HASAN ARSLANPİR TUĞRA MOBİLYA

PERSONAL DATA PROTECTION AND PROCESSING POLICY

PURPOSE OF THE POLICY AND COMMITMENT TO CONFIDENTIALITY

Protecting your fundamental rights and freedoms and privacy in the processing of your personal data, especially the privacy of your private life, and ensuring the security of your personal data in this context is among the most prioritized values and objectives of Hasan Arslanpir Tuğra Furniture (Tuğra Furniture). In this context, within the framework of this Hasan Arslanpir Tuğra Mobilya Personal Data Protection and Processing Policy (Policy), the principles adopted in the execution of personal data processing activities carried out by Tuğra Mobilya and the basic principles adopted in terms of compliance of Tuğra Mobilya data processing activities with the relevant secondary regulations and practices, especially the Personal Data Protection Law No. 6698, are explained and thus Tuğra Mobilya provides the necessary transparency by informing you as personal data owners.

In this context, Tuğra Mobilya undertakes to process and protect your personal data in accordance with the relevant legislation, this Policy and the procedures to be applied depending on the Policy, with full awareness of responsibility.

SCOPE OF THE POLICY

This Policy relates to all personal data of all natural persons whose personal data are processed automatically or non-automatically, provided that they are part of any data recording system.

This Policy covers all data processing activities for personal data processed by Tuğra Furniture and applies to such activities.

This Policy does not apply to data that does not qualify as personal data.

This Policy may be amended from time to time with the approval of [Yönetim Kurulu] if required by the relevant legislation or if Tuğra Furniture deems necessary.

In case of any incompatibility between the relevant legislative regulations and this Policy, the relevant legislative regulations shall prevail.

BASIC PRINCIPLES OF PROCESSING OF PERSONAL DATA

Processing of Personal Data in Compliance with the Law and Good Faith Tuğra Furniture processes Personal Data in accordance with the law and good faith and based on the principle of proportionality. Tuğra Mobilya processes Personal Data within this scope to the extent and limited to the extent required by Tuğra Mobilya’s business activities.

Ensuring that Personal Data is Accurate and Updated When Necessary Tuğra Furniture takes all necessary measures to ensure that Personal Data is complete, accurate and up-to-date during the processing period. In this context, Tuğra Mobilya establishes the necessary mechanisms to ensure the accuracy and timeliness of Personal Data and updates the relevant Personal Data in accordance with the requests of the Relevant Person for changes to their Personal Data within the scope of KVKK Regulations.

Processing of Personal Data for Specific, Explicit and Legitimate Purposes Before the Processing of Personal Data, the purpose for which Personal Data will be processed by Tuğra Furniture is determined. In this context, Tuğra Furniture clearly sets out the purposes of processing Personal Data and processes Personal Data in line with its business activities within the scope of the purposes related to these activities. In this direction, the Relevant Persons are informed in accordance with the KVK Regulations and their Explicit Consents are obtained when necessary.

Personal Data to be Linked, Limited and Measured for the Purpose for which they are Processed Tuğra Furniture collects Personal Data only in the nature and extent required by its business activities and processes it limited to the specified purposes. In this direction, Tuğra Furniture avoids processing Personal Data that is not related to the realization of the specified purposes or is not needed.

Preservation of Personal Data for the Period Stipulated in the Relevant Legislation or Required for the Purpose for which they are Processed Tuğra Mobilya preserves Personal Data for the minimum period required for the purpose for which they are processed and stipulated in the relevant legal legislation. In this context, Tuğra Furniture first determines whether a period is stipulated for the storage of personal data in the relevant legislation and acts in accordance with this period if a period is determined.

Personal Data shall be Destroyed at the end of the specified retention periods in accordance with the periodic Destruction periods or the application of the Data Subject and with the specified Destruction methods (deletion and/or destruction and/or anonymization). In this case, third parties to whom Tuğra Furniture transfers Personal Data should also delete or destroy Personal Data

or anonymize it.

[Komite] is responsible for the operation of the destruction processes. In this context, the necessary procedure is established by [Komite].

TUĞRA FURNITURE PERSONAL DATA PROCESSED BY DATA AND PURPOSES OF PROCESSING

At Tuğra Mobilya, Personal Data are processed in accordance with the Personal Data processing purposes of Nazilli Private Referans Hospital by informing the Relevant Persons in accordance with the KVK Regulations, based on and limited to at least one of the Personal Data processing conditions specified in Articles 5 and 6 of the KVKK, in accordance with the general principles specified in the KVKK, especially the principles specified in Article 4 of the KVKK regarding the Processing of Personal Data.

