Personal Data Protection and Processing Policy

HASER ALUMINUM PLASTIC INDUSTRY AND TRADE LTD. ŞTİ.

PERSONAL DATA PROTECTION AND PROCESSING POLICY

1. Introduction

1.1. POLITICAL PURPOSE

Within the scope of the Personal Data Protection Law No. 6698 (“Law”)
Haser Aluminum Plastic Industry and Trade LTD. ŞTİ.   As (“Company”), storing and protecting personal data in accordance with its records is among our important objectives. We follow the same priority in all our planning and business activities. To enlighten you regarding this union in accordance with Article 10 of the Law; You submit this Personal Data Processing and Protection Policy (“Policy”) for your information in order to record all administrative and technical procedures we will implement within the scope of protection and protection of your personal data.

1.2 SCOPE

This Policy determines the conditions for processing personal data and Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ. The principles adopted for personal maintenance are set forth. This logical Policy; Haser Aluminum Plastic Industry and Trade LTD. ŞTİ. It covers all personal data processing activities within the scope of the Law, all personal data processed and the ownership of these personal data.

1.3 DEFINITIONS

1.4 ENFORCEMENT OF THE POLICY

Haser Aluminum Plastic Industry and Trade LTD. ŞTİ. This Policy, issued by , entered into force on 02.01.2024 and was presented to the public. In case of conflict between the current legislation, especially the Law, and the regulations contained in this Policy, the provisions of the legislation shall apply.

Haser Aluminum Plastic Industry and Trade LTD. ŞTİ. reserves the right to make changes to the Policy in parallel with legal regulations. You can access the current version of the Policy on the website www.haseryapi.com.tr.

2. Haser Aluminum Plastic Industry and Trade LTD. Information Regarding Personal Data Processing Activities Conducted by ŞTİ.

2.1 DATA SUBJECTS

Data owners within the scope of the policy are Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ.  All real persons, other than Company employees, whose personal data are processed by. In general, data owners can be listed as follows:

The data subject categories described in the table above are stated for general information sharing purposes. The fact that the data owner does not fall within the scope of any of these categories does not eliminate his/her status as a data owner as stated in the Law.

2.2 PURPOSES OF PROCESSING PERSONAL DATA

2.2.1 Haser Aluminum Plastic Industry and Trade LTD. Carrying out the necessary work by the relevant units and carrying out the business processes in order to benefit the relevant people from the products and services offered by ŞTİ.:

Planning and executing sales processes of products and/or services,
Planning and/or executing after-sales support services activities,
Planning and execution of customer relationship management processes,
Following up contract processes and/or legal requests,
Follow-up of customer requests and/or complaints.

2.2.2 Haser Aluminum Plastic Industry and Trade LTD. Planning and execution of ŞTİ.'s human resources policies and processes:

Planning and execution of talent-career development activities,
Fulfilling obligations arising from employment contracts and/or legislation for company employees,
Planning and execution of fringe benefits and benefits for employees,
Planning and execution of in-company orientation activities,
Planning and execution of personnel exit procedures,
Fee management
Planning human resources processes,
Managing personnel recruitment processes,
Planning and executing appointment-promotion and resignation processes for the company,
Planning and executing employee performance evaluation processes,
Monitoring and/or auditing the work activities of employees,
Planning and/or carrying out in-company training activities,
Planning and executing employee satisfaction and/or loyalty processes,
Planning and executing the processes of receiving and evaluating employees' suggestions for improving work and/or production processes,
Planning and/or executing intern and/or student recruitment, placement and operation processes.

2.2.3 Haser Aluminum Plastic Industry and Trade LTD. ŞTİ. Carrying out the necessary work by the relevant business units and carrying out the related business processes in order to realize the commercial activities carried out by:

event management,
Planning and execution of business activities,
Planning and execution of corporate communication activities,
Planning and execution of supply chain management processes,
Planning and execution of production and/or operation processes,
Planning, auditing and executing information security processes,
Establishing and managing information technology infrastructure,
Planning and executing business partners' access to information authorizations,
Following up financial and/or accounting affairs,
Planning and executing corporate sustainability activities,
Planning and execution of corporate governance activities,
Planning and/or executing activities to ensure business continuity,
Planning and execution of logistics activities.
 

2.2.4 Haser Aluminum Plastic Industry and Trade LTD. ŞTİ. Planning and executing the activities necessary to customize and recommend and promote the products and services offered by the company according to their tastes, usage habits and needs to the relevant people:

Identification and/or evaluation of people to be subject to marketing activities in line with consumer behavior criteria,
Designing and/or executing personalized marketing and/or promotional activities,
Designing and/or executing advertising and/or promotion and/or marketing activities in digital and/or other media,
Designing and/or executing activities to be developed on customer acquisition and/or value creation for existing customers in digital and/or other channels,
Planning and/or executing data analytics studies for marketing purposes,
Planning and execution of marketing processes of products and/or services,
Planning and/or executing the processes of creating and/or increasing loyalty to the products and/or services offered by the company.
 

