Personal Data Protection Law

Dear Customers, Business Partners, Visitors, Candidate Employees, and Employees; As Kenan Metal A.Ş. (“KENAN METAL” or the “Company”), we value the security of your personal data. Pursuant to the Law No. 6698 on the Protection of Personal Data (“KVKK”), in our capacity as the “data controller”, we would like to inform you about your personal data and the processing operations.

This Policy aims to ensure the sustainability of the Company's “principle of conducting company activities in transparency.” In this context, the fundamental principles adopted by the Company regarding the compliance of its data processing activities with the regulations in Law No. 6698 on the Protection of Personal Data (“Law” or “KVKK”) are determined, and the practices carried out by the Company are explained.

The Company reserves the right to make changes to the Policy in line with legal regulations.

DEFINITIONS

YOUR PERSONAL DATA WE PROCESS

Depending on the relationship between you and KENAN METAL, the following categories of your data may be processed:

1. Identity Information: This data category includes data types such as Name-Surname, T.C. Identification Number, Tax Identification Number, place and date of birth, marital status, gender, and copy of identity document.
2. Contact Information: This data category includes data types such as address, phone number, email address, fax number, and IP address.
3. Special Categories of Personal Data: This data category includes data types such as (i) health data collected from personnel within the scope of personnel file and occupational safety, (ii) biometric data consisting of fingerprints or facial recognition, (iii) criminal records regarding criminal convictions.
4. Visual and Audio Information: This data category includes images of individuals in camera recordings made for security purposes in physical spaces of KENAN METAL and voice recordings captured during call center calls.
5. Personnel File Information: This data category includes identity, contact, profession, education, and financial information included in the personnel file required to be legally established within the framework of the employment contract.
6. Contract Information: This data category includes data types such as signature, signature circulars, and real person company details belonging to real persons such as officials and personnel of business partners, suppliers, and external resources with whom KENAN METAL has a legal or commercial relationship.
7. Financial Information: This data category includes personal data processed regarding information, documents, and records showing all kinds of financial results created according to the type of legal relationship established between KENAN METAL and the Data Subject, as well as bank account numbers and IBAN numbers.
8. Location Information: This data category includes location data of employees processed by KENAN METAL for internal auditing purposes.
9. Performance Information: This data category includes data processed internally for personnel and externally for performance auditing of business partners to increase operational efficiency and internal controls.

DATA SUBJECT CATEGORIES

COLLECTION METHOD AND LEGAL REASON FOR YOUR PERSONAL DATA

Within the scope of the commercial and/or contractual relationship between you and KENAN METAL, based on the legal grounds stated under Paragraph 2 of Article 5 and subsequent provisions of Law No. 6698, or in the absence of such grounds, based on your explicit consent; your Personal Data is collected directly from you (via contracts, order forms, quote requests or forms, email correspondence, business card exchanges, recruitment processes, workplace visits, and shares by our business partners) and processed by KENAN METAL. During your visits to our workplaces, your identity information and security camera footage are recorded for security reasons and processed strictly limited to this operation.

PURPOSES OF PROCESSING PERSONAL DATA

Your Personal Data is processed within the scope of the following purposes:

a. For Customers:

Due to its corporate structure, KENAN METAL conducts data processing activities pursuant to purchase and sale relationships established with real or legal entity customers regarding products manufactured across various sectors, for the following purposes:

• Execution of Goods/Service Purchase Processes
• Execution of Goods/Service Sales Processes
• Execution of Customer Relationship Management Processes
• Ensuring Physical Space Security
• Conducting transactions and activities within the scope of commercial/contractual relationships and fulfilling financial and legal obligations
• Follow-up of Requests/Complaints
• Fulfillment of legal obligations
• Execution of legal processes
• Promotion and marketing activities
• Execution of Communication Activities

b. For Potential Customers:

Your identity and contact information obtained directly from you through requests for orders and price quotes, business cards shared at exhibition areas or events (data on business cards is deemed public); is processed pursuant to Article 5/2 of the Law for creating quotes for requested products, establishing contracts, and managing your requests and complaints.

c. For Employee Candidates:

KENAN METAL processes your personal data obtained through CVs submitted or application forms filled out within the scope of job applications, based on the establishment and execution of our contracts and the legitimate interests of our company as specified in Article 5 of the Law, for the following purposes:

• Execution of Candidate Employee / Intern / Student Selection and Placement Processes
• Execution of Application Processes of Candidate Employees
• Execution of Human Resources Operations, especially Recruitment Processes
• Execution of Employee Satisfaction and Loyalty Processes
• Execution of Business Continuity Activities and Ensuring Physical Space Security

d. For Employees:

KENAN METAL processes your personal data for the purpose of creating personnel files originating from relevant legislation, entering into employment contracts with you, and within the scope of KENAN METAL's legitimate interest, for the following purposes:

• Execution of Information Security Processes
• Execution of Employee Satisfaction and Loyalty Processes
• Fulfillment of Obligations Arising from Employment Contracts and Legislation for Employees
• Execution of Fringe Benefits and Benefits Processes for Employees
• Execution of Audit / Ethics Activities
• Execution of Activities in Accordance with Legislation
• Execution of Finance and Accounting Affairs
• Ensuring Physical Space Security
• Follow-up and Execution of Legal Affairs
• Planning of Human Resources Processes
• Execution / Audit of Business Activities
• Execution of Occupational Health / Safety Activities
• Execution of Performance Evaluation Processes
• Providing Information to Authorized Persons, Institutions, and Organizations
• Execution of Management Activities
• Making Necessary Legal Notifications to Public Institutions, Benefiting from Incentives Before Public Institutions, and Making Notifications to Relevant Authorities within Audits
• Execution of Human Resources Operations, especially Personnel File Activities
• Ensuring Employee Supervision and Carrying Out Necessary Data Processing within the Scope of Employer's Management Rights

e. For Suppliers / Business Partners:

KENAN METAL carries out data processing activities regarding personal data belonging to your company officials, partners, and employees within the commercial relationship, in accordance with the fundamental principles and personal data processing conditions provided in the Law, under the scope of establishing and executing contracts, fulfilling legal obligations, and legitimate interests of our company, for the following purposes:

• Execution of Contract Processes
• Execution of Finance and Accounting Affairs
• Execution and Follow-up of Responsibilities and Legal Processes Arising from Legislation
• Execution of Internal Company Operations
• Strategy Planning and Business Partner / Supplier Management
• Ensuring Physical Space Security
• Execution of Logistics Activities
• Management of Supply Chain Management Processes
• Retention of your information required to be stored pursuant to relevant legislation; copying and backing up to prevent data loss; ensuring consistency of your information; taking necessary technical and administrative measures for the security of our databases and information

f. For Visitors:

During your visits to our company, website, and other workplaces, in addition to ensuring safety for our company and you, fulfilling our legal obligations and depending on our legitimate interests, visual data captured via security cameras in physical environments and identity data for visitor records are processed for the following purposes:

• Execution of Audit and Security Activities
• Execution of Information Security Processes
• Creation and Follow-up of Visitor Records
• Ensuring Physical Space Security
• Ensuring the Security of Data Controller Operations

PARTIES TO WHICH PERSONAL DATA IS TRANSFERRED AND PURPOSES OF TRANSFER

KENAN METAL may transfer your personal data to the following domestic recipient groups in accordance with the law and relevant legislation for the purposes specified under this policy:

• To our suppliers and business partners worked with for providing or delivering goods and services to you,
• To business partners, supplier companies, banks, and financial institutions collaborated with and/or service obtained from for purposes such as presentation and promotion of goods,
• To lawyers, auditors, consultants, and service-providing firms,
• To your authorized proxies, guardians, and representatives,
• To regulatory and supervisory authorities, courts, and enforcement offices authorized to request your personal data, and to persons designated by them.

SPECIAL CATEGORIES OF PERSONAL DATA

Special categories of personal data are data that, if learned, may cause discrimination or victimization of the data subject. Therefore, they must be protected much more strictly compared to other personal data. Special categories of personal data can only be processed with the explicit consent of the data subject or in limited cases specified by law.

RIGHTS ENUMERATED IN ARTICLE 11 OF THE LAW

• To learn whether your personal data is processed,
• To request information if your personal data has been processed,
• To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
• To know the third parties to whom your personal data is transferred domestically or abroad,
• To request correction of personal data if it is incomplete or incorrectly processed,
• To request the deletion or destruction of your personal data within the framework of conditions stipulated in KVKK legislation,
• To request notification of operations carried out pursuant to Articles 5 and 6 to third parties to whom personal data has been transferred,
• To object to the occurrence of a result against you by analyzing the processed data exclusively through automated systems,
• To demand compensation for damages in case you suffer damage due to unlawful processing of personal data.