STORAGE PERIOD AND DESTRUCTION OF PERSONAL DATA

Tuğra Mobilya retains Personal Data for the period required for the purpose for which they are processed and for the minimum period stipulated in the relevant legislation. In this context, Tuğra Mobilya first determines whether a period is stipulated for the storage of Personal Data in the relevant legislation, and if a period is determined, it acts in accordance with this period. If there is no legal period, Personal Data is stored for the period required for the purpose for which it is processed. Personal Data is not stored by Tuğra Furniture under any circumstances, taking into account the possibility of future use.

Tuğra Furniture, Personal Data in accordance with the Personal Data processing inventory

It establishes a Data Storage and Destruction policy and carries out all Destruction (deletion and/or destruction and/or anonymization) activities in accordance with the Personal Data Storage and Destruction policy related to KVK Regulations. Personal Data shall be destroyed at the end of the retention periods determined within the scope of the prepared Personal Data retention and Destruction policy, in accordance with the periodic Destruction periods or the application of the Data Subject and with the determined Destruction methods (deletion and/or destruction and/or anonymization). [Komite] is responsible for the operation of the destruction processes. In this context, the necessary procedure is established by [Komite].

TRANSFER OF PERSONAL DATA

Tuğra Mobilya may transfer the Personal Data of the Relevant Persons to third parties in the country and / or abroad in accordance with the KVK Regulations by taking the necessary security measures in line with the lawful Personal Data processing purposes. In this case, the necessary protective provisions shall be included in the contracts concluded with third parties.

Personal Data may be transferred to third parties by the Company by taking the necessary administrative and technical measures in accordance with the KVK Regulations in the event that one or more of the following conditions exist, even if the Data Subject does not have Explicit Consent:

The relevant activities regarding the transfer of Personal Data are clearly stipulated in the laws,

The transfer of Personal Data by Tuğra Mobilya is directly related and necessary for the establishment or performance of a contract,

The transfer of Personal Data is mandatory for Tuğra Furniture to fulfill its legal obligations,

Transfer of Personal Data by Tuğra Furniture in a limited manner for the purpose of publicization, provided that the Personal Data is publicized by the Relevant Person,

The transfer of Personal Data by Tuğra Mobilya is mandatory for the establishment, use or protection of the rights of Tuğra Mobilya or the Relevant Person or third parties,

Provided that it does not harm the fundamental rights and freedoms of the Relevant Person, it is mandatory to carry out Personal Data transfer activity for the legitimate interests of Tuğra Mobilya,

It is necessary for the protection of the life or physical integrity of the person who is unable to disclose his/her consent due to actual impossibility or whose consent is not legally valid.

In addition to the above, Personal Data may be transferred to foreign countries declared to have adequate protection by the Board (“Foreign Country with Adequate Protection”) in the presence of any of the above conditions. In the absence of adequate protection, in accordance with the data transfer conditions stipulated in the legislation, the data may be transferred to foreign countries where the Data Controllers in Turkey and the relevant foreign country undertake adequate protection in writing and where the Board has permission (“Foreign Country Where the Data Controller Undertakes Adequate Protection”).

TRANSFER OF SPECIAL CATEGORIES OF PERSONAL DATA

Special Qualified Personal Data may be transferred by Tuğra Mobilya in accordance with the principles set out in this Policy and by taking all necessary administrative and technical measures, including the methods to be determined by the Board, and in the presence of the following conditions:

Sensitive Personal Data other than health and sexual life are processed without the Explicit Consent of the Data Subject if it is explicitly stipulated in the laws, in other words, if there is a clear provision regarding the Processing of Personal Data in the relevant law. Otherwise, the Explicit Consent of the Data Subject is required for the processing of Sensitive Personal Data other than health and sexual life.

Sensitive Personal Data relating to health and sexual life are processed by persons under the obligation of confidentiality (e.g. workplace physician working under the payroll of the Company) or authorized institutions and organizations for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, without the explicit consent of the Data Subject. Otherwise, the Explicit Consent of the Data Subject is required for the processing of Sensitive Personal Data other than health and sexual life.

In addition to the above, Special Categories of Personal Data may be transferred to Foreign Countries with Adequate Protection in the presence of any of the above conditions. In the absence of adequate protection, the data may be transferred to Foreign Countries where the Data Controller Committed to Adequate Protection is located in line with the data transfer conditions stipulated in the legislation.

