

d) Rights of Data Subjects and Exercise of These Rights

If, as a personal data subject, you submit your requests regarding the rights stated below to the Company through the methods specified under the heading Exercise of Rights by Data Subjects, your requests will be evaluated and finalised by our Company as soon as possible and in any case within 30 (thirty) days.

Pursuant to Article 11 of the Law, as a personal data subject you have the following rights:

To learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of processing your personal data and whether it is used in accordance with that purpose; to know the third parties to whom your personal data is transferred, in Turkey or abroad; to request correction of your personal data if it is incomplete or incorrectly processed, and to request that the correction be notified to the third parties to whom the data has been transferred; to request the deletion or destruction of your personal data if the reasons requiring its processing cease to exist even though it was processed in accordance with the Law and other relevant laws, and to request that this be notified to the third parties to whom the data has been transferred; to object to a result arising against you from the analysis of your processed data exclusively through automated systems; and to request compensation if you suffer damage due to unlawful processing of your personal data.

Paragraph 2 of Article 28 of the Law lists the cases in which data subjects may not exercise these rights; in this context:

Where personal data processing is necessary for the prevention of crime or for a criminal investigation; where personal data made public by the person concerned is processed; where personal data processing is necessary for the execution of supervisory or regulatory duties and for disciplinary investigation or prosecution by authorised public institutions and organisations and by professional organisations in the nature of public institutions, based on the authority granted by law; or where personal data processing is necessary for the protection of the economic and financial interests of the State with regard to budget, tax and financial matters, the rights listed above cannot be exercised in respect of that data.

According to paragraph 1 of Article 28 of the Law, the following cases fall outside the scope of the Law, so data subjects’ requests will not be processed in respect of such data either:

Processing of personal data by natural persons entirely in relation to themselves or to family members living in the same residence, provided that the data is not given to third parties and that the obligations regarding data security are complied with.

Processing of personal data for purposes such as research, planning and statistics, by anonymising it within official statistics.

Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defence, national security, public security, public order, economic security, privacy of private life or personal rights, and does not constitute a crime.

Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organisations authorised by law to ensure national defence, national security, public safety, public order or economic security.

Processing of personal data by judicial authorities or execution authorities in relation to investigation, prosecution, trial or execution proceedings.

Exercise of Rights by Data Subjects

Applications will be made by one of the following methods, together with documents identifying the data subject:

Filling in the form and delivering a wet-signed copy by hand, through a notary public or by registered letter with return receipt to the address [NOSAB Erguvan Cad. No:16 Nilüfer / Bursa TÜRKİYE]; signing the form with a secure electronic signature issued within the scope of the Electronic Signature Law No. 5070 and sending it by registered electronic mail to [……………………..@hs02].kep.tr; or following a method prescribed by the Personal Data Protection Board.

The Company responds to data subjects who wish to exercise these rights within the limits set out in the Law, within a maximum of thirty (30) days as stipulated in the Law. For third parties to apply on behalf of personal data subjects, a special power of attorney issued by the data subject through a notary public in the name of the applicant must be present.

Data subject applications are processed free of charge as a rule; however, a fee may be charged based on the fee schedule stipulated by the Personal Data Protection Board.

The Company may request information from the applicant in order to establish whether the applicant is the personal data subject, and may ask the data subject questions about the application in order to clarify the matters specified in it.