Personal Data Protection Law - Privacy Notice

1. Identity of the Data Controller
   As Ahşap Ürün Sanayi A.Ş. ("Company"), in accordance with the Constitution of the Republic of Turkey, Law No. 6698 on the Protection of Personal Data ("KVKK" or "Law") and its secondary regulations, we are fully aware that the protection of your personal data is a fundamental right. In accordance with our obligation to inform you, we hereby provide the following information.
2. Personal Data Processed and Processing Purposes
   As a company, we process the identity and contact data, bank account information, and invoice details of employees/authorized persons of customer companies to which we provide products and services. These are processed for the purposes of carrying out product/service production, operations, sales, post-sales support, logistics activities, handling customer complaints and requests, business operations/monitoring, and managing customer relations.

We also process the identity, contact, and personal data of employees/authorized persons of subcontractors/suppliers/customs consultancy companies from whom we benefit within the scope of our activities. These are processed for the purposes of managing contract processes, conducting operations, production, sales, and post-sales follow-up of the products and services we offer, carrying out financial and accounting processes, fulfilling obligations arising from employment contracts and relevant regulations, and conducting audit/ethical activities.

For job applicants to our company, we process the identity and contact details of the references they provide during their application process. These are used for reference checks and managing the application process. After hiring, we process the identity and contact information of family members provided by employees, in order to manage emergency response processes, conduct human resources activities, fulfill employment contract obligations, and manage employee benefits and entitlements.

If visiting our company's premises, we process security camera footage and vehicle plate data recorded by our camera systems for the purpose of ensuring physical security and managing emergency response processes.

When visiting our website, identity and contact information are processed through cookie records and contact form submissions. This data is processed solely for the purposes of operating our website, as outlined in our cookie policy, and for continuing communication activities.

These personal data are destroyed, deleted, or anonymized through one of these methods in accordance with the KVKK and relevant legislation when the reasons for processing no longer exist, in compliance with our company’s data retention and destruction policy.

1. Transfer of Personal Data and Purpose of Transfer
   The personal data of individuals specified in Article 1 of this Privacy Notice may be transferred to authorized public institutions and organizations, as well as to our partners/subcontractors/suppliers with whom we cooperate, in accordance with the purposes for processing outlined above and within the framework of the security and confidentiality principles set forth in the KVKK. Adequate security measures will be taken during the transfer process.
2. Method of Collecting Personal Data and Legal Basis
   The personal data we process within our company is collected either automatically or non-automatically through verbal and written notifications made by employees, job candidates, or the data subject themselves, as well as via security camera recordings. The legal grounds for processing personal data are based on:

• "The necessity of processing personal data directly related to the establishment or performance of a contract" as stated in Article 5 of the Law,
• "Processing personal data for the legitimate interests of the data controller, provided that it does not violate the fundamental rights and freedoms of the data subject,"
• "As required by law,"
• "The necessity of processing personal data for the fulfillment of the legal obligations of the data controller."

1. Rights of the Data Subject Regarding the Protection of Personal Data
   You can submit your requests under Article 11 of the Law, which regulates the rights of data subjects, in writing to our address at Emek Mahallesi Sivat Caddesi No:7 Sancaktepe/Istanbul. Alternatively, you may send them via notarial mail or registered return receipt, or via our secure electronic mail (KEP) address ahsap@hs01.kep.tr if you have a KEP address. You may also use your previously notified email address in our system or send them to info@ahsap.com.tr using a secure electronic signature or mobile signature. We will respond to your requests in accordance with the relevant regulation, within a maximum of thirty days.