Privacy Notice (Clarification Text)

PURSUANT TO THE TURKISH PERSONAL DATA PROTECTION LAW NO. 6698 (KVKK)

PRIVACY NOTICE (CLARIFICATION TEXT)

DATA CONTROLLER As Gündoğdu Gıda Süt Ürünleri Ve Dış Ticaret A.Ş. (the “Company”), established in Turkey, acting in the capacity of Data Controller, we hereby inform you that your personal data;

Which we obtain in the manners specified below,
Within the scope of our commercial relationship or within the framework of our employment contract with you,
Within the framework of the purpose requiring their processing and in a manner relevant, limited and proportionate to that purpose,
While preserving the accuracy and the most up-to-date version of your personal data as notified to us by you or as otherwise notified,
Will be recorded, stored, retained, reorganized, shared with the public institutions and organizations legally authorized to request such personal data, and, under the conditions stipulated by the KVKK, transferred and assigned to domestic and foreign third parties, may be classified, and may be processed in the other manners enumerated in the KVKK

We hereby inform you.

HOW AND FOR WHAT REASONS DO WE COLLECT YOUR PERSONAL DATA? As the Company, we collect your personal data — which we request from you and/or from other representatives/employees representing your company in order to fulfil our legal obligations, for the performance of the contract and the commercial relationship between us and your company and/or you, for the reasons stipulated in the laws, and pursuant to the Company's legitimate interest — physically or electronically, through their being communicated to us verbally, physically or electronically by you and/or by the other representatives/employees of your company, and by means of the cameras we have installed in the Company buildings.

PURPOSES OF PROCESSING YOUR PERSONAL DATA Your personal data may be processed by the Company for the purposes and on the legal grounds specified below. For the implementation of the contracts between us and the fulfilment of their terms and conditions; Coordination and conduct of the work and communication relating to the goods and services supplied to the Company by you or by the company you represent, and quality control and evaluation relating to the performance of the service/contract Keeping finance and accounting records and carrying out payment transactions Conduct of Goods / Services Procurement Processes Conduct of Supply Chain Management Processes Conduct of Communication Activities Ensuring communication between suppliers, business partners, external service providers and customers Obtaining support from supplier employees Your personal data may be processed where necessary for the implementation of our Company policies. Your personal data may be processed in order to exercise our right of defence or, where requested within the scope of a duly conducted legal process, to fulfil our legal obligation. Your personal data may be processed for the purpose of fulfilling legal obligations such as ensuring and supervising occupational health and safety at the Company's workplace and building. Your personal data will be retained for the maximum period specified in the relevant legislation or required for the purpose for which they are processed and, in any event, for the duration of the statutory limitation periods.

SHARING OF YOUR PERSONAL DATA WITH THIRD PARTIES Within the scope of the purposes specified above and within the framework of the personal data processing conditions set out in Articles 8 and 9 of the KVKK, your personal data may be transferred;

To the relevant banks for the payment and collection transactions necessary within the scope of the conclusion and performance of the contracts to which the processing of your personal data relates,
To the courts and the public institutions and organizations requesting information, where necessary, within the scope of the fulfilment of our Company's legal obligations,
To law firms and other consultants for the purpose of obtaining legal support within the scope of the establishment, exercise and protection of our Company's rights.
To our group companies located domestically or abroad, within the framework of the personal data processing conditions set out in Articles 8 and 9 of the KVKK,
To archive companies or cloud service companies for the purpose of ensuring data security.

All kinds of technical and administrative measures are taken to ensure data security throughout and after the process of sharing your personal data.

LEGAL GROUNDS FOR COLLECTING PERSONAL DATA Your personal data are processed pursuant to the following provisions of the KVKK No. 6698;

The existence of the person's explicit consent as set out in the first paragraph of Article 5,
The legal ground of “being expressly provided for by laws” regulated in Article 5/2 (a) — on this basis, your personal data are processed where the legislation to which our Company is subject, primarily the Turkish Commercial Code and the Tax Procedure Law, expressly permits,
The legal ground regulated in Article 5/2 (c) “the conclusion or performance of a contract” — on this legal basis, your personal data are processed for the fulfilment and continued performance of the requirements of the contract in connection with which you disclosed your personal data, the opening of a current account, and the carrying out of payment and collection transactions,
The legal ground of “the Data Controller being able to fulfil its legal obligation” regulated in Article 5/2 (ç) — on this basis, the Company processes your personal data for the preparation of legal declarations and notifications, compliance with the retention periods stipulated in the legislation to which the Company is subject and the fulfilment of the other obligations stipulated in the relevant legislation, and the fulfilment of the requests of the courts and the public institutions and organizations requesting information and of other legal obligations,
The legal ground of “the data having been made public by the Data Subject themselves” regulated in Article 5/2 (d),
The legal ground of “the establishment, exercise or protection of a right” regulated in Article 5/2 (e) — on this basis, the Company processes your personal data so that they may serve as evidence in potential disputes and so that legal consultancy and technical support may be obtained.

Your personal data collected on these legal grounds may be processed and transferred solely for the purposes specified in this Privacy Notice (Clarification Text), within the scope of the personal data processing conditions and purposes set out in Articles 5 and 6 of the KVKK.

RIGHTS OF THE PERSONAL DATA SUBJECT As personal data subjects, if you submit your requests regarding your rights to the Company by the methods regulated in the Communiqué on the Procedures and Principles of Application to the Data Controller, our Company will conclude the request free of charge as soon as possible and within thirty days at the latest, depending on its nature. However, if the operation requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board will be charged by the Company. Within this scope, as a personal data subject, you have the right;

To learn whether your personal data are being processed,
To request information in this regard if your personal data have been processed,
To learn the purpose of the processing of your personal data and whether they are used in accordance with their purpose,
To know the third parties to whom your personal data are transferred, whether domestically or abroad,
To request the rectification of your personal data if they have been processed incompletely or incorrectly and to request that the operation carried out in this regard be notified to the third parties to whom your personal data have been transferred,
To request the deletion or destruction of your personal data in the event that the reasons requiring their processing cease to exist, even though they have been processed in accordance with the provisions of the KVKK and other relevant laws, and to request that the operation carried out in this regard be notified to the third parties to whom your personal data have been transferred,
To object to the occurrence of a result to your detriment through the analysis of the processed data exclusively by automated systems,

And, in the event of suffering damage due to the unlawful processing of personal data, to claim compensation for the damage.