2.2.5 Haser Aluminum Plastic Industry and Trade LTD. Planning and executing ŞTİ.'s commercial and/or business strategies, managing relations with business partners, ensuring legal, technical and commercial occupational safety of relevant persons in business relations with the company:

Follow-up of legal affairs
Planning and executing necessary operational activities to ensure that company activities are carried out in accordance with company procedures and/or relevant legislation,
Providing information regarding legislation to authorized institutions,
Creating and tracking visitor records,
Planning and executing emergency management processes,
Carrying out company and partnership law transactions,
Planning and execution of company audit activities,
Planning and/or executing occupational health and/or safety processes,
Performing risk management of credit processes,
Ensuring the security of company campuses and/or facilities,
Ensuring the security of company operations,
Planning and/or execution of the company's financial risk processes,
Ensuring the security of company assets and/or resources.

2.3 PERSONAL DATA CATEGORIES

Haser Aluminum Plastic Industry and Trade LTD. ŞTİ. Personal data categorized as follows are processed in accordance with the personal data processing conditions in the Law and relevant legislation:

3. Principles and Conditions for Processing Personal Data

Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ. processes personal data in accordance with Article 4 of the Law, ensuring that the data is processed lawfully and in good faith, is accurate and up-to-date when necessary, processed for specific, clear, and legitimate purposes, and is relevant, limited, and proportionate to the intended purpose. The company retains personal data for the duration required by the law or for the purposes for which it was processed.

3.1 Principles for Processing Personal Data

Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ., in compliance with Article 10 of the Personal Data Protection Law (KVK Law), informs data subjects and requests their consent in situations where consent is required, processing personal data based on the following principles:

3.1.1 Processing Data Lawfully and in Good Faith

Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ. processes personal data in line with the legal principles and general trust and good faith rules established by legal regulations. In accordance with the principle of good faith, the company considers the interests and reasonable expectations of the data subjects while pursuing its data processing goals.

3.1.2 Ensuring Data is Accurate and Up-to-Date When Necessary

Maintaining accurate and up-to-date personal data is essential for protecting the fundamental rights and freedoms of data subjects. Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ. is actively responsible for ensuring that data is accurate and up-to-date. To facilitate this, all communication channels with the data subjects are kept open.

3.1.3 Processing Data for Specific, Clear, and Legitimate Purposes

Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ. defines its legitimate and lawful data processing purposes explicitly and clearly. It processes personal data only as necessary for the conduct of its commercial activities and in connection with these activities.

3.1.4 Processing Data in a Manner Relevant, Limited, and Proportionate to the Purpose

Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ. processes personal data in a way that is relevant to and necessary for the purpose of its business activities. As a result, it processes personal data to the extent that it is suitable for achieving the specified purposes and avoids processing data unrelated to or unnecessary for the intended purposes.

3.1.5 Retaining Data for the Duration Required by Relevant Legislation or the Purpose for Which it is Processed

Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ. retains personal data only for the period stipulated by the relevant legislation or as long as necessary for the purpose for which it was processed. In this context, the company first determines if a retention period is specified by relevant legislation and acts in accordance with this period. If no such period is defined, personal data is retained for the time necessary to fulfill the processing purpose. After the purpose is no longer valid or the legally stipulated period expires, personal data is deleted, destroyed, or anonymized by the company.

3.2 Conditions for Processing Personal Data

Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ. processes personal data if at least one of the data processing conditions set forth in Article 5 of the Law is present.

3.2.1 Obtaining the Data Subject’s Explicit Consent

One of the conditions for processing personal data is obtaining the explicit consent of the data subject. The explicit consent of the data subject must relate to a specific issue, be based on information, and be given freely. For the processing of personal data based on the data subject’s consent, the company obtains explicit consent from customers, potential customers, and visitors using appropriate methods.

3.2.2 Conducting Data Processing Activities Clearly Stipulated by Law

If the personal data of the data subject is explicitly stipulated by law, the data can be processed lawfully without the need for explicit consent from the data subject.

3.2.3 Inability to Obtain Consent Due to Physical Impossibility

If it is impossible to obtain the consent of the data subject due to physical impossibility, or if their consent cannot be deemed valid, personal data may be processed if it is necessary to protect the life or physical integrity of the data subject or another person.

3.2.4 Data Processing Related to the Formation or Performance of a Contract

If the processing of personal data is necessary for the formation or performance of a contract, personal data may be processed for this purpose, provided it is directly related to the contract.

3.2.5 Fulfilling Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ.’s Legal Obligations

Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ., as the data controller, may process personal data to fulfill its legal obligations when processing is necessary.

3.2.6 Publicizing Personal Data by the Data Subject

If the data subject has made their personal data public, it can be processed for related purposes.

