TABLE OF CONTENTS

1. INTRODUCTION 1……………………………………………………………………………………………………. …………………………………………………………………………………………………….
2. Purpose and Scope 1……………………………………………………………………………………………… ………………………………………………………………………………………………
3. Definitions 1…………………………………………………………………………………………………………. ………………………………………………………………………………………………………….
4. GENERAL PRINCIPLES and CONDITIONS FOR THE PROCESSING OF PERSONAL DATA 3
5. Principles Regarding the Processing of Personal Data 3………………………………………………. ……………………………………………….
6. Conditions Regarding the Processing of Personal Data 4…………………………………………….. ……………………………………………..
7. Requirements for Processing Sensitive Personal Data 5………………………………………………. ……………………………………………….

III. CATEGORIES OF PERSONAL DATA PROCESSED BY PROCAT 6…………………………. ………………………….

6. TRANSFER OF PERSONAL DATA 6……………………………………………………………………….. ………………………………………………………………………..
7. Transfer of Personal Data 6……………………………………………………………………………………. …………………………………………………………………………………….
8. Transfer of Sensitive Personal Data 7………………………………………………………………………. ……………………………………………………………………….
9. ISSUES RELATED TO THE PROTECTION OF PERSONAL DATA 7………………………… …………………………
10. STORAGE and DISPOSAL OF PERSONAL DATA 8…………………………………………………. ………………………………………………….

VII. CLARIFICATION and INFORMATION OF THE PERSON CONCERNED 9…………….. ……………..

VIII. RIGHTS OF the PERSON CONCERNED and EXERCISE OF THESE RIGHTS 10……. ……

11. PROCAT ‘S RESPONSE TO APPLICATIONS 11………………………………………………………. ……………………………………………………….
12. ENFORCEMENT OF THE POLICY 11……………………………………………………………………… ……………………………………………………………………..

I. INTRODUCTION

A.     Purpose and Scope

The policy regulates the principles adopted by PROCAT in the protection and processing of personal data.

Within the scope of this Policy, it is aimed to provide explanations about the systems adopted by PROCAT for the processing of personal data and the protection of personal data, to ensure transparency by informing the Relevant Person, especially the Employee, Employee Candidate, Employee Relative, Supplier Officer, Supplier Employee, Product or Service Recipient, Potential Product or Service Recipient, Intern, Visitor, Employee Relative, Employee’s Authorized Person in the Former Workplace, Employer, Workplace Physician, Public Official, Institution Official, Reference Person, Receiver and Deliverer, Person Subject to the News and Other Third Parties Involved in Any Process, to ensure the establishment and realization of standards in the management of personal data; to determine and support organizational goals and obligations; to establish control mechanisms in accordance with the acceptable level of risk, to comply with the principles and rules imposed by international conventions, Constitution, laws, regulations, contracts and other legislation regarding the protection of personal data, and to protect the fundamental rights and freedoms of the Relevant Person in the best possible way. In addition, this Policy covers all physical and electronic data recording systems and environments used for the automatic or non-automatic processing of personal and special personal data, provided that it is part of any data recording system.

B. Definitions

II.GENERAL PRINCIPLES and CONDITIONS FOR THE PROCESSING OF PERSONAL DATA

PROCAT carries out personal data processing activities in accordance with Article 20 of the Constitution and Article 4 of the KVKK; in accordance with the law and honesty rules, accurate and up-to-date when necessary; for specific, clear and legitimate purposes; in connection with the purpose, in a limited and measured manner. In this context, pursuant to Article 5 of the LPPD, it processes personal data based on one or more of the conditions in Article 5 of the LPPD regarding the processing of personal data, and retains personal data for the period stipulated by the laws and/or required by the purpose of personal data processing. In addition, it acts in accordance with the regulations stipulated in terms of the processing of sensitive personal data in accordance with Article 6 of the LPPD, acts in accordance with the regulations stipulated in the law and put forward by the LPPD Board on the transfer of personal data in accordance with Articles 8 and 9 of the LPPD, enlightens the Relevant Person in accordance with Article 10 of the LPPD and provides the necessary information if the Relevant Person requests information.

