Personal Data Protection Notice

Data Controller

Company Name: OYAK TURKOMAN YATIRIM ANONİM ŞİRKETİ

Address: Koşuyolu Mahallesi Koşuyolu Caddesi no:31 Kadıköy/İSTANBUL

(The Data Controller shall be referred to as the “Company” within the scope of this Information Notice.)

Method of Collection of Your Personal Data and the Legal Grounds

Your personal data may be collected electronically, by automated or non-automated methods, through the affiliated units of the Company, social media channels, the software used in order to carry out activities within the company and similar means. Your personal data may be processed by being created and updated for as long as your relationship with the Company continues, and may be kept in both digital and physical media.

Your personal data may be processed and transferred in line with the purposes set out under the heading “Your Personal Data Processed and the Purposes of Processing”, and within the scope of the personal data processing conditions and purposes provided for by the fulfilment of the explicit consent condition under Article 5, paragraph 1 of Law No. 6698 or by subparagraphs “c, ç and e” of Article 5, paragraph 2.

Your Personal Data Processed and