Personal Data Protection

Identity of the Data Controller

Pursuant to Law No. 6698 on the Protection of Personal Data, your personal data may be processed, recorded, stored, classified and updated — and, where permitted by legislation and/or limited to the purposes for which they are processed, disclosed/transferred to third parties — in compliance with the law and the rules of good faith and within the scope explained below, by Çeliktaş Tekstil Tic. ve San. A.Ş. as the data controller, located at İkitelli Org. San. Bölg. Atatürk Bulv. Sürmeli İş Merkezi No: 108/A İkitelli – İstanbul.

The Purposes for Which Personal Data Will Be Processed

Our Company processes personal data limited to the purposes and conditions within the personal data processing requirements set out in Article 5(2) and Article 6(3) of Law No. 6698 on the Protection of Personal Data. These purposes and conditions are;

– Where our Company carrying out the relevant activity in relation to the processing of your personal data is expressly stipulated by laws,

– Where the processing of your personal data by our Company is directly related and necessary to the conclusion or performance of a contract,

– Where the processing of your personal data is mandatory for our Company to be able to fulfil its legal obligation,

– Provided that your personal data has been made public by you; its processing by our Company in a manner limited to the purpose for which it was made public,

– Where the processing of your personal data by our Company is mandatory for the establishment, exercise or protection of the rights of our Company or of you or of third parties,

– Where, provided that it does not harm your fundamental rights and freedoms, processing of personal data is mandatory for the legitimate interests of our Company,

– Where the processing of personal data by our Company is mandatory for the protection of the life or bodily integrity of the data subject or of another person, and where, in such case, the data subject is unable to give consent due to actual impossibility or legal invalidity,

– Where the processing of special categories of personal data other than the health and sexual life of the data subject is stipulated by laws,

– Special categories of personal data relating to the health and sexual life of the data subject are processed by persons under an obligation of confidentiality or by authorised institutions and organisations, for the purposes of protecting public health, preventive medicine, medical diagnosis, the carrying out of treatment and care services, and the planning and management of health services and their financing.

In the absence of these conditions, the Company resorts to the explicit consent of the data subjects in order to carry out personal data processing activities.

Under the conditions stated above, our Company may process personal data for the following purposes, including but not limited to:

In line with the necessary work being carried out by our relevant business units and the conduct of the related business processes for the realisation of the commercial activities pursued by the Company;

– Planning and execution of the activities for ensuring business operations and business continuity,

– Follow-up of finance and/or accounting affairs,

– Provision of information arising from legislation to authorised institutions,

– Planning and execution of corporate communication activities,

– Planning and execution of production and/or operation processes

– Planning and execution of the information-access authorisations of business partners and/or suppliers

In line with the necessary work being carried out by our business units and the conduct of the related business processes in order to enable relevant persons to benefit from the products and services offered by the Company;

– Planning and execution of customer relationship management processes,

– Follow-up of customer requests and/or complaints,

– Planning and execution of the marketing processes of products and/or services,

– Planning and/or execution of after-sales support service activities,

In line with the purpose of carrying out the necessary work to recommend the products and services offered by our Company to data subjects by customising them according to the data subjects’ tastes, usage habits and needs;

– Planning and execution of market research activities for the sale and marketing of products and services,

– Sales and after-sales operations together with purchasing operations,

Planning and/or execution of the processes for creating and/or increasing loyalty to the products and/or services offered by the Company,

Ensuring the conduct of our Company’s human resources policies;

Ensuring the legal and commercial security of our Company and of the persons in a business relationship with our Company;

Carrying out satisfaction-assessment activities for our existing customers, organisation and event management, the conduct of sales and purchasing processes, and the performance of finance and accounting operations,

Carrying out internal audit processes,

Carrying out occupational health and safety activities,

Fulfilling the notification obligation to relevant/authorised public institutions (Courts, the Ministry of Environment and Urbanisation, the Ministry of Finance, the Ministry of Labour and Social Security, the Ministry of the Interior, etc.),

Carrying out information and physical security processes

Meeting your requests and informing you about the status and outcome of your request

For the purpose of ensuring the security of our employees, our guests and the buildings belonging to our Company through camera recording and other security measures, and enabling entries and exits to be controlled

For the purpose of determining the communication and identifying the content of voice and call recordings, in the event that contact is made through our call centres or company telephones

For the purpose of generating statistical data, recording visitor information and providing feedback when our website is visited

Provided that it does not harm the fundamental rights and freedoms of the relevant person, your personal data may be processed for the purposes of protecting the legitimate interests of our Company.

