Personal Data Protection Policy

1. Purpose and Scope

The protection of personal data, which is recognized and legally safeguarded as a constitutional right, is a matter of great importance and a priority for ARK PRES EMNİYET KEMERİ SANAYİ VE TİCARET ANONİM ŞİRKETİ (“ARK PRES” or the “Company”). At ARK PRES, we are aware of our responsibilities in this regard and attach importance to the secure processing of your personal data.

The purpose of this Personal Data Retention, Processing and Destruction Policy (the “Policy”) is to establish the methods and principles to be followed to protect the fundamental rights and freedoms of natural persons, particularly the privacy of their private lives, by ensuring that personal data processed by ARK PRES is processed, transferred and protected in compliance with Personal Data Protection Law No. 6698 (“KVKK”), published in the Official Gazette dated 7 April 2016 and numbered 29677, and the applicable secondary legislation. The Policy also explains the rights of Data Subjects under KVKK and applicable secondary legislation.

This Policy applies to all activities involving the processing, transfer, retention, destruction and protection of personal data managed by ARK PRES.

In this regard, ARK PRES takes the administrative and technical measures necessary to protect personal data processed under applicable legislation. The Company reserves the right to amend this Policy.

B. Definitions

The definitions and terms used in this KVKK Policy have the meanings assigned to them under KVKK and the relevant secondary legislation enacted pursuant to KVKK. In this context:

• Explicit Consent: Consent relating to a specific matter, based on information and expressed freely.
• Data Subject: The natural person whose personal data is processed.
• Personal Data: Any information relating to an identified or identifiable natural person.
• Processing of Personal Data: Any operation performed on personal data, such as obtaining, recording, storing, retaining, altering, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, whether wholly or partly by automated means or by non-automated means forming part of a data recording system.
• Board: The Personal Data Protection Board.
• Authority: The Personal Data Protection Authority.
• Personal Data Inventory: An inventory detailing the personal data processing activities of data controllers in connection with their business processes, by associating such activities with their purposes and legal grounds, data categories, recipient groups and data subject groups, and specifying the maximum retention periods necessary for the processing purposes, personal data envisaged to be transferred abroad and data security measures.
• Recording Medium: Any medium containing personal data processed wholly or partly by automated means, or by non-automated means forming part of a data recording system.
• KVKK: Personal Data Protection Law No. 6698.
• Destruction: Deletion, destruction or anonymization of personal data.
• Periodic Destruction: Deletion, destruction or anonymization carried out ex officio at recurring intervals specified in the personal data retention and destruction policy when all conditions for processing personal data under the Law cease to exist.
• Policy: ARK PRES’s Personal Data Retention, Processing and Destruction Policy.
• Special Categories of Personal Data: Data concerning race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.
• Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.
• VERBIS: Data Controllers Registry Information System.
• Data Processor: The natural or legal person who processes personal data on behalf of the data controller under the authority granted by that controller.
• Regulation: The Regulation on the Deletion, Destruction or Anonymization of Personal Data, published in the Official Gazette dated 28 October 2017.

1. Data Subjects and Personal Data Processed

ARK PRES may collect or process personal data relating to:

(i) customers, subcontractors, suppliers, business contacts and potential customers (and/or natural persons associated with them), and other business partners;

(ii) natural persons whose personal data is obtained in the course of professional services provided to customers (for example, customers’ employees, customers, suppliers and their references);

(iii) ARK PRES employees, employees’ family members, job applicants and their references;

(iv) visitors to the website and social media followers; and

(v) third parties.

The personal data collected by ARK PRES may vary according to the commercial and legal relationship between the Data Subject and ARK PRES. Nevertheless, personal data such as identity, contact and financial information, special categories of personal data, educational and visual data, and information on family members and relatives is processed by ARK PRES for specified purposes in a manner that is relevant, limited, proportionate and, where necessary, up to date, in accordance with the conditions set out in Articles 5 and 6 of KVKK.

