Privacy Policy

PRIVACY POLICY

The protection of personal data is of the utmost importance to Efg Elektrik Enerji A.Ş. We carefully safeguard the information of everyone who has shared any personal data with us through any means of contact. We have implemented all necessary administrative and technical measures within our company to ensure the security of this information. That is why you can conduct your transactions with the confidence that your personal data is safe under the Efg Elektrik Enerji A.Ş. brand. We will respect your rights regarding your data, which are guaranteed by both the Constitution of the Republic of Turkey and relevant laws. With this awareness and confidence, we would like to share with you our corporate Privacy Policy, which we have prepared in accordance with the universal principles of “transparency” and “accountability” regarding personal data security.

You can be assured that we will respond with the utmost sensitivity to any suggestions for improvement, inquiries, or potential complaints you may have. Please feel free to contact us with any concerns regarding your personal data. Just as we do with all our services, we will demonstrate the same sensitivity and care in protecting your personal data.

Best regards,

Efg Elektrik Enerji A.Ş.

Purpose

Given the sensitive nature of the work we have undertaken to date at Efg Elektrik Enerji A.Ş., the personal data collected has been kept confidential and has never been shared with third parties for purposes other than those intended. The protection of personal data is a fundamental policy of our company. Even before any legal regulations were enacted, our company placed great importance on the confidentiality of personal data and adopted this as a guiding principle. As Efg Elektrik Enerji A.Ş., we are committed to complying with all responsibilities imposed by the Personal Data Protection Law.

1. SCOPE AND AMENDMENTS

This Policy, prepared by our company, has been drafted in accordance with the Personal Data Protection Law No. 6698 (“KVK”). The Law has entered into force in its entirety as of today.

Data obtained from you with your consent or pursuant to other legally valid grounds specified in the Law will be used to enhance the quality of the services we provide and to improve our quality policy. Furthermore, certain data in our possession is de-identified and anonymized. This data is used for statistical purposes and is not subject to the Law or this Policy.

The Efg Elektrik Enerji A.Ş. Privacy Policy aims to protect the data automatically collected from our customers, prospective customers, employees, and the customers and employees of companies with which we have business partnerships, as well as other individuals, and includes regulations pertaining to such data.

Our company reserves the right to amend our Policy and our Guidelines on Personal Data to ensure compliance with the Law and to provide better protection of personal data.

2. BASIC RULES REGARDING THE PROCESSING OF PERSONAL DATA

Compliance with the law and principles of good faith: Efg Elektrik Enerji A.Ş. verifies the source of the data it collects or receives from other companies and places importance on ensuring that such data is obtained in compliance with the law and within the framework of the principles of good faith.

Accuracy and, where necessary, timeliness: Efg Elektrik Enerji A.Ş. places importance on ensuring that all data within the organization is accurate, free from errors, and, in the event of changes to personal data, updated upon notification.

Processing for specific, explicit, and legitimate purposes: Efg Elektrik Enerji A.Ş. processes data only to the extent necessary for the purposes for which it obtained consent from individuals during the provision of its services. It does not process, use, or allow the use of data for purposes other than those for which consent was obtained.

Processing that is relevant, limited, and proportionate to the purpose: Efg Elektrik Enerji A.Ş. uses data only to the extent necessary for the purpose for which it is processed and as required by the service.

Retention for the period prescribed by applicable legislation or necessary for the purpose of processing: Efg Elektrik Enerji A.Ş. retains contract-based data for the duration of the statute of limitations under the Law, as well as for as long as required by commercial and tax law. However, once these purposes no longer apply, the company deletes or anonymizes the data. It deletes or destroys such data in accordance with the Personal Data Deletion Guidelines.

It is important to note that regardless of whether Efg Elektrik Enerji A.Ş. has collected or processed data based on consent or in accordance with the law, the principles listed above still apply.

3. THE DATA SUBJECT’S RIGHTS UNDER ARTICLE 11 OF THE KVK

Pursuant to Article 11 of the KVK, you have the rights listed below. To facilitate the exercise of these rights, Efg Elektrik Enerji A.Ş. has also prepared a separate application form for you, which is available on our website.