TUĞRA FURNITURE‘S LIGHTING OBLIGATION

Tuğra Mobilya informs the Relevant Persons before the processing of Personal Data in accordance with Article 10 of the KVKK and the provisions of the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform. In this context, Tuğra Mobilya informs the Data Subjects about the purposes for which their Personal Data are processed by the Data Controller, for which purposes, with whom they are shared, with which methods they are collected and the legal reason and the rights of the Data Subjects within the scope of the processing of their Personal Data in accordance with the KVK Regulations.

Necessary KVK Procedures are created by [Komite] in order to report all new Personal Data processing processes to [Komite].

In the event that the Data Processor is a third party other than Tuğra Furniture, it is undertaken by the third party before the Personal Data Processing is started with a written contract that the third party will act in accordance with the above-mentioned obligations. Each employee, Tuğra Mobilya is obliged to go through the process in this Policy and KVK Procedures in case of Personal Data transfer by a third party.

RIGHTS OF THE PERSONS CONCERNED

Relevant Persons have the following rights:

Learn whether their Personal Data is being processed or not,

Request information if their Personal Data has been processed,

To learn the purpose of processing their Personal Data and whether they are used in accordance with their purpose,

To know the third parties in Turkey or abroad to whom their Personal Data is transferred,

To request correction of Personal Data in case of incomplete or incorrect processing and to request notification of the transaction made within this scope to third parties to whom Personal Data is transferred,

Although it has been processed in accordance with the provisions of the Law and other relevant laws, in the event that the reasons requiring its processing disappear, to request the deletion or destruction of Personal Data and to request notification of the transaction made within this scope to third parties to whom Personal Data is transferred,

To object to the occurrence of a result to the detriment of the person himself/herself by analyzing the processed data exclusively through automated systems,

In the event that Personal Data is damaged due to unlawful processing of Personal Data, to demand the compensation of the damage.

Relevant Persons will be able to submit their requests regarding their rights listed in this section of this Policy to Tuğra Furniture by the methods determined by the Board. They will be able to benefit from Tuğra Furniture Relevant Person Application Form. However, in any case, current application methods and application content should be checked in the relevant legislation prior to application and applications should be made in accordance with the relevant procedures and principles.

In the event that the Relevant Persons submit their requests regarding the rights listed above to Tuğra Mobilya in writing, Tuğra Mobilya finalizes the request free of charge within 30 (thirty) days at the latest according to the nature of the request in accordance with the KVK Regulations. If there is an additional cost for the finalization of the requests by the Data Controller, the fees in the tariff determined by the Board may be requested by the Data Controller.

PERSONAL DATA MANAGEMENT AND SECURITY

Tuğra Mobilya creates [Komite] in order to fulfill its obligations under the KVK Regulations, to ensure and supervise the preparation and implementation of the KVK Procedures required for the implementation of this Policy, and to make suggestions for their functioning.

Tuğra Mobilya takes all necessary administrative and technical measures to ensure the security of Personal Data in accordance with KVK Regulations. In this context, the activities of Processing Personal Data by Tuğra Mobilya are supervised by technical systems according to technological possibilities and application cost. Personnel who are knowledgeable in technical issues for the Processing of Personal Data activities are employed.

Tuğra Furniture employees are informed and trained for the protection and processing of Personal Data in accordance with the law.

Necessary KVK Procedures are created in order to ensure that employees who need access to Personal Data at Tuğra Mobilya have access to such Personal Data, and [Komite] is responsible for its creation and implementation.

Tuğra Mobilya employees can access Personal Data only within the authority defined to them and in accordance with the relevant KVK Procedures.

If Tuğra Furniture employees suspect that the security of Personal Data is not sufficiently ensured or if they detect such a security gap, they immediately report the situation to [Komite].

Detailed KVK Procedures for the security of Personal Data are created by [Komite].

Each person who is allocated a Tuğra Furniture product is responsible for the safety of the products allocated for their own use.

Each Tuğra Furniture employee is responsible for the security of the physical files in their area of responsibility.

In the event that there are security measures requested or to be requested additionally for the security of Personal Data within the scope of KVK Regulations, all employees are obliged to comply with additional security measures and to ensure the continuity of these security measures.

All of the Personal Data processed within Tuğra Furniture is considered as “Confidential Information” by Tuğra Furniture.

Tuğra Mobilya employees have been informed that their obligations regarding the security and confidentiality of Personal Data will continue after the termination of the business relationship and a commitment has been received from Tuğra Mobilya employees to comply with these rules.