A.     Principles Regarding the Processing of Personal Data

Your personal data is processed by PROCAT in accordance with the principles of personal data processing in Article 4 of the LPPD. It is mandatory to comply with these principles for each personal data processing activity:

Processing of personal data in accordance with the law and the rules of honesty:

In the processing of your personal data, we act in accordance with the laws, secondary regulations and general principles of law; it is important to process personal data limited to the purpose of processing and to take into account the reasonable expectations of the Relevant Person.

Accurate and up-to-date personal data:

Care is taken to check whether your processed personal data is up-to-date or not. In this context, the Relevant Person is granted the right to request the correction or deletion of his/her accurate and outdated data.

Processing of personal data for specific, explicit and legitimate purposes:

Before each personal data processing activity, the purposes of data processing are determined and these purposes are complied with in accordance with the law.

Being related, limited and proportionate to the purpose for which the personal data are processed:

The personal data required to perform the purpose of data processing is limited and the necessary technical and administrative measures are taken to prevent the processing of personal data not related to this purpose.

Retention of personal data for the period required by the legislation or processing purposes:

Personal data is deleted, destroyed or anonymized after the disappearance of the purpose of personal data processing or the expiration of the period stipulated in the legislation.

B. Conditions Regarding the Processing of Personal Data

Your personal data is processed by PROCAT in the presence of at least one of the personal data processing conditions set out in Article 5 of the LPPD. Explanations regarding these conditions are given below:

Having the Explicit Consent of the Relevant Person:

The personal data of the Relevant Person can be processed with his/her free will, having sufficient information about the personal data processing activity, in a way that leaves no room for hesitation and only if he/she gives his/her consent limited to that transaction.

Clearly stipulated by law:

Personal data may be processed within the framework of the relevant legal regulation without the Explicit Consent of the Relevant Person, if explicitly stipulated by law.

Failure to obtain the Explicit Consent of the Relevant Person due to the actual impossibility and the obligation to process personal data:

Personal data of the Relevant Person, who is unable to disclose his/her consent or whose consent cannot be validated, can be processed without seeking Explicit Consent if it is necessary to process personal data in order to protect the life or physical integrity of the Relevant Person or a third party.

If the personal data processing activity is directly related to the establishment or performance of a contract:

If it is necessary to process the personal data of the parties to the contract established or already signed between the relevant person and PROCAT, the personal data processing activity can be carried out without seeking explicit consent.

In order for the Data Controller to fulfill its legal obligation, it is mandatory to carry out personal data processing activities:

Personal data may be processed without seeking Explicit Consent in order to fulfill its legal obligations stipulated within the scope of the legislation in force.

The Relevant Person has made his/her personal data public:

Personal data that has been disclosed to the public in any way by the Relevant Person and has become accessible to everyone as a result of this publicization can be processed without the Explicit Consent of the Relevant Person, limited to the purpose of publicization.

Personal data processing is mandatory for the establishment, exercise or protection of a right:

If data processing is mandatory for the establishment, exercise or protection of a right, the personal data of the Relevant Person may be processed.

Provided that it does not harm the fundamental rights and freedoms of the Data Subject, data processing is mandatory for the legitimate interests of the data controller:

Personal data may be processed provided that the balance of interest of the Relevant Person is observed. In this context, in the processing of data based on legitimate interest, first of all, the legitimate interest that PROCAT will obtain as a result of the processing activity is determined. The possible impact of the processing of personal data on the rights and freedoms of the Relevant Person is evaluated and if it is concluded that the balance is not disturbed, the processing activity can be carried out without seeking Explicit Consent.

C. Conditions for Processing Sensitive Personal Data

In Article 6 of the LPPD, sensitive personal data are specified in a limited number. These are; race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, clothing, membership to associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

PROCAT may process sensitive personal data by ensuring that additional measures determined by the PPD Board are taken in the following cases:

Having the explicit consent of the person concerned

Sensitive personal data of the Relevant Person can be processed with his/her free will, having sufficient information about the processing activity of sensitive personal data, without hesitation and only if he/she gives his/her consent limited to that transaction.

Clearly stipulated by law

Sensitive personal data may be processed within the framework of the relevant legal regulation without the Explicit Consent of the Relevant Person, if explicitly stipulated by law.