Individuals whose personal data is processed may contact us via the contact information published on our website by Efg Elektrik Enerji A.Ş. to inquire about their data;

Find out whether their personal data is being processed,

Request information regarding the processing of their personal data,

To learn the purpose of the processing of their personal data and whether it is being used in accordance with that purpose,

To know the third parties to whom personal data has been transferred, whether within or outside the country,

To request the correction of personal data if it has been processed incompletely or incorrectly, and to request that the third parties to whom the personal data has been transferred be notified of such correction,

Within the framework of the conditions set forth in Article 7 of the KVK Law, To request the erasure or destruction of personal data if the grounds justifying its processing no longer exist, even though it was processed in accordance with the provisions of the Data Protection Law and other relevant laws, and to request that third parties to whom the personal data was transferred be notified of this action,

To object to a decision made solely through the automated processing of personal data that adversely affects the individual,

The right to request compensation for damages suffered as a result of the unlawful processing of personal data. At Efg Elektrik Enerji A.Ş., we respect these rights.

4. PRINCIPLE OF MAXIMUM ECONOMY/PRINCIPLE OF THRIFT

In accordance with this principle, known as the principle of data minimization or the principle of frugality, data received by Efg Elektrik Enerji A.Ş. is processed into the system only to the extent necessary. Therefore, the data we collect is determined based on the purpose. Unnecessary data is not collected. Other data received by our company is also transferred to the company’s IT systems in the same manner. Excess information is not recorded in the system; instead, it is deleted or anonymized. This data may be used for statistical purposes.

DELETION OF PERSONAL DATA

Once the legally required retention periods have expired, judicial proceedings have been completed, or other requirements no longer apply, our company deletes, destroys, or anonymizes this data either automatically or upon the request of the data subject.

ACCURACY AND DATA UP-TO-DATENESS

Data held by Efg Elektrik Enerji A.Ş. is generally processed as declared by the relevant individuals. Efg Elektrik Enerji A.Ş. is not obligated to verify the accuracy of data provided by customers or individuals who contact Efg Elektrik Enerji A.Ş., nor is this done due to legal requirements and our operating principles. The data provided is deemed accurate. Efg Elektrik Enerji A.Ş. also adheres to the principle of accuracy and timeliness of personal data. The company updates personal data based on official documents it receives or upon the request of the data subject. It takes the necessary measures to ensure this.

PRIVACY AND DATA SECURITY

Personal data is confidential, and Efg Elektrik Enerji A.Ş. upholds this confidentiality. Within the company, only authorized individuals may access personal data. Efg Elektrik Enerji A.Ş. takes all necessary technical and administrative measures to protect the personal data it collects, prevent it from falling into the hands of unauthorized persons, and ensure that the data subject is not harmed. In this context, we ensure that software complies with standards, that third parties are carefully selected, and that the Privacy Policy is adhered to within the company. We also require companies with which we share personal data in accordance with the law to protect that data.

PURPOSES OF DATA PROCESSING

Efg Elektrik Enerji A.Ş. will process data in accordance with the purposes specified in its KVKK Policy.

DATA OF CUSTOMERS, POTENTIAL CUSTOMERS, AND BUSINESS AND SOLUTION PARTNERS
Collection and Processing of Data for Contractual Relationships

If a contractual relationship has been established with our customers or potential customers, the personal data collected may be used without the customer’s consent. However, such use is limited to the purposes of the contract. Data is used to the extent necessary for the better performance of the contract and the requirements of the service, and is updated as needed by contacting customers.

Business and Solution Partner Data

Efg Elektrik Enerji A.Ş. adheres to the principle of acting in compliance with the law when sharing data with both business and solution partners. Data is shared with business and solution partners only to the extent required by the service and subject to a data confidentiality agreement; these parties are required to take necessary measures to ensure data security.

DATA PROCESSING FOR ADVERTISING PURPOSES

In accordance with the Law on the Regulation of E-Commerce and the Regulation on Commercial Communications and Commercial Electronic Messages, electronic messages for advertising purposes may only be sent to individuals who have provided prior consent. The explicit consent of the recipient to whom the advertisement will be sent is required.

