Privacy notice onthe processingof personal data

This is an English translation of our Turkish privacy notice (KVKK Aydınlatma Metni), provided for information. If the two versions differ, the Turkish version prevails.

SEYHAN ZİNCİR VE DİŞLİ SANAYİ VE TİCARET LİMİTED ŞİRKETİ

This Privacy Notice has been prepared by SEYHAN ZİNCİR VE DİŞLİ SANAYİ VE TİCARET LİMİTED ŞİRKETİ (the “Company”) in order to inform the Company’s customers about the processing of their personal data by the Company within the scope of Law No. 6698 on the Protection of Personal Data (KVKK, the “Law”).

Detailed information on the processing of your personal data within the scope of this Privacy Notice is available in the SEYHAN ZİNCİR VE DİŞLİ SANAYİ VE TİCARET LİMİTED ŞİRKETİ Personal Data Protection and Processing Policy published at www.seyhanzincir.com.tr.

a) Methods of Collecting Personal Data and Legal Grounds

Your personal data is collected by electronic or physical means. Your personal data collected on the legal grounds set out in this Privacy Notice may be processed and shared within the framework of the personal data processing conditions set out in Articles 5 and 6 of the Law.

b) Purposes of Processing Personal Data

Your personal data is processed, within the framework of the personal data processing conditions set out in Articles 5 and 6 of the Law, for the purposes of: planning and carrying out the activities necessary to customise the products and services offered by the Company according to the preferences, usage habits and needs of data subjects and to recommend and promote them to data subjects; the performance by the business units of the work necessary to enable data subjects to benefit from the products and services offered by the Company, and the conduct of the related business processes; the performance by the relevant business units of the work necessary to carry out the commercial activities conducted by the Company, and the conduct of the related business processes; planning and implementing the Company’s commercial and/or business strategies; and ensuring the legal, technical and commercial and business security of the Company and of the data subjects who are in a business relationship with the Company.

c) Parties with Whom Personal Data May Be Shared and Purposes of Sharing

Your personal data may be shared with the Company’s business partners and suppliers, with legally authorised institutions and organisations, and with legally authorised private legal entities, within the framework of the personal data processing conditions and purposes set out in Articles 8 and 9 of the Law, for the purposes of: planning and carrying out the activities necessary to customise the products and services offered by the Company according to the preferences, usage habits and needs of data subjects and to recommend and promote them to data subjects; the performance by the business units of the work necessary to enable data subjects to benefit from the products and services offered by the Company, and the conduct of the related business processes; the performance by the relevant business units of the work necessary to carry out the commercial activities conducted by the Company, and the conduct of the related business processes; planning and implementing the Company’s commercial and/or business strategies; and ensuring the legal, technical and commercial and business security of the Company and of the data subjects who are in a business relationship with the Company.

d) Rights of Data Subjects and Exercise of These Rights

Where you, as data subjects, submit your requests concerning the rights set out below to the Company by the methods specified under the heading Exercise of Rights by Data Subjects, your requests will be assessed and concluded by our Company as soon as possible and in any event within 30 (thirty) days.

Pursuant to Article 11 of the Law, as a data subject you have the following rights:

• To learn whether or not your personal data has been processed,
• To request information in this regard if your personal data has been processed,
• To learn the purpose of the processing of your personal data and whether it is used in accordance with that purpose,
• To know the third parties in Türkiye or abroad to whom your personal data has been transferred,
• To request the rectification of your personal data if it has been processed incompletely or inaccurately, and to request that the action taken in this respect be notified to the third parties to whom the personal data has been transferred,
• To request the erasure or destruction of your personal data if the reasons requiring its processing cease to exist, even though it has been processed in accordance with the provisions of the Law and other relevant legislation, and to request that the action taken in this respect be notified to the third parties to whom the personal data has been transferred,
• To object to a result arising to your detriment as a consequence of the analysis of your processed data exclusively by automated systems,
• To request compensation for the damage in the event that you suffer damage as a result of the unlawful processing of your personal data.

Paragraph 2 of Article 28 of the Law lists the cases in which data subjects have no right to make requests; accordingly, where:

• the processing of personal data is necessary for the prevention of crime or for a criminal investigation,
• personal data made public by the data subject themselves is processed,
• the processing of personal data is necessary for the performance of supervisory or regulatory duties, or for disciplinary investigation or prosecution, by the competent and authorised public institutions and organisations and by professional organisations having the status of public institutions, on the basis of the authority conferred by law,
• the processing of personal data is necessary for the protection of the economic and financial interests of the State in relation to budgetary, tax and financial matters,

the rights set out above may not be exercised in respect of such data.

Pursuant to paragraph 1 of Article 28 of the Law, since data falls outside the scope of the Law in the following cases, requests of data subjects will not be acted upon in respect of such data either:

• The processing of personal data by natural persons within the scope of activities relating exclusively to themselves or to family members living in the same household, provided that the data is not disclosed to third parties and the obligations concerning data security are complied with.
• The processing of personal data through official statistics, or for purposes such as research, planning and statistics by being anonymised.
• The processing of personal data for artistic, historical, literary or scientific purposes, or within the scope of freedom of expression, provided that it does not violate national defence, national security, public security, public order, economic security, the privacy of private life or personal rights, and does not constitute a criminal offence.
• The processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organisations assigned and authorised by law to ensure national defence, national security, public security, public order or economic security.
• The processing of personal data by judicial authorities or enforcement authorities in relation to investigation, prosecution, trial or enforcement proceedings.

Exercise of Rights by Data Subjects

In order to exercise the rights mentioned above, data subjects may use the “Form for Applications to Be Made by the Data Subject to the Data Controller” available at www.seyhanzincir.com.tr.

Applications shall be made, together with documents establishing the identity of the data subject concerned, by one of the following methods:

• Delivering a completed copy of the form bearing a wet-ink signature by hand, through a notary public or by registered letter with return receipt to Karasoku Mah. Kızılay Cad. Serhan İşhanı No:14/C, Seyhan / Adana, Türkiye,
• Sending the form, signed with a secure electronic signature as defined under Electronic Signature Law No. 5070, by registered electronic mail (KEP) to [email protected],
• Following a method prescribed by the Personal Data Protection Board.

Within the limits prescribed by the Law, the Company responds to data subjects wishing to exercise these rights within a maximum of thirty (30) days, again as prescribed by the Law. In order for third parties to submit an application on behalf of data subjects, a special power of attorney issued through a notary public by the data subject in the name of the person making the application must be provided.

Although applications by data subjects are, as a rule, handled free of charge, a fee may be charged in accordance with the fee schedule¹ set by the Personal Data Protection Board.

In order to determine whether the applicant is the data subject, the Company may request information from the person concerned and, in order to clarify the matters stated in the application, may put questions to the data subject regarding the application.

¹ Pursuant to the “Communiqué on the Procedures and Principles for Applications to the Data Controller” published in Official Gazette No. 30356 dated 10 March 2018, if the response to a data subject’s application is to be given in writing, no fee is charged for up to ten pages. A processing fee of 1 Turkish lira may be charged for each page above ten. If the response to the application is provided on a recording medium such as a CD or flash drive, the fee that may be requested by the institution may not exceed the cost of the recording medium.