The fact that it is mandatory for the protection of the life or physical integrity of the person who is unable to disclose his/her consent due to actual impossibility or whose consent is not legally valid

Sensitive personal data belonging to the Relevant Person, who cannot disclose his/her consent or whose consent cannot be validated, can be processed without seeking Explicit Consent if it is necessary to process sensitive personal data in order to protect the life or physical integrity of the Relevant Person or a third party.

Regarding the personal data that the person concerned has made public and being in compliance with the publicization will

Sensitive personal data that has been disclosed to the public in any way by the Relevant Person and has become accessible to everyone as a result of this publicization can only be processed without the Explicit Consent of the Relevant Person, limited to the will to publicize.

Mandatory for the establishment, exercise or protection of a right

If data processing is mandatory for the establishment, exercise or protection of a right, the sensitive personal data of the Relevant Person may be processed.

Necessary for the purpose of the protection of public health, the execution of preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services by persons under the obligation of confidentiality or authorized institutions and organizations

Persons under the obligation of confidentiality or authorized institutions and organizations may process data without the explicit consent of the Relevant Person, even if data processing is necessary for the protection of public health, the execution of preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services.

Mandatory for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance

Sensitive personal data of the Relevant Person may be processed without his/her Explicit Consent if it is mandatory for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance.

Provided that the foundations, associations and other non-profit organizations or organizations established for political, philosophical, religious or trade union purposes are in accordance with the legislation and purposes they are subject to, are limited to their fields of activity and are not disclosed to third parties, they should be aimed at their current or former members and members or persons who are in regular contact with these organizations and organizations

Foundations, associations and other non-profit organizations or formations established for political, philosophical, religious or trade union purposes may process sensitive personal data without the need for Explicit Consent, provided that the Relevant Person is a current or former member/member or a person who is in regular contact with these organizations and formations, limited to his/her fields of activity, and provided that it is not shared with third parties, in accordance with the legislation they are obliged to comply with and their own purposes.

III. CATEGORIES OF PERSONAL DATA PROCESSED BY PROCAT

Within the framework of the purposes and conditions specified in this Policy, PROCAT processes the personal data of the Relevant Person within the categories of Criminal Conviction and Security Measures, Other (Accident Number), Other (Accident Date), Other(Plate), Other(Reference Information), Philosophical Belief, Religion, Sect and Other Beliefs, Finance, Physical Space Security, Visual and Audio Records, Legal Transaction, Race and Ethnic Origin, Communication, Transaction Security, Identity, Professional Experience, Personality, Health Information in accordance with the provisions of the KVKK and other relevant legislation.

IV.TRANSFER OF PERSONAL DATA

PROCAT may transfer the personal data and sensitive personal data of the Relevant Person to natural persons and private law legal entities, shareholders, suppliers and authorized public institutions and organizations and other relevant persons by taking the necessary security measures for the purposes of personal data processing in accordance with the law. Accordingly, the regulations stipulated in Article 8 of the PPDL are complied with.

A.Transfer of Personal Data

Even if the Relevant Person does not have Explicit Consent, if one or more of the following conditions are present, personal data may be transferred to third parties by taking the necessary care by PROCAT and taking all necessary security measures, including the methods stipulated by the PPD Board:

• Clearly stipulating the relevant activities related to the transfer of personal data in the laws,

• The person who is unable to disclose his/her consent due to actual impossibility or whose consent is not legally valid is obliged to protect the life or physical integrity of himself/herself or someone else.

• The transfer of personal data is directly related and necessary for the establishment or performance of a contract,

• The transfer of personal data is mandatory for the fulfillment of a legal obligation,

• Limited transfer of personal data for publicization purposes, provided that the personal data has been made public by the Relevant Person,

• If the transfer of personal data is mandatory for the establishment, use or protection of the rights of PROCAT or the person concerned or third parties,

• Provided that it does not harm the fundamental rights and freedoms of the Relevant Person, it is mandatory to carry out personal data transfer activities for the legitimate interests of PROCAT,

In addition to the above, personal data may be transferred to foreign countries declared to have adequate protection by the PPD Board in the presence of any of the above conditions. In the absence of adequate protection, in line with the data transfer conditions stipulated in the legislation, it can be transferred to foreign countries where the data controllers in Turkey and the relevant foreign country undertake an adequate protection in writing and where the KVK Board has permission without the Explicit Consent of the Relevant Person.