1. Data Controller

Acting as the data controller, ARK PRES may process, record, retain, reorganize and transfer your personal data within Türkiye to the extent permitted by KVKK and in the context of our commercial or business relationships, obtaining the Data Subject’s explicit consent where required.

In accordance with Article 12 of KVKK, ARK PRES, as data controller, takes the necessary technical and administrative measures and performs or commissions the necessary audits to ensure an appropriate level of security, prevent unlawful processing of and access to personal data, and ensure its safekeeping.

1. Implementation of the Policy and Applicable Legislation

The provisions of applicable legislation shall take precedence in the processing and protection of personal data. In the event of a conflict between legal provisions and this Policy, ARK PRES acknowledges that the current provisions of applicable legislation shall prevail.

The Policy has been prepared by organizing ARK PRES practices in accordance with the rules established by relevant legislation. ARK PRES maintains the necessary systems and preparations to comply with the implementation periods stipulated by KVKK.

1. Principles Governing the Processing of Personal Data

ARK PRES processes personal data in accordance with the procedures and principles set out in KVKK and other applicable laws.

In accordance with Article 4 of KVKK, ARK PRES, as data controller, complies with the following principles when processing personal data:

(i) Lawfulness and Fairness: Personal data is processed lawfully and fairly. Accordingly, ARK PRES, as data controller, complies with applicable legislation and the principle of good faith in all personal data processing activities.

(ii) Ensuring Accuracy and Keeping Data Up to Date Where Necessary: Data controllers must establish the necessary processes to ensure that the personal data they process is accurate and up to date. ARK PRES provides Data Subjects with opportunities to update their data and takes the necessary measures to ensure its accurate transfer to databases.

(iii) Processing for Specified, Explicit and Legitimate Purposes: Data controllers must inform Data Subjects of the purposes for which their personal data is processed in accordance with their information obligations under KVKK. Accordingly, ARK PRES limits its data processing activities to specified and legitimate purposes and clearly informs Data Subjects of those purposes through privacy notices.

(iv) Relevance, Limitation and Proportionality to the Processing Purpose: ARK PRES processes personal data only to the extent necessary for, and in connection with, the purposes communicated to Data Subjects when the data was collected.

(v) Retention for the Period Stipulated by Relevant Legislation or Necessary for the Processing Purpose: ARK PRES retains personal data only for the period stipulated by applicable legislation or necessary for the purposes of processing. It first determines whether applicable legislation prescribes a retention period and complies with that period where specified. Otherwise, it retains personal data for the period necessary for the processing purpose. Upon expiry of the period or cessation of the grounds requiring processing, personal data is deleted or destroyed by ARK PRES.

Under Article 5 of KVKK, personal data may not be processed without the Data Subject’s explicit consent; however, paragraph 2 of that Article sets out certain circumstances in which processing is permitted without explicit consent. ARK PRES may carry out data processing and transfer activities without obtaining explicit consent under Article 5(2) of KVKK in the following cases:

(i) Where expressly provided for by law;

(ii) Where necessary to protect the life or physical integrity of a person who is unable to express consent due to factual impossibility, or whose consent is not legally valid, or of another person;

(iii) Where processing personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract;

(iv) Where necessary for the data controller to fulfill its legal obligations;

(v) Where the data has been made public by the Data Subject;

(vi) Where processing is necessary for the establishment, exercise or protection of a right; and

(vii) Where processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the Data Subject.

1. Processing of Special Categories of Personal Data

KVKK affords special importance to certain categories of personal data because their unlawful processing may cause victimization or discrimination. These categories include data concerning race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

ARK PRES handles such data, whose unlawful processing could adversely affect individuals, with particular care and may process it without the Data Subject’s explicit consent in accordance with Article 6(3) of KVKK, provided adequate safeguards determined by the Board are taken (or by obtaining the Data Subject’s explicit consent where required).

Accordingly, ARK PRES diligently applies the technical and administrative measures taken to protect personal data to special categories of personal data as well, and performs the necessary internal audits.

