Privacy and Information Notice

PRIVACY & SECURITY POLICY AND INFORMATION NOTICE UNDER THE PERSONAL DATA PROTECTION LAW

This “Privacy & Security Policy and Information Notice under the Personal Data Protection Law” has been prepared by GKR İnşaat ve Enerji Anonim Şirketi (hereinafter referred to as the “Company”), as Data Controller and in line with its Obligation to Inform, in order to protect the fundamental rights and freedoms of data subjects and to inform our visitors of the legal grounds and methods by which we collect your personal data, how we process the data obtained, and the methods by which we ensure your data security. The Law No. 6698 on the Protection of Personal Data (KVKK) entered into force upon its publication in the Official Gazette No. 29677 dated 07.04.2016. KVKK aims to protect the fundamental rights and freedoms of natural persons whose personal data is processed, including the privacy of private life which is also protected by the Constitution, and to set out the obligations of natural and legal persons who process personal data in their capacity as data controller.

In line with KVKK and the provisions of the applicable legislation, the Company reserves the right to update and amend this Privacy & Security Policy and Information Notice under the Personal Data Protection Law.

1. PERSONAL DATA

Under KVKK, personal data means any information relating to an identified or identifiable natural person. Such information includes a person’s name, surname, date of birth, gender, identity number, e-mail address, residential/delivery address, telephone number and similar information, which is defined as personal data in our legislation because it can make the person identifiable.

2. PROCESSING OF PERSONAL DATA AND PURPOSE OF PROCESSING

Processing of personal data means any operation performed on data, such as obtaining, recording, storing, preserving, altering, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, by wholly or partly automated means.

Our Main Purposes for Processing Personal Data:

a) Planning or carrying out the purchase and sale processes of products or services,

b) Planning and carrying out production processes,

c) Following up on customer requests or complaints,

d) Following up on contract processes or legal claims,

e) Planning and carrying out the operational activities required to ensure that Company activities are conducted in accordance with Company procedures or the relevant legislation, and ensuring their security,

f) Planning or carrying out organization and event processes and activities,

g) Carrying out activities relating to visitors,

h) Ensuring that personal data is accurate and up to date,

i) Providing information to authorized institutions as required by legislation.

3. GENERAL PRINCIPLES IN THE PROCESSING OF PERSONAL DATA

The Company accepts, declares and undertakes that it complies, and will comply, with the following fundamental principles when processing personal data:

a) Lawfulness and fairness,

b) Being accurate and, where necessary, up to date,

c) Processing for specified, explicit and legitimate purposes,

d) Being relevant, limited and proportionate to the purposes for which it is processed,

e) Being retained only for the period necessary for the purpose for which it is processed.

4. DATA SECURITY

The Company accepts, declares and undertakes that it will establish the necessary systems and control mechanisms for the erasure, destruction or anonymization of the personal data it obtains; prevent the unlawful processing of data; prevent unlawful access to data; ensure the preservation of data and take all technical and administrative measures to this end; and carry out, or have carried out, the necessary audits within its own organization and where the data is processed by another natural or legal person, also taking all technical and administrative measures.

If the processed personal data is obtained by others by unlawful means, the Company will notify the data subject in writing or to their registered e-mail address, and the Personal Data Protection Board, as soon as possible.

5. TRANSFER OF PERSONAL DATA

DOMESTIC DATA TRANSFER

The Company may transfer the personal data it obtains to third-party natural or legal persons in Türkiye only with the explicit consent of the data subject. Personal data of the data subject may be transferred to third-party natural or legal persons without explicit consent in the cases listed below, in accordance with the law and to persons authorized in connection with the purpose:

a) It is expressly provided for by law,

b) It is necessary to protect the life or physical integrity of the person, or of another person, who is unable to give consent due to actual impossibility or whose consent is not legally valid,

c) Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract,

d) It is necessary for the data controller to fulfil its legal obligation,

e) The data has been made public by the data subject,

f) Data processing is necessary for the establishment, exercise or protection of a right,

g) Data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

DATA TRANSFER ABROAD

The Company may transfer the personal data it obtains to third-party natural or legal persons abroad only with the explicit consent of the data subject. Without seeking the explicit consent of the data subject, the Company may transfer personal data abroad if the domestic transfer conditions set out above are met and, in the foreign country to which the personal data will be transferred:

a) There is adequate protection, or

b) Where there is no adequate protection, the data controllers in Türkiye and in the relevant foreign country undertake adequate protection in writing and the Board has given its permission.