B.Transfer of Sensitive Personal Data

Sensitive personal data can be transferred by PROCAT in accordance with the principles specified in this Policy and by taking all necessary technical and administrative measures, including the methods to be determined by the PPD Board, and in the presence of the following conditions.

The processing of sensitive personal data is prohibited; these data can only be processed;

• Having the explicit consent of the person concerned,
• It is clearly stipulated in the laws,
• If it is mandatory for the protection of the life or physical integrity of the person who is unable to disclose his/her consent due to actual impossibility or whose consent is not legally valid,
• Regarding the personal data that the person concerned has made public and being in compliance with the publicization will,
• It is mandatory for the establishment, exercise or protection of a right,
• Necessary for the purpose of the protection of public health, the execution of preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services by persons under the obligation of confidentiality or authorized institutions and organizations,
• It is mandatory for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance,
• Provided that the foundations, associations and other non-profit organizations or formations established for political, philosophical, religious or trade union purposes are in accordance with the legislation and purposes they are subject to, are limited to their fields of activity and are not disclosed to third parties; they are aimed at their current or former members and members or persons who are in regular contact with these organizations and formations,

may be processed and transferred by taking adequate measures determined by the Board if there are exceptional circumstances.

In addition to the above, personal data may be transferred to foreign countries with adequate protection in the presence of any of the above conditions. In the absence of adequate protection, it can be transferred to foreign countries where the Data Controller / Data Processor undertakes adequate protection in accordance with the data transfer conditions stipulated in the legislation.

V. ISSUES RELATED TO THE PROTECTION OF PERSONAL DATA

In accordance with Article 12 of the KVKK, PROCAT takes the necessary technical and administrative measures to ensure the appropriate level of security in order to prevent the unlawful processing of the personal data it processes and to prevent unlawful access to the data, and to ensure the protection of the data, and to carry out or have carried out the necessary audits in this context.

The data protection principles adopted by PROCAT include:

• Giving clear information to individuals about who uses their personal data and how,

• For these purposes, processing personal data at the minimum necessary scale in order not to harm the fundamental rights and freedoms of individuals and not to process more data than necessary,

• Respecting the rights of the Relevant Person regarding his/her personal data, including the right of access,

• Keeping an inventory of the personal data categories processed,

• Keeping personal data accurate and up-to-date when necessary,

• Processing personal data in accordance with fairness and law,

• Processing personal data only if it is clearly necessary for legitimate corporate purposes,

• Retention of personal data only within the framework of legal regulations, legal obligations or legitimate corporate interests of PROCAT and within the periods specified in the PROCAT Personal Data Retention and Destruction Policy,

• Transferring personal data abroad within the framework of the principles determined by the KVKK,

• Determination of a Committee with special powers and responsibilities regarding the personal data protection system,

• Implementation of exceptions permitted in accordance with the legislation,

• Preparation of this Policy,

• Taking the necessary technical and administrative measures determined by the KVKK and secondary legislation as well as the KVK Board to ensure the appropriate level of security of all personal data,

• Processing only relevant and appropriate personal data.

VI. STORAGE and DESTRUCTION OF PERSONAL DATA

PROCAT keeps personal data in accordance with the period required for the purpose for which they are processed and the minimum periods stipulated in the legislation to which the relevant activity is subject. In this context, first of all, it is determined whether a period is stipulated for the storage of personal data in the relevant legislation, and if a period is determined, this period is complied with. If it is not available in the legislation for a period of time, personal data are kept for the period required for the purpose for which they are processed. At the end of the specified retention periods, personal data are destroyed in accordance with the periodic destruction periods specified in the PROCAT Personal Data Retention and Destruction Policy or the application of the Relevant Person and by determined destruction methods (deletion and/or destruction and/or anonymization).

For detailed information, you can review the PROCAT Personal Data Retention and Destruction Policy (https://procat.com.tr/kisisel-verilerin-korunmasi-kanunu/?lang=tr).

