PROTECTION OF PERSONAL DATA

GÜNAL GEMİ İNŞAAT MAK. NAK. VE SAN. TİC. LTD. ENLIGHTENMENT TEXT ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

We, as GÜNAL GEMİ İNŞAAT MAK.NAK.VE.SAN.TİC.LTD. ŞİRKETİ, would like to inform you that we have taken all legal, technical and administrative measures to protect your privacy by collecting, processing, transferring, erasing, destroying or anonymizing your personal data and/or personal data of special nature in compliance with Law No. 6698 on the Protection of Personal Data (LPPD), and enlighten you of the purpose for which your personal data will be processed, for what purpose and to whom it will be transferred, the method and legal reasons of data processing, and of your rights.

• 1. Data Controller

Your personal data and/or personal data of special nature may be recorded, stored, processed, classified, updated and disclosed/transferred to the third parties, permitted by the legislation and/or limited to the purposes for processing by GÜNAL GEMİ İNŞAAT MAK.NAK.VE.SAN.TİC.LTD. ŞİRKETİ, in the capacity of “Data Controller,” in compliance with the law and good faith under the following scope pursuant to Law No. 6698 on the Protection of Personal Data.

• 2. Collection, Processing of Personal Data and Processing Purposes

While your personal data and/or personal data of special nature may vary depending on your relationship with GÜNAL GEMİ İNŞAAT MAK.NAK.VE.SAN.TİC.LTD. ŞİRKETİ, they may be processed by being collected verbally, in writing, or electronically through automatic or non-automatic means, all units of the Company, corporate e-mail, portal and website as well as social media platforms, mobile applications and similar channels. Your personal data and/or personal data of special nature may be processed and transferred based on the information you have confirmed to be accurate within your relationship with the Company.

Your personal data and/or personal data of special nature may be collected, processed, updated, transferred and anonymized for research and development to provide our services and meet your personal preferences respect thereof, contact with you directly through the communication channels you have shared with us, for the promotions/advertisements/announcements/meetings/conferences/events/courses/development programs/exhibitions, the management of the projects in which the Company is either an executor or a stakeholder, the efficiency and service quality are implemented as a guiding principle during production within the Company, and continuance, the execution of company privacy policies, the management and improvement of the Company’s business processes and making use of such services within the scope of training activities; and

while your collected personal data and/or personal data of special nature; your credentials, contact details, educational and professional history, photos, health and financial data, SSI information, background, residence, and internet access through the company network, campus entrances and exits may vary depending on your relationship with GÜNAL GEMİ İNŞAAT MAK.NAK.VE.SAN.TİC.LTD. ŞİRKETİ as personnel, visitor, intern, employee candidate, project partner and business partner, they may be collected, processed, updated, transferred and anonymized for the following purposes:

2.1. Maintaining manufacturing operations and improving service quality, ensuring service continuity, listing, reporting, verification, analysis and assessments within the scope of reducing cost and workload, producing statistical and scientific information, assessment and success tracking, organizing and announcing events, courses, development programs, exhibitions, conferences and meetings by the Company in or out the campus,

2.2. Protecting and accomplishing the rights and obligations of workers, subcontractors and suppliers who work or receive services at departments within or outside the Company,

2.3. Informing and promoting on the business fields required for the Company’s business and service operations, as well as presenting proposals, in order to begin or continue the service and business relationship between the customer or supplier prospects and the COMPANY;

2.4. Safeguarding or complying with the rules in this respect for the life and property of all Company stakeholders (trainees/personnel/visitors) and third parties; fulfilling the legal obligations, requirements or requests of judicial bodies or authorized administrative bodies, taking necessary security and legal measures, transferring the data to the IT infrastructure to achieve these purposes, archiving in electronic or physical media for the purpose of fulfilling legal obligations,

2.5. Within the framework of the business processes developed in accordance with the Company’s business strategy; establishing and implementing corporate commercial and business strategies, managing internal system and application operations, as well as financial and legal operations, procurement operations, the commercial and legal assessment processes, legal and commercial risk analyses as well as the legal compliance process, running financial affairs, communication, market research and the social responsibility activities;

2.6. Under the Human Resources policies; executing operations, recruiting suitable personnel for open positions in accordance with the Company’s Human Resources policies, fulfilling obligations under Labour Law, Social Security Law and relevant legal regulations governing business life as well as the occupational health and safety, and taking necessary measures,

2.7. Fulfilling all rights and duties resulting from all natural and legal persons with whom the Company has contractual relationships, as well as their affiliates,

2.8. Using the information technology services (corporate email, corporate portal, corporate wireless network, corporate internet, etc.) provided by the Company.