DESTRUCTION OF PERSONAL DATA

KENAN METAL has prepared and published an Destruction Policy within the company that establishes procedures for personal data destruction. All destruction processes are carried out in compliance with this policy. Pursuant to Article 7 of the Law, despite having been processed in accordance with the law, if the reasons requiring processing cease to exist, personal data shall be destroyed ex officio or upon the request of the data subject in accordance with legislation and guidelines published by the Board.

MATTERS REGARDING THE PROTECTION OF PERSONAL DATA

In accordance with Article 12 of the KVKK Law, KENAN METAL takes necessary technical and administrative measures to ensure an appropriate level of security to prevent unlawful processing of personal data, prevent unlawful access to data, and ensure data retention, and conducts or commissions necessary audits within this scope. KENAN METAL implements technical and administrative measures according to technological possibilities and implementation costs to ensure lawful processing of personal data.

TECHNICAL MEASURES

The main technical measures taken by KENAN METAL to ensure lawful processing of personal data are listed below:

• Personal data processing activities carried out within KENAN METAL are regularly audited.
• Technical measures taken are periodically reported to relevant authorities in line with internal control mechanisms.
• Departments specialized in technical matters have been established, and knowledgeable personnel are employed.
• New technological developments are followed and technical measures are implemented on systems, especially in cybersecurity, and measures taken are periodically updated and renewed.
• Access and authorization solutions are implemented within the framework of legal compliance requirements determined specifically for each department within KENAN METAL.
• Access authorizations are restricted, and authorizations are regularly reviewed. Access restrictions are applied to former employees, and accounts are closed.
• Technical measures taken in accordance with internal workflows of KENAN METAL are reported to relevant users, and risky issues are re-evaluated to produce necessary technological solutions.
• Software and hardware including antivirus protection systems, data vulnerability safety systems, and firewalls are established.
• Personnel specialized in technical fields are employed.
• All information systems, including applications where personal data is collected, are regularly subjected to external penetration tests to identify security vulnerabilities, and identified gaps are closed according to test results.

ADMINISTRATIVE MEASURES

Administrative measures taken by KENAN METAL for lawful processing of personal data:

• KENAN METAL employees, dealer, and authorized service staff are informed and trained on personal data protection law and lawful processing of personal data.
• All personal data processing activities carried out by KENAN METAL are conducted in accordance with the personal data inventory and its annexes created through detailed analysis of all business units.
• Obligations to be fulfilled to ensure compliance of personal data processing activities carried out by relevant departments within KENAN METAL with KVKK criteria have been bound to written policies and procedures by KENAN METAL, each business unit has been informed, and specific points requiring attention have been determined per activity.
• Audit and management regarding personal data security of departments within KENAN METAL are organized by Information Security Committees. Awareness is created to meet legal requirements per business unit, and necessary administrative measures are implemented via internal policies, procedures, and training to ensure continuous application and oversight.
• Provisions including information on personal data and data security are included in employment contracts and related documentation between KENAN METAL and employees, and additional protocols are executed. Awareness activities have been conducted for employees in this regard.
• Legal compliance, internal access to personal data, and authorization processes are implemented considering personal data processing workflows for each department within KENAN METAL.

CONTACT

You may submit your requests regarding your rights under the KVKK mentioned above to KENAN METAL in writing with a wet signature by hand or via registered mail with return receipt to KENAN METAL's postal address written below, or electronically via email to [email protected].

In the event that data subjects (relevant persons) submit their requests regarding personal data in writing to our Company, our Company, in its capacity as data controller, conducts necessary processes to ensure finalization as soon as possible and within thirty (30) days at the latest, depending on the nature of the request, in accordance with Article 13 of the KVK Law.

Within the scope of ensuring data security, the Company may request information to determine whether the applicant is the owner of the personal data subject to the application. Our Company may also direct questions regarding the application to the relevant person to ensure that the application is concluded in accordance with the request.

The application of the data subject may be rejected with justification explained in cases where it risks interfering with rights and freedoms of others, requires disproportionate effort, or the information is publicly available.

Kenan Metal A.Ş.
ADDRESS: İ.O.S.B. İs-Dök San. Sit. 4. Blok No:14 Başakşehir / İstanbul
Mersis No: 0544057441000015
PHONE: +90 212 485 60 35