The countries with adequate protection as described above will be determined and announced by the Personal Data Protection Board. If safe countries are announced by the Board, personal data may be transferred abroad without the need to obtain permission from the Personal Data Protection Board and without the need for the data controllers in the foreign country to undertake protection in writing.

6. RIGHTS OF THE DATA SUBJECT

Natural persons whose personal data is processed have the right to apply to the Company, in its capacity as data controller, for the application of KVKK and other relevant legislation. Your rights as a data subject under Article 11 of KVKK are set out below:

a) To learn whether personal data is being processed,

b) To request information if personal data has been processed,

c) To learn the purpose of processing personal data and whether it is used in accordance with its purpose,

d) To know the third parties to whom personal data is transferred in Türkiye or abroad,

e) To request the rectification of personal data if it has been processed incompletely or inaccurately,

f) To request the erasure or destruction of personal data within the framework of the conditions set out in Article 7 of KVKK,

g) To request that the operations carried out pursuant to subparagraphs (e) and (f) be notified to third parties to whom the personal data has been transferred,

h) To object to a result arising against the person by means of the analysis of the processed data exclusively through automated systems,

i) To claim compensation for damages if the person suffers damage due to the unlawful processing of personal data.

7. APPLICATION TO THE DATA CONTROLLER

The data subject whose personal data is processed accepts that, should they wish to make a request regarding the exercise of their rights concerning personal data processed, or learned to be processed, by the Company, they are obliged to apply to the Company in its capacity as data controller within the most appropriate time frame related to the exercise of the right. The data subject accepts that they are obliged to submit their applications to the Company in writing by registered letter with return receipt, through a notary public, or by e-mail, with the subject line “Request for Information on the Personal Data Protection Law”.

In order to exercise the rights set out in Article 6 above titled “Rights of the Data Subject”, the mandatory information that must be included in the application, pursuant to Article 5/2 of the Communiqué on the Procedures and Principles of Application to the Data Controller, which entered into force upon its publication in the Official Gazette No. 30356 dated 10.03.2018, so that applications made to the Company can be answered in accordance with the law and legislation, is set out below:

a) Name, surname and, if the application is in writing, signature,

b) For citizens of the Republic of Türkiye, the T.R. identity number; for foreigners, nationality, passport number or identity number, if any,

c) Residential or business address for notification,

d) E-mail address, telephone and fax number for notification, if any,

e) Subject of the request.

A request letter containing the information and documents specified above, together with explanations regarding the right requested, may be sent to “Karaağaç OSB Mah. Eski Bağlar Cad. No:9/1 Kapaklı, Tekirdağ, Türkiye”, delivered through a notary public, or sent to the e-mail address info@gkrmesek.com.

The Company accepts and undertakes to conclude the requests in the application as soon as possible, depending on the nature of the request, and within thirty days at the latest.

The Company, in its capacity as data controller, has the right to accept the request regarding the exercise of the right directed to it by the data subject, or to reject it by stating its reasons. In this case, the data controller accepts that it is obliged to notify the person of its response to the request in writing or electronically. If the request in the application is accepted, the data controller accepts and undertakes that it is obliged to fulfil the request.

If the application is rejected, the response is found insufficient, or the application is not answered in due time (30 days), the data subject has the right to file a complaint with the Personal Data Protection Board within thirty (30) days from the date on which they learn of the data controller’s response, and in any case within sixty (60) days from the date of application.

COOKIE POLICY

This policy has been prepared to inform users visiting the https://gkrmesek.com/ website about our principles for the use of cookies.

1. WHAT IS A COOKIE?

Cookies are small data files that websites save on your devices and that are used to identify users. Cookies are used by websites to identify users and to offer them personalized services.

2. USE OF COOKIES

Cookies are used on the GKR İnşaat ve Enerji Anonim Şirketi website in order to offer users the best experience.

What Types of Cookies Do We Use?

• Cookies necessary for the website to function (Session Cookies)
• Cookies that allow us to improve the user experience (Functional Cookies)
• Performance cookies used to understand and analyze how and how often the content on our website is used by users and to improve the content offered (Performance and Statistics Cookies)

3. COOKIE MANAGEMENT

If you do not want cookies to be stored on the device you use to access our website, you can block, limit and delete the use of cookies through your browser settings. You can also change these preferences later.

If you access our website from different devices, you can configure the cookie settings on each device and browser you use according to your preferences through the links below.