Efg Elektrik Enerji A.Ş. also complies with the details of “consent” as defined by the same legislation. The consent obtained must cover all commercial electronic messages sent to recipients’ electronic communication addresses for the purpose of promoting your company’s goods and services, marketing them, publicizing your business, or increasing brand awareness through content such as greetings and well-wishes. This consent may be obtained in writing on physical media or via any means of electronic communication. What is important is that the recipient’s affirmative declaration of consent to receive commercial electronic messages, along with their first and last name and electronic communication address, be included.

DATA PROCESSING CONDUCTED DUE TO THE COMPANY’S LEGAL OBLIGATION OR AS EXPRESSLY PROVIDED BY LAW

Personal data may be processed without obtaining separate consent if the processing is explicitly specified in the relevant legislation or is necessary to fulfill a legal obligation established by law. The type and scope of data processing must be necessary for the legally permitted data processing activity and must comply with the relevant legal provisions.

THE COMPANY’S DATA PROCESSING

Personal data may be processed in accordance with the services provided by the company and its legitimate purposes. However, the data may not be used under any circumstances for services that violate the law.

PROCESSING OF SENSITIVE PERSONAL DATA

Efg Elektrik Enerji A.Ş. takes all adequate measures, as separately determined by the Board, when processing special category personal data. Special category personal data is processed at our company in accordance with the “Policy on the Protection and Processing of Special Category Personal Data.”

DATA PROCESSED BY AUTOMATED SYSTEMS

Efg Elektrik Enerji A.Ş. acts in compliance with the Law regarding data processed through automated systems. Information obtained from such data may not be used against an individual without their explicit consent. However, Efg Elektrik Enerji A.Ş. may make decisions regarding individuals based on data processed within its own systems.

USER INFORMATION AND THE INTERNET

When personal data is collected, processed, or used on Efg Elektrik Enerji A.Ş.’s websites, other systems, or applications, the relevant individuals are informed via a privacy notice and, if necessary, about cookies.

Individuals are informed about our applications on our websites. Personal data will be processed in accordance with the law.

DATA RELATING TO OUR EMPLOYEES

Processing of Data for Employment Relationships

Our employees’ personal data may be processed without consent to the extent necessary for employment relationships and health insurance. However, Efg Elektrik Enerji A.Ş. ensures the confidentiality and protection of its employees’ data.

Processing Required by Legal Obligations

Efg Elektrik Enerji A.Ş. may process employees’ personal data without obtaining additional consent if such processing is explicitly provided for in applicable legislation or is necessary to fulfill a legal obligation established by law. This provision is limited to obligations arising from the law.

Processing for the Benefit of Employees

Efg Elektrik Enerji A.Ş. may process personal data without obtaining consent for purposes that benefit company employees, such as private health insurance. Efg Elektrik Enerji A.Ş. may also process employee data in connection with disputes arising from employment relationships.

Processing of Special Category Data

According to the Law, data regarding a person’s race, ethnic origin, political opinions, philosophical beliefs, religion, denomination, or other beliefs; attire; membership in associations, foundations, or unions; health; sexual life, criminal convictions, and security measures, as well as biometric and genetic data, constitute special category personal data.

In processing special category personal data, Efg Elektrik Enerji A.Ş. takes sufficient measures as additionally determined by the Board, in addition to obtaining the data subject’s consent. Sensitive personal data may be processed without the individual’s consent only in cases permitted by law and strictly limited to those circumstances.

e. Data Processed by Automated Systems

Data processed via automated systems regarding employees may be used in internal promotions and performance evaluations. Our employees have the right to object to any outcome that is detrimental to them and must do so in accordance with internal company procedures. Employees’ objections are also evaluated internally.

Telecommunications and the Internet

Computers, phones, email, and other applications assigned to employees within the company are provided solely for business purposes. Employees may not use any of these company-provided tools for personal purposes or communication. The company may monitor and inspect all data on these devices. From the moment they begin employment, employees agree not to store any data or information unrelated to work on the computers, phones, or other devices provided to them.

TRANSFER OF PERSONAL DATA WITHIN AND OUTSIDE THE COUNTRY

Personal data may be shared by Efg Elektrik Enerji A.Ş. with the majority shareholder, as well as with business and solution partners, for the purpose of providing services.

Efg Elektrik Enerji A.Ş. may transfer personal data to its suppliers on a limited basis solely to ensure that the services necessary for the Company to carry out its commercial activities—which the Company obtains from such suppliers through outsourcing—are provided to the Company.