1. Recording Media

1. Methods of Collecting Personal Data and Legal Grounds

ARK PRES may collect or obtain personal data because it is provided to the Company by third parties, because an individual connects to the ARK PRES Wi-Fi network, through the Company’s website or social media accounts, or because the data is publicly available.

Personal data held by ARK PRES is processed and retained for the periods prescribed under the applicable legislation, including KVKK, the Regulation on the Deletion, Destruction or Anonymization of Personal Data (the “Regulation”), Turkish Commercial Code No. 6102, Turkish Code of Obligations No. 6098, Labor Law No. 4857, Social Insurance and Universal Health Insurance Law No. 5510, Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed Through Such Publications, Law No. 6361 on Occupational Health and Safety, Tax Procedure Law No. 213, Right to Information Law No. 4982, the Regulation on Health and Safety Measures to Be Taken in Workplace Buildings and Annexes, the Regulation on Archival Services, and secondary legislation issued under these laws.

In order to comply with legal requirements, perform contractual obligations, pursue the legitimate interests of ARK PRES and fulfill the other purposes and grounds described below, ARK PRES may collect personal data requested from Data Subjects or shared directly by them, using automated or non-automated methods and sources, and may retain such data for legally permitted periods:

(i) Communications between all service units of ARK PRES and Data Subjects;

(ii) Applications submitted verbally, in writing or electronically to ARK PRES;

(iii) Third parties and organizations with which ARK PRES has close relationships;

(iv) Meetings and congresses;

(v) Public institutions;

(vi) Online applications, SMS channels and social media;

(vii) Other companies from which support services are received;

(viii) Natural and/or legal persons with whom ARK PRES conducts transactions under any legislation or agreement; and

(ix) Publicly available data.

1. Explanations Regarding the Retention and Destruction of Personal Data

Personal data belonging to employees, job applicants, visitors, customers, employees of client institutions or organizations, and third parties providing services (such as suppliers and subcontractors and their representatives) is retained and destroyed by ARK PRES in accordance with the Law.

Detailed explanations regarding retention and destruction are provided below in order.

1. Explanations Regarding Retention

Article 3 of KVKK defines the concept of processing personal data. Article 4 provides that the personal data processed must be relevant, limited and proportionate to the purposes for which it is processed and retained for the period stipulated by the relevant legislation or necessary for those purposes. Articles 5 and 6 set out the conditions for processing personal data.

Accordingly, in the course of ARK PRES activities, personal data is retained for the periods stipulated in the relevant legislation or appropriate to our processing purposes.

ARK PRES retains personal data processed within the scope of its activities for the following purposes:

(i) Managing human resources processes;

(ii) Ensuring corporate communication;

(iii) Ensuring Company security;

(iv) Conducting statistical studies;

(v) Carrying out operations and transactions arising from signed commercial and other contracts and protocols;

(vi) Fulfilling legal obligations as required or mandated by legal regulations;

(vii) Maintaining contact with natural and legal persons who have business relationships with ARK PRES;

(viii) Preparing legally required reports; and

(ix) Meeting evidentiary obligations in legal disputes that may arise in the future.

2. Explanations Regarding Destruction

Personal data shall be deleted, destroyed or anonymized by ARK PRES, upon the request of the Data Subject or ex officio, in the following circumstances:

(i) Amendment or repeal of the relevant legislative provisions forming the basis for processing;

(ii) Cessation of the purpose requiring processing or retention;

(iii) Withdrawal of explicit consent by the Data Subject where processing is based solely on explicit consent;

(iv) Acceptance by the Authority of the Data Subject’s application for deletion or destruction of personal data within the scope of their rights under Article 11 of KVKK;

(v) Where ARK PRES rejects a Data Subject’s request for deletion, destruction or anonymization of personal data, the Data Subject considers the response insufficient, or ARK PRES fails to respond within the period specified by KVKK, and the Data Subject lodges a complaint with the Board which the Board finds justified; and

(vi) Expiry of the maximum period requiring retention of personal data, where no circumstances justify retaining the data for a longer period.