All necessary technical and administrative measures are taken in order to prevent the unlawful processing of your personal data and unlawful access to your data, and to keep your personal data securely.

To Whom and for What Purpose It May Be Transferred

Your personal data processed within the scope of the purposes explained may be transferred, in accordance with the fundamental principles stipulated in the PDPL and within the personal data processing conditions and purposes set out in Articles 8 and 9 of the PDPL,

to authorised public institutions/organisations as required by obligations arising from legal legislation such as the Turkish Commercial Code, the Tax Procedure Law, the Social Security Law, the Occupational Health and Safety Law and environmental regulations; to our business partners for the purpose of carrying out our commercial activities; to our suppliers, limited to the purpose of providing products and services; to other private and public legal entities, notably banks, for the purpose of ensuring that the social and financial rights of the persons employed within the Company are met; and to the relevant institutions from which health services are received and to insurance companies, for the purpose of enabling employees to work in a healthy working environment regarding their health information within the scope of occupational health and safety measures.

Personal data is transferred by our Company to foreign countries declared by the PDP Authority to have adequate protection (“Foreign Country with Adequate Protection”) or, in the absence of adequate protection, to foreign countries where the data controllers in Turkey and in the relevant foreign country have undertaken adequate protection in writing and the permission of the PDP Authority exists (“Foreign Country with a Data Controller Undertaking Adequate Protection”). Our Company acts in accordance with the regulations stipulated in Article 9 of the PDP Law in this regard.

Method and Legal Basis of Collecting Personal Data

Your personal data, although it may vary depending on the service provided by our Company and the commercial activities of our Company, may be collected verbally, in writing or electronically, by automated or non-automated methods, through all contracts/information forms and other documents relating to the transactions arranged with your approval and/or signature, and through our Company’s units and departments, the website, social media channels, mobile applications and similar means. When you visit our Company or our website, or participate in the trainings, seminars, fairs or organisations held by our Company, your personal data may be processed. In addition, it may be collected through various methods, including program-partner institutions and organisations with which we cooperate, official institutions and other third parties.

Rights of the Data Subject

As data subjects, if you submit your requests regarding your rights to our Company through the methods set out below, our Company will conclude the request free of charge within at most 30 (thirty) days, depending on the nature of the request. However, if responding incurs an additional cost, a fee may be charged according to the tariff determined by the Personal Data Protection Board. In this context, data subjects have the right to;

Learn whether their personal data is being processed,

Request information if their personal data has been processed,

Learn the purpose of processing personal data and whether they are used in accordance with their purpose,

Know the third parties to whom personal data is transferred domestically or abroad,

Request the correction of personal data in the event that it is processed incompletely or incorrectly, and request that the transaction carried out in this regard be notified to the third parties to whom the personal data has been transferred, • Although it has been processed in accordance with the PDP Law and other relevant legal provisions, request the deletion or destruction of personal data in the event that the reasons requiring its processing cease to exist, and request that the transaction carried out in this regard be notified to the third parties to whom the personal data has been transferred,

Object to the occurrence of a result against the person himself/herself through the analysis of the processed data exclusively by automated systems,

Request the compensation of the damage in the event that they suffer damage due to the unlawful processing of personal data.

As the relevant person, you must submit your rights requests to our Company in writing. In this framework, in order for the applications you will make to our Company within the scope of Article 11 of the PDP Law to be managed soundly and quickly, we recommend that you use the “Relevant Person Information Request Application Form” available on our website, and that you submit it in person by hand or by registered return mail, also providing the documents/information that may be requested depending on your request and the documents necessary to verify your identity. In addition, as an online user (with the e-mail address previously notified to our Company and registered in our Company’s system), you may submit your requests to us via info@celiktastekstil.com or by calling 0(212)549 88 68.