Efg Elektrik Enerji A.Ş. has the authority to transfer personal data within the country and abroad in accordance with the conditions set forth by the Board and other provisions of the Law, subject to the individual’s consent.

RIGHTS OF THE DATA SUBJECT

Efg Elektrik Enerji A.Ş. acknowledges that, under the Law, the data subject has the right to give consent prior to the processing of their data and, after processing, the right to determine the fate of their data.

By contacting the relevant department announced on our website by Efg Elektrik Enerji A.Ş., you may, regarding your personal data:

a) To find out whether your personal data has been processed,
b) Request information regarding the processing of your personal data,
c) To learn the purpose of the processing of your personal data and whether it is being used in accordance with that purpose,

ç) To know the third parties to whom your personal data has been transferred, whether within or outside the country,

d) To request the correction of your personal data if it has been processed incompletely or incorrectly,
e) To request the erasure or destruction of personal data in accordance with the conditions set forth in Article 7,
f) To request that the third parties to whom personal data has been transferred be notified of the actions taken pursuant to subparagraphs (d) and (e),
g) To object to a decision made solely through the automated processing of personal data that adversely affects the individual,

ğ) The right to request compensation for damages incurred as a result of the unlawful processing of personal data.

However, individuals have no rights regarding anonymized data within the Company. Efg Elektrik Enerji A.Ş. may share personal data with relevant institutions and organizations as required by business and contractual relationships, or for the purpose of fulfilling a judicial duty or the exercise of statutory authority by a government authority.

Data subjects may submit requests regarding the rights specified above by completing the application form—available on the Company’s official website—in full, signing it with a wet signature, and sending it to the Company via certified mail with return receipt, along with copies of their identification documents (for a national ID card, only a photocopy of the front side) via certified mail with return receipt requested. Your requests will be responded to as soon as possible depending on the content of your request, or within a maximum of 30 days after they are received by our company. You must submit your applications via certified mail with return receipt requested. Furthermore, only the portions of your requests pertaining to you will be addressed; requests made regarding your spouse, relatives, or friends will not be accepted.

Efg Elektrik Enerji A.Ş. may request additional relevant information and documents from requesters.

PRIVACY POLICY

The data of both employees and other individuals at Efg Elektrik Enerji A.Ş. is confidential. No one may use, copy, reproduce, transfer to others, or use this data for any purpose other than business purposes without a contract or legal authorization.

DATA SECURITY

Efg Elektrik Enerji A.Ş. takes all necessary technical and administrative measures to protect the personal data it collects, prevent unauthorized access, and ensure that our customers and prospective customers are not harmed. In this context, we ensure that software complies with standards, that third parties are carefully selected, and that the Privacy Policy is adhered to within the company. Security measures are continuously updated and improved.

AUDIT

Efg Elektrik Enerji A.Ş. conducts the necessary internal and external audits regarding the protection of personal data.

REPORTING OF BREACHES

When Efg Elektrik Enerji A.Ş. is notified of any breach involving personal data, it acts with the understanding that it must report the matter to the Personal Data Protection Board without delay and no later than 72 hours from the date the breach is discovered. It minimizes the harm to the data subject and compensates for any damage. If personal data is accessed by unauthorized third parties, the company immediately reports the situation to the Personal Data Protection Board.

You may file a report regarding data breaches in accordance with the procedures outlined on our corporate website.