• 3. To Whom and For What Purposes the Processed Data May Be Transferred

Your personal data processed and/or personal data of special nature; your credentials, contact details, educational and professional history, photos, health and financial data, SSI information, background, residence, and internet access through the company network, campus entrances and exits can be transferred to the founder, the board of directors, business partners, project partners, authorities such as the Social Security Institution and the Treasury, ministries, and legally-authorized public institutions like judicial authorities as well as the consultants, institutions, third parties, contracted institutions and payment systems institutions with which it cooperates, where permitted by the legislation, under the conditions and purposes of processing personal data specified in the 8th and the 9th Articles of Law No. 6698 to continue the service activities provided by GÜNAL GEMİ İNŞAAT MAK.NAK.VE.SAN.TİC.LTD. ŞİRKETİ, to develop policies and procedures for providing services, to plan educational programs, to carry out administrative and academic processes to ensure the continuity of the Company’s services, to ensure the legal and commercial security of real and legal persons in a business relationship with the COMPANY, to maintain physical security and keep things under control in and around the campus’s facilities and buildings, to manage legal compliance processes, execute monetary and financial duties, and develop and implement commercial and business plans.

• 4. The Method and Legal Reason of Collection of Personal Data

While your personal data processed and/or personal data of special nature may vary depending on your relationship with the COMPANY, they may be collected, processed and transferred in any verbal, written or electronic medium through direct or indirect means for the above purposes under the processing conditions and purposes stated in 5th and 6th Articles of the Law to provide the services of the COMPANY and to fulfil its responsibilities arising from the contract and the law completely and accurately together with the internal regulations (regulations, directives, policies and procedures) within the COMPANY.

• 5. Obligation of the Data Controller

5.1. Obligation to Inform

Whilst collecting personal data and/or personal data of special nature, the controller or the person authorised by him is obliged to inform the data subjects about the following: Whereas;

• the identity of the data controller and its representative, if any,
• the purpose of data processing,
• to whom and for what purposes the processed data may be transferred,
• the method and legal reason of collection of personal data
• other rights of the data subject referred to in 11th Article of Law.
• The data controller and/or person authorized by the data controller may fulfil the disclosure obligation by using physical or electronic media such as verbal, written, audio recording or call centre.

5.2. Obligations Concerning Data Security

Based on the 12th Article of Law No. 6698 on the Protection of Personal Data, GÜNAL GEMİ İNŞAAT MAK.NAK.VE.SAN.TİC.LTD. ŞİRKETİ, as the data controller, shall be obliged to take all necessary technical and administrative measures to provide a sufficient level of security in order to:

• a) prevent unlawful processing of personal data,
• b) prevent unlawful access to personal data,
• c) ensure the retention of personal data,
• d) The controller shall be obliged to conduct necessary inspections, or have them conducted in his own institution or organization, with the aim of implementing the provisions of this Law,
• e) In case the processed data are collected by other parties through unlawful methods, the Controller shall notify the data subject and the Board within the shortest time.

The controllers and processors shall not disclose the personal data that they learned to anyone in breach of this Law, neither shall they use such data for purposes other than processing. This obligation shall continue even after the end of their term.

5.3. Erasure, Destruction or Anonymization of Personal Data

Despite being processed under the provisions of Law No. 6698 and other related laws, the personal data shall be erased, destructed or anonymized by OUR COMPANY, the data controller, ex officio or upon demand by the data subject, upon the disappearance of reasons which require the process.

• 6. The Rights of the Data Subject Under the LPPD

If you, as personal data subjects, follow the below processes and means to make requests pertaining to your rights to OUR COMPANY under Law No. 6698 on the Protection of Personal Data, OUR COMPANY shall respond to and finalize your requests within thirty (30) days, depending on the nature of the request. However, if the process requires an additional cost, the tariff set by the Board may be charged. Based on the 11th Article of Law No. 6698 on the Protection of Personal Data, each person has the right to apply to the controller and

• 6.1. To learn whether his personal data are processed or not,
• 6.2. To request information if his personal data are processed,
• 6.3. To learn the purpose of your data processing and whether this data is used for intended purposes,
• 6.4. To know the third parties to whom his personal data is transferred at home or abroad,
• 6.5. . To request the rectification of the incomplete or inaccurate data, if any, and request notification of the operations carried out in respect thereof to third parties to whom his personal data has been transferred,
• 6.6. To request his personal data erased, destructed or anonymized by the controller, ex officio or upon demand by the data subject, upon the disappearance of reasons which require the process, despite being processed under the provisions of the Law and other related laws; to request notification of the operations carried out to third parties to whom his personal data has been transferred,
• 6.7. To object to the processing, exclusively by automatic means, of your personal data, which leads to an unfavourable consequence for the data subject,
• 6.8. To request compensation for the damage arising from the unlawful processing of your personal data.

The channels and procedures for submitting your application in accordance with the 11th Article of Law No. 6698 on the Protection of Personal Data are detailed below.

The following information must be available in the applications made by personal data subjects:

• Name, surname and signature if the application is written,
• For citizens of the Republic of Turkey, the Turkish identity number, the nationality for foreigners, passport number or, if any, identity number;
• Address for service or work address;
• E-mail address, phone and fax number for service, if any,
• Subject of request

Pursuant to Article 13(1) of the LPPD and the Communiqué on the Procedures and Principles of Application to Data Controller, you may send your request, including your explanations about the right you have requested to exercise, in writing or by mail to “Aydıntepe Mah. Sahil Bulvarı Alize İş Merkezi No:191/14 Tuzla/İstanbul” in person with your identification, or by using our corporate e-mail “info@gunalgemi” or by any other means specified in the Law No. 6698 on the Protection of Personal Data.