1. Measures Taken to Protect Personal Data

The Company takes technical and administrative measures to ensure the secure retention of personal data, prevent unlawful processing of and access to such data, and ensure lawful destruction of personal data.

1. Technical Measures

ARK PRES regularly audits the personal data it processes and its data processing activities through the technical systems established within the Company. Relevant departments operate in technical fields, and specialized staff are employed. New technological developments, particularly developments in cybersecurity systems, are monitored and systems updated accordingly. Particular attention is paid to access and authorization: the permissions of existing employees are reviewed and adjusted, while former employees’ access is restricted and their accounts closed. Software incorporating antivirus systems and firewalls is used. Potential shortcomings identified during audit activities are addressed.

2. Administrative Measures

ARK PRES fulfills the requirements of KVKK and secondary legislation through this Policy and its personal data documentation, including the [personal data inventory]. In this context, ARK PRES establishes corporate procedures, incorporates data security provisions into contracts in its capacity as data controller, and obtains confidentiality undertakings to strengthen data security. Before beginning personal data processing, ARK PRES fulfills its obligation to inform Data Subjects. The Company conducts periodic and, at times, unannounced internal audits and identifies risks through risk analyses. It establishes an internal culture of personal data protection and provides information security training and awareness activities to all staff, from management with access to personal data to other employees. A disciplinary procedure has also been established for employees who fail to comply with security policies and procedures.

3. Measures Regarding Special Categories of Personal Data

ARK PRES also treats the protection of special categories of personal data referred to in Article 6(1) of KVKK with particular sensitivity. In this context, ARK PRES implements technical and administrative measures to protect personal data, taking into account the minimum measures determined by the Board for special categories of personal data.

L. Deletion, Destruction and Anonymization of Personal Data by ARK PRES

Under Article 138 of the Turkish Criminal Code and Article 7 of KVKK, where the grounds requiring processing cease to exist, even though personal data has been processed lawfully, the data is deleted, anonymized or destroyed by ARK PRES either on its own initiative or upon the request of the Data Subject. This Policy has been prepared for that purpose.

ARK PRES reserves the right not to fulfill a Data Subject’s request where it has the right and/or obligation to retain personal data under applicable legislation.

Where personal data is processed by non-automated means as part of a data recording system, deletion or destruction involves physically destroying such data in a manner that prevents subsequent use. Where ARK PRES engages a person or organization to process personal data on its behalf, such person or organization securely deletes the data so that it cannot be recovered.

ARK PRES may anonymize lawfully processed personal data when the grounds requiring its processing cease to exist.

The anonymization techniques most commonly used by ARK PRES are listed below:

1. Retention and Destruction Periods

The periods for which ARK PRES is required to retain the personal data it processes or will process, and the periods after which it will destroy such data, are specified in the table below:

The periodic destruction interval is set at 6 months pursuant to Article 11 of the Regulation. Accordingly, ARK PRES destroys personal data within 6 months after expiry of the retention period specified in the Personal Data Inventory.

N. Persons Involved in Personal Data Retention and Destruction Processes and Their Duties

The personnel involved in the personal data retention and destruction processes of ARK PRES and their duties and responsibilities are as follows:

O. Transfer of Personal Data

1. Transfer of Personal Data Within Türkiye

ARK PRES is responsible for ensuring that transfers of personal data comply with KVKK, decisions adopted by the Board and applicable regulations.

Personal data and special categories of personal data relating to Data Subjects may not be transferred by ARK PRES to other natural or legal persons without the Data Subject’s explicit consent. However, in circumstances required by KVKK and other laws, where the conditions specified in Article 5(2) and Article 6(3) of KVKK are met, such data may be transferred without explicit consent to authorized administrative or judicial bodies, within the limits prescribed by legislation.

Furthermore, provided that KVKK and other relevant legislation are complied with and the security measures specified in regulations are taken, the Company may transfer personal data to third parties in Türkiye unless otherwise stipulated by law, applicable legislation or a contract signed with the Data Controller, obtaining the Data Subject’s consent where required.