KVKK

PERSONAL DATA PROTECTION AND PROCESSING POLICY

1.PURPOSE

As EFG ELEKTRİK ENERJİ A.Ş., our priority is to ensure that the personal data of natural persons associated with our Company, including our customers, subscribers and employees, are processed in compliance with the Constitution of the Republic of Türkiye, international conventions on human rights to which our country is a party, particularly the Personal Data Protection Law No. 6698 (“KVKK”), and other applicable legislation, and to ensure that the rights of the relevant persons whose data are processed can be effectively exercised. Therefore, including but not limited to our employees, subscribers, visitors, business partners, customers, dealers, users visiting our website and using our mobile applications, in short, all personal data obtained during our activities, we carry out all operations relating to the processing, storage and transfer of such data in accordance with the EFG ELEKTRİK ENERJİ A.Ş. Personal Data Protection and Processing Policy (“Policy”). The protection of personal data and safeguarding the fundamental rights and freedoms of natural persons whose personal data are collected constitute the fundamental principles of our policy regarding the processing of personal data. Therefore, we conduct all our activities involving the processing of personal data by observing the rights to privacy, confidentiality of communications, freedom of thought and belief, and effective legal remedies. In order to protect personal data, we take all administrative and technical protection measures required by the nature of the relevant data in accordance with applicable legislation and current technology. This Policy explains the methods we follow for the processing, storage, transfer, deletion or anonymization of personal data shared during our commercial, social responsibility and similar activities within the framework of the principles specified in the KVKK.

2.SCOPE

Including but not limited to the personal data of our employees, subscribers, visitors, business contacts, business partners, customers, potential customers, suppliers, dealers and users visiting our website, in short, all personal data obtained during our activities and processed by us fall within the scope of this Policy. Personal data protection applies only to natural persons, and information belonging to legal entities that does not contain information relating to a natural person is excluded from personal data protection. Therefore, this Policy does not apply to data belonging to legal entities. Our Policy applies to all personal data processing activities owned or managed by EFG ELEKTRİK ENERJİ A.Ş. and has been prepared by taking into account the KVKK, other relevant legislation relating to personal data and international standards in this field.

3.DEFINITIONS AND ABBREVIATIONS

This section briefly explains specific terms and expressions, concepts, abbreviations, etc. used in the Policy.

Company Name: EFG ELEKTRİK ENERJİ A.Ş.

Explicit Consent: Consent relating to a specific subject, based on being informed and free will, given in a clear manner that leaves no room for doubt and limited solely to the relevant processing activity.

Anonymization: Rendering personal data incapable of being associated with an identified or identifiable natural person under any circumstances, even by matching them with other data.

Employee: Refers to personnel of EFG ELEKTRİK ENERJİ A.Ş.

Personal Data Owner (Data Subject): The natural person whose personal data are processed.

Personal Data: Any information relating to an identified or identifiable natural person.

Special Categories of Personal Data: Data relating to individuals’ race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, association, foundation or trade union membership, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Processing of Personal Data: Any operation performed on personal data, such as obtaining, recording, storing, retaining, altering, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, whether wholly or partially by automated means or by non-automated means provided that they form part of a data recording system.

Data Processor: A natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.

Data Controller: A natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.

KVK Board: Personal Data Protection Board.

KVK Authority: Personal Data Protection Authority.

KVKK: Personal Data Protection Law published in the Official Gazette dated 7 April 2016 and numbered 29677.

KEP: Registered Electronic Mail address. It is a system that preserves all kinds of commercial and legal correspondence and document sharing in the form in which they were sent, definitively identifies the recipient, ensures that the content cannot be altered, and makes the content legally valid, secure and conclusive evidence.

Policy: EFG ELEKTRİK ENERJİ A.Ş. Personal Data Protection and Processing Policy.

4.DUTIES AND RESPONSIBILITIES

Company Management is responsible for the overall supervision of determining and operating notification, investigation and sanction mechanisms in cases of non-compliance with the Policy, rules and regulations. The KVKK working group is responsible for the preparation, development, implementation and updating of the Policy. This Policy is evaluated when necessary in terms of its currency and development requirements. The publication of the prepared document on the corporate portal is the responsibility of management.

5.LEGAL OBLIGATIONS

Our legal obligations as a data controller within the scope of the protection and processing of personal data pursuant to the KVKK are listed below:

A. Our obligation to inform

When collecting personal data as a data controller;

The purposes for which your personal data will be processed,

Information regarding our identity and, if applicable, the identity of our representative,

To whom and for what purposes your processed personal data may be transferred,

Our method of collecting data and its legal basis,

Rights arising from the law; we have an obligation to inform the Data Subject regarding these matters. As EFG ELEKTRİK ENERJİ A.Ş., we take care to ensure that this Policy, which is publicly available, is clear, understandable and easily accessible.

Our obligation to ensure data security

As a data controller, we take the administrative and technical measures prescribed by legislation to ensure the security of personal data under our responsibility. Obligations and measures relating to data security are detailed in Section 9 of this Policy.