3.2.7 Data Processing Required for the Establishment or Protection of a Right

Personal data may be processed if necessary for the establishment, exercise, or protection of a legal right.

3.2.8 Processing Data for Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ.’s Legitimate Interests

Personal data may be processed if it is necessary for the legitimate interests of Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ., provided that it does not harm the fundamental rights and freedoms of the data subject.

3.3 Processing Special Categories of Personal Data

Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ. processes special categories of personal data as specified in the KVK Law with due care and in accordance with the regulations. The company processes special categories of personal data in the following cases:

• If the data subject has given explicit consent, or
• If explicit consent is not obtained, non-health-related special categories of personal data can be processed in cases provided for by law. Health-related special categories of personal data can only be processed by persons or authorized institutions obligated to maintain confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment, and care services, or managing health services and financing.

4. Transfer of Personal Data

Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ. may transfer the personal data and special categories of personal data of data subjects to third parties within the country, provided that necessary security measures are taken and the data processing purposes comply with legal regulations. The company complies with the regulations in Article 8 of the KVK Law during such transfers.

4.1 Transfer of Personal Data to Third Parties Within the Country

Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ. may transfer personal data in compliance with the data processing conditions explained in the third section of this Policy and under the conditions outlined in Articles 5 and 6 of the Law.

4.2 Third Parties to Whom Personal Data is Transferred and the Purpose of Transfer

Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ. may transfer personal data to the categorized third parties listed in the following table, in compliance with the general principles of the Law and the conditions for data processing outlined in Article 8.

5. RIGHTS OF THE DATA SUBJECT AND EXERCISE OF RELATED RIGHTS

5.1 RIGHTS OF THE DATA SUBJECT:

• To learn whether personal data is being processed,
• To request information if personal data has been processed,
• To learn the purpose of processing personal data and whether it is used in accordance with its purpose,
• To know the third parties in the country to whom personal data is transferred,
• To request the correction of incomplete or inaccurate personal data and to request that the action taken in this regard be communicated to third parties to whom the personal data has been transferred,
• To request the deletion or destruction of personal data if the reasons for its processing no longer exist, even though it has been processed in accordance with the relevant provisions of the Personal Data Protection Law and other applicable laws, and to request that the action taken in this regard be communicated to third parties to whom the personal data has been transferred,
• To object to a negative outcome arising from the analysis of processed data exclusively through automated systems,
• To request compensation for damages incurred as a result of the unlawful processing of personal data.

In cases where personal data is not obtained directly from the data subject, Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ. will provide information to the data subject in accordance with the following conditions: (1) within a reasonable period after the personal data is obtained, (2) if the personal data will be used to communicate with the data subject, at the time of the first communication, and (3) if the personal data will be transferred, no later than the time of the first transfer.

5.2 CIRCUMSTANCES WHERE THE DATA SUBJECT CANNOT EXERCISE THEIR RIGHTS:

According to Article 28 of the Personal Data Protection Law, personal data subjects cannot exercise their rights in the following cases as these situations are exempt from the scope of the law:

• If personal data is processed by real persons entirely within the scope of activities related to themselves or family members living in the same residence, provided that it is not shared with third parties and data security obligations are observed,
• If personal data is processed for purposes such as research, planning, and statistics through anonymization,
• If personal data is processed for artistic, historical, literary, or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public safety, public order, economic security, or personal rights and does not constitute a crime,
• If personal data is processed by public institutions and organizations authorized by law for the purpose of carrying out preventive, protective, and intelligence activities aimed at ensuring national defense, national security, public safety, public order, or economic security,
• If personal data is processed by judicial authorities or enforcement agencies in relation to investigation, prosecution, trial, or execution processes.

According to Article 28.2 of the Personal Data Protection Law, in the following cases, personal data subjects cannot exercise the rights listed in Article 5.1, except for the right to request compensation for damages:

• If personal data processing is necessary for the prevention of a crime or for a criminal investigation,
• If personal data has been made public by the data subject,
• If personal data processing is necessary for the fulfillment of inspection or regulatory duties and for disciplinary investigations or prosecutions by authorized public institutions or professional organizations,
• If personal data processing is necessary for the protection of the economic and financial interests of the state regarding budget, tax, and financial matters.

6. DELETION, DESTRUCTION, AND ANONYMIZATION OF PERSONAL DATA

As regulated under Article 138 of the Turkish Penal Code and Article 7 of the Personal Data Protection Law, personal data will be deleted, destroyed, or anonymized when the reasons for processing no longer exist, upon the decision of Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ. or upon the request of the data subject. In this context, Haser Alüminyum Plastik Sanayi ve Ticaret LTD. ŞTİ. has taken the necessary technical and administrative measures within the company to fulfill this obligation and has developed operational mechanisms in this regard. The company educates and assigns relevant business units to comply with these obligations and ensures their awareness.