2. Institutions and Organizations to Which Data Is Transferred

Information requested by public legal entities under their applicable legislation is shared in accordance with Article 8 of KVKK.

P. Data Security

In accordance with Article 12 of KVKK, ARK PRES ensures that appropriate technological and organizational controls are in place to prevent the loss, misuse, accidental destruction and alteration of personal data.

Personnel of ARK PRES who have access to personal data have received the necessary training to safeguard its confidentiality. Personnel authorized to access personal data are permitted to do so only to the extent needed to properly perform their duties. Individuals with access to personal data are also subject to strict professional confidentiality rules.

Our security safeguards are regularly monitored and tested to ensure their effectiveness against emerging threats.

Q. Rights of the Data Subject

All natural persons whose personal data is processed by ARK PRES have the following rights by applying to ARK PRES at info@arkpres.com:

(i) To learn whether their personal data has been processed;

(ii) To request information if their personal data has been processed;

(iii) To learn the purpose of processing their personal data and whether it is being used in accordance with that purpose;

(iv) To know the third parties to whom their personal data has been transferred in Türkiye or abroad;

(v) To request correction of their personal data if it has been processed incompletely or inaccurately;

(vi) To request the deletion or destruction of their personal data where the grounds requiring processing cease to exist, even if it has been processed in accordance with Article 7 of KVKK;

(vii) To request notification to third parties to whom their personal data has been transferred of the correction, deletion, destruction or anonymization of such data;

(viii) To object to a result arising against them as a consequence of the analysis and processing of personal data exclusively by automated systems; and

(ix) To request compensation for damages incurred as a result of the unlawful processing of personal data.

Under Article 28 of Personal Data Protection Law No. 6698, entitled “Exceptions,” the provisions of the Law do not apply in the following cases, and therefore Data Subjects cannot assert rights under the Law on the basis of these circumstances:

(i) Processing of personal data by natural persons within the scope of activities relating exclusively to themselves or family members living in the same household, provided that such data is not disclosed to third parties and data security obligations are observed;

(ii) Processing of personal data for purposes such as research, planning and statistics by rendering it anonymous through official statistics;

(iii) Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public security, public order, economic security, privacy or personality rights, or constitute a crime;

(iv) Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations granted duties and powers by law to safeguard national defense, national security, public security, public order or economic security;

(v) Processing of personal data by judicial authorities or enforcement authorities in connection with investigations, prosecutions, judicial proceedings or execution procedures.

Furthermore, under Article 28(2) of KVKK, Data Subjects cannot exercise the rights listed in Article 11 of KVKK, except for the right to request compensation for damages, in the following circumstances:

(i) Where processing personal data is necessary for the prevention of a crime or a criminal investigation;

(ii) Where the personal data has been made public by the Data Subject;

(iii) Where processing is necessary for the performance of supervisory or regulatory duties or disciplinary investigations or prosecutions by duly authorized public institutions and organizations and professional organizations having the status of public institutions, on the basis of authority granted by law; and

(iv) Where processing is necessary to protect the State’s economic and financial interests in relation to budgetary, taxation and financial matters.

Pursuant to KVKK or the relevant secondary legislation, Data Subjects may send requests concerning the rights listed above to info@arkpres.com with the subject line “Personal Data Application Petition.” When submitting such applications, Data Subjects may use the email address previously provided to ARK PRES and currently registered in its systems, or an electronic or mobile signature as defined under Electronic Signature Law No. 5070.

Alternatively, Data Subjects may deliver their application petitions bearing a wet-ink signature to Köseköy Mah. Çuhane Cad. No:128 Kartepe/Kocaeli, or send electronically signed petitions to info@arkpres.com.

In order for third parties to submit an application on behalf of a Data Subject, they must hold a special power of attorney issued by a notary public in their name by the Data Subject.

1. AMENDMENT, UPDATE AND REPEAL

Our Company reserves the right to amend its Personal Data Protection and Processing Policy.

If this Policy is amended, including but not limited to amendments to comply with newly effective legal requirements, the most recent version of the relevant text will be published on our website.