6.CLASSIFICATION OF PERSONAL DATA

Personal data means any information relating to an identified or identifiable natural person. Personal data protection applies only to natural persons, and information belonging to legal entities that does not contain information relating to a natural person is excluded from personal data protection. Therefore, this Policy does not apply to data belonging to legal entities.

Data relating to individuals’ race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, association, foundation or trade union memberships, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, are special categories of personal data.

7.PROCESSING OF PERSONAL DATA

We process personal data in accordance with certain principles. We process personal data in accordance with the rules of good faith, transparently and within the framework of our obligation to inform. We take the necessary measures in our data processing procedures to ensure that processed data are accurate and up to date. We also provide the Personal Data Owner with the opportunity to contact us in order to update their data and correct any errors in processed data, if any. We process personal data within the scope of our legitimate purposes, the scope and content of which are clearly defined and which have been determined in order to carry out our activities within the framework of legislation and the ordinary course of commercial life. We process personal data in a manner that is relevant, limited and proportionate to the clearly and precisely defined purposes. We avoid processing personal data that are irrelevant or not required to be processed. Various regulations in the legislation require personal data to be stored for specific periods. Therefore, we retain the personal data we process for the periods prescribed by applicable legislation or required for the purposes of processing personal data and until the end of the relevant service period. Where the retention period prescribed by legislation expires or the purpose of processing ceases to exist, we delete, destroy or anonymize personal data. Our principles and procedures relating to retention periods are detailed in Section 9 of this Policy.

Your Personal Data;

Your personal data by which we may identify you, such as your name, surname, telephone number, e-mail address, customer number, contract number and user ID assigned to you in relation to your subscription,

Your voice call recordings kept by sales and customer representatives in accordance with call center standards and your personal data obtained when you contact us via e-mail,

Your credit card and debit card information, branch code, account number and other banking information,

Your data obtained through sales, such as request and transaction information through sales channels,

Your personal data containing usage details such as your usage volume of value-added services, content and personal information provided by you, and other records,

If you apply for a job, other personal data obtained in this context, including your CV, and if you are an employee of EFG ELEKTRİK ENERJİ A.Ş. or an associated employee, all personal data relating to your employment agreement and suitability for employment,

Informing you about our new products and services and providing you with the products and services most suitable for you,

Making offers to you based on the way you use our products and services and informing you about new services,

Conducting analyses for the purpose of improving our products and services,

Training and developing our employees,

Issuing invoices in return for your use of our products and services,

Verifying your identity,

Responding to any questions and complaints you may have regarding our products or services,

Analyzing your use of our products and services for the purpose of developing and improving the products and services we provide to you,

Providing the necessary information in line with requests and inspections by regulatory and supervisory institutions and official authorities,

Ensuring the consistency of your information,

Measuring customer satisfaction,

Including but not limited to the provision of services relating to our products and services, including the execution of customer services and sales operations, management of services, traffic management, analysis of products and services, marketing activities and communications such as determining and measuring campaigns, tariffs, products and strategies, customer services and satisfaction, financial reporting and analysis, legal proceedings, service optimization and similar purposes.

Special categories of personal data are processed by us by taking the administrative and technical measures prescribed by law and by the KVK Board and where explicit consent exists, or in cases where processing is required by legislation. Since special categories of personal data relating to health and sexual life may be processed for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing by persons subject to confidentiality obligations or authorized institutions and organizations, such data are not processed by us except for data relating to our employees. Such data belonging to our employees may be processed by persons prescribed by law.

In exceptional cases arising from the law where explicit consent is not required for the processing of personal data, we may process personal data without obtaining explicit consent.

TRANSFER OF PERSONAL DATA

As EFG ELEKTRİK ENERJİ A.Ş., we act in compliance with the provisions of the KVKK and the decisions and regulations adopted by the KVK Board regarding the transfer of personal data. Except for exceptional circumstances specified in the legislation, personal data and special categories of personal data are not transferred by us to other natural or legal persons without the explicit consent of the Data Subject. In exceptional circumstances stipulated by the KVKK and other legislation, data may also be transferred without the explicit consent of the Data Subject to authorized administrative or judicial institutions or organizations in the manner and within the limits prescribed by the legislation. In addition, in exceptional circumstances prescribed by the legislation, data may be transferred without requiring explicit consent. As a rule, personal data are not transferred abroad without the explicit consent of the Data Subject.