VII.INFORMING AND INFORMING THE PERSON CONCERNED

PROCAT enlightens the Relevant Person in accordance with Article 10 of the KVKK. In this context, if the personal data is obtained from the Relevant Person himself/herself, during the acquisition; if it is not obtained from the Relevant Person, within a reasonable period of time from the acquisition of the personal data; but in any case, regardless of the request of the Relevant Person,

• The identity of PROCAT,

• For what purpose the personal data will be processed,

• To whom and for what purposes it can be transferred,

• Method of collecting personal data (whichever of the fully or partially automated methods is used or which of the non-automatic methods is used, provided that it is part of a data recording system),

• The legal reason for collecting personal data,

• Other rights of the Relevant Person listed in Article 11 of the LPPD,

explained.      

In addition to the above, it must be ensured that the said clarification includes the rights of the Relevant Person listed in the PPDL and this Policy. The following points are taken into account when lighting:

• Informing within the scope of clarification is carried out using clear and simple language. For other purposes that may come up in the future, expressions that suggest that the relevant personal data can be processed are not used.

• Clarification can be made through various physical or electronic channels through the call center through verbal, written, audio recording, and can be directed to the web page where personal data clarification texts are located and other channels that can be announced later. The relevant department, which informs and fulfills the obligation of clarification, takes measures to prove this in accordance with the law and procedure.

• If the purpose of data processing specified in the clarification changes while obtaining a personal data, the obligation to clarify for this new purpose shall be fulfilled separately in accordance with the procedures stipulated above.

• If the personal data obtained will only be used for the purpose of communicating with the Relevant Person, the clarification can be made during the establishment of the first communication.

• If the personal data obtained will be transferred to third parties, it is ensured that the clarification is carried out at the latest when the personal data is transferred for the first time.

VIII.    Rights OF the PERSON CONCERNED and the EXERCISE OF THESE RIGHTS

The legal rights that the Relevant Person can exercise in relation to personal data are listed below:

• To learn whether their personal data is processed or not,

• Requesting information if his/her personal data has been processed,

• To learn the purpose of processing personal data and whether they are used in accordance with their purpose,

• To learn the third parties whose personal data are transferred domestically or abroad,

• To request correction of your personal data if it is incomplete or incorrectly processed and to request notification of the transaction made within this scope to third parties to whom your personal data has been transferred,

• Although it has been processed in accordance with the provisions of the Law and other relevant laws, to request the deletion, destruction or anonymization of his/her personal data in case the reasons requiring its processing disappear and to request the notification of the transaction made within this scope to the third parties to whom his/her personal data has been transferred,

• To object to the emergence of a negative result by analyzing the processed data exclusively through automated systems,

• To request compensation in case of loss due to unlawful processing of personal data.

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller numbered 30356, the Relevant Person may submit his/her requests regarding his/her rights specified in this article to PROCAT by filling out the PROCAT Application Form in writing or by using the Registered Electronic Mail (REM) address, Secure Electronic Signature, Mobile Signature or the e-mail address he/she has previously notified and registered in our system.

IX. PROCAT ‘S RESPONSE TO APPLICATIONS

PROCAT takes all necessary technical and administrative measures to conclude the applications to be made by the Relevant Person effectively, in accordance with the law and honesty.

Applications of the Relevant Person may be accepted or rejected by explaining the reason. The response to the application of the Relevant Person may be notified to the Relevant Person in writing or electronically.

In the event that the Relevant Person submits his/her request regarding the rights under Title VIII of the Policy titled Rights of the Relevant Person and Exercise of These Rights to PROCAT in accordance with the aforementioned procedures, the relevant request shall be concluded free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost and the conditions determined by the PPD Board are met, the fee in the tariff may be requested.

X. ENFORCEMENT OF THE POLICY

This Policy issued by PROCAT entered into force on 26.06.2020 and necessary updates will be made in case of renewal of all or certain articles of the Policy.

The Committee shall carry out the implementation, updating and announcement of this Policy.

The policy is published on the PROCAT website (https://procat.com.tr/kisisel-verilerin-korunmasi-kanunu/?lang=tr).