Personal data may be transferred, including but not limited to, our suppliers, business partners and business contacts, subsidiaries and group companies, legally authorized public institutions and organizations, legally authorized private-law entities and our shareholders, in accordance with the principles and rules explained above.

In order to protect personal data, including but not limited to, we establish an internal technical organization for the processing and storage of personal data in accordance with legislation, establish the technical infrastructure necessary to ensure the security of databases in which your personal data will be stored, monitor and audit the processes of the technical infrastructure created, determine procedures for reporting the technical measures we take and the audit processes, periodically update and renew technical measures, reassess risky situations and develop necessary technological solutions, use software or hardware security products such as antivirus systems and firewalls, and establish security systems in line with technological developments.

In order to protect your personal data, including but not limited to, we establish personal data access policies and procedures covering employees of companies and subsidiaries within our group, inform and train our employees regarding the lawful protection and processing of personal data, record the measures to be taken in cases where personal data are processed unlawfully by our Company Employees in agreements concluded with our employees and/or in the Policies we establish, and audit the personal data processing activities of the data processors with whom we work or the partners of such data processors.

9.RETENTION OF PERSONAL DATA

Personal data are retained for the period prescribed by applicable legislation or required for the purpose for which they are processed. Without prejudice to the retention periods prescribed by legislation, we retain personal data for as long as required by the purpose of processing and for the duration of the continuity of products and services. Where we process personal data for more than one purpose, the data are deleted, destroyed or retained in anonymized form where the purposes of processing cease to exist or where, upon the request of the Data Subject, there is no legal obstacle to deleting the data. The provisions of legislation and decisions of the KVK Board are complied with regarding destruction, deletion or anonymization.

The measures we take regarding the retention of personal data include establishing technical infrastructures and related audit mechanisms for the deletion, destruction and anonymization of personal data, taking the necessary measures for the secure retention of personal data, employing personnel with technical expertise, establishing business continuity and emergency plans against potential risks and developing systems for their implementation, establishing security systems in accordance with technological developments relating to personal data storage environments, informing our employees about technical and administrative risks relating to the retention of personal data and raising awareness, and, where cooperation with third parties is required for the retention of personal data, including provisions in agreements concluded with companies to which personal data are transferred requiring the persons to whom personal data are transferred to take the necessary security measures for the protection and secure retention of transferred personal data.

10.SECURITY OF PERSONAL DATA

Our obligations regarding the security of personal data are to prevent the unlawful processing of personal data, prevent unlawful access to data and ensure that personal data are retained in accordance with the law. In this context, administrative and technical measures are taken according to technological possibilities and implementation costs.

The measures we take to prevent the unlawful processing of personal data are as follows:

– Conducting and having the necessary audits conducted within the Company,

-Training and informing our employees about the lawful processing of personal data,

-Evaluating the activities carried out by our Company in detail for all business units and, as a result of such evaluation, processing personal data specifically within the commercial activities carried out by the relevant units,

-Where cooperation with third parties is undertaken for the purpose of processing personal data, including provisions in agreements concluded with companies processing personal data requiring persons processing personal data to take the necessary security measures,

-In the event of unlawful disclosure of personal data or a data breach, notifying the KVK Board of the situation and carrying out the examinations prescribed by legislation and taking the necessary measures.

The technical and administrative measures we take to prevent unlawful access to personal data are as follows:

-Periodically updating and renewing technical measures,

-Establishing access authorization procedures within our Company,

-Determining procedures for reporting the technical measures we take and audit processes,

– Establishing the data recording systems used within our Company in accordance with legislation and carrying out periodic audits thereof,

-Establishing emergency plans against potential risks and developing systems for their implementation,

-Training and informing our employees regarding access to and authorization for personal data,

-Where cooperation with third parties is undertaken for activities such as the processing and storage of personal data, including provisions in agreements concluded with companies providing access to personal data requiring persons with access to personal data to take the necessary security measures,

-Establishing security systems within the scope of technological developments in order to prevent unlawful access to personal data.

We take administrative and technical measures to prevent the unlawful disclosure of personal data and update these measures in accordance with our relevant procedures. If we determine that personal data have been disclosed without authorization, we establish systems and infrastructures to notify the Data Subject and the KVK Board of such situation. If an unlawful disclosure occurs despite all administrative and technical measures taken, where deemed necessary by the KVK Board, such situation may be announced on the KVK Board’s website or by another method.

11.RIGHTS OF THE PERSONAL DATA OWNER

Within the scope of our obligation to inform, we inform the Personal Data Owner and establish systems and infrastructures relating to such information. We make the necessary technical and administrative arrangements to enable the Personal Data Owner to exercise their rights regarding personal data.

The Personal Data Owner has the following rights regarding their personal data:

-To learn whether personal data are being processed,

-To request information if personal data have been processed,

-To learn the purpose of processing personal data and whether they are being used in accordance with their intended purpose,

-To know the third parties to whom personal data are transferred domestically or abroad,

-To request the correction of personal data if they have been processed incompletely or incorrectly,

-To request the deletion or destruction of personal data if the reasons requiring their processing cease to exist,

-To request that the correction, deletion or destruction operations mentioned above be notified to third parties to whom personal data have been transferred,

-To object to the occurrence of a result against the individual arising from the analysis of processed data exclusively through automated systems,

-To request compensation for damages in the event of suffering damage due to the unlawful processing of personal data.

The Personal Data Owner may submit your requests within the scope of the KVKK and any questions regarding your personal data by writing a petition and sending it to Mevlana Mah. 832. Sk. No:1 Gaziosmanpaşa/İstanbul address (through a Notary Public, etc.) or by sending the relevant form signed with a secure electronic signature to our registered electronic mail address [email protected]. You may also submit your request through the KVKK Information Inquiry section at www.efgelektrik.com.

In the application to be made by the Personal Data Owner in order to exercise the above-mentioned rights and containing explanations regarding the right requested to be exercised, the requested matter must be clear and understandable, the requested matter must relate to the applicant personally or, if acting on behalf of another person, the applicant must be specifically authorized in this regard and such authorization must be documented; furthermore, the application must contain identity and address information and documents verifying the applicant’s identity must be attached to the application. Such requests must be made individually, and requests made by unauthorized third parties regarding personal data will not be taken into consideration.

Requests relating to personal data shall be concluded free of charge as soon as possible depending on their nature and, in any event, within no more than 30 (thirty) days, or, where the conditions specified in the tariff to be published by the KVK Board regarding fees arise, in return for the fee specified in such tariff. Additional information and documents may be requested during the application process or while the application is being evaluated.

Applications relating to personal data shall be rejected with justification in the following written circumstances:

-Processing personal data for purposes such as research, planning and statistics by anonymizing them through official statistics,

-Processing personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that such processing does not violate privacy or personality rights or constitute a criminal offence,

-Processing personal data made public by the Personal Data Owner

-The application not being based on a justified reason

-The application containing a request contrary to applicable legislation

-Failure to comply with the application procedure shall result in rejection with justification.

In order for the response period specified in Article 11 of this Policy to commence, requests must be submitted in writing and with a wet signature or electronically signed and sent via KEP, or through other methods determined by the KVK Board, together with information and documents verifying the applicant’s identity. If the request is accepted, the relevant action shall be taken and notification shall be made in writing or electronically. If the request is rejected, the reason shall be explained and notified to the applicant in writing or electronically. In the event that the application is rejected, the response provided by us is considered insufficient, or no response is provided within the prescribed period, the applicant has the right to lodge a complaint with the KVK Board within 30 (thirty) days from the date on which the applicant learns of the response and, in any event, within 60 (sixty) days from the date of application.

12.PUBLICATION AND RETENTION OF THE DOCUMENT

This Policy is retained in two different media: printed paper and electronic format. The current version of the documents is available on the corporate portal and website.

13.UPDATE PERIOD

This Policy is reviewed at least once a year and is updated by Operations Management where necessary.

14.EFFECTIVE DATE

This Policy enters into force on the date of its adoption by the Executive Board.

Corporate

Monoblock Concrete Pavilions

Application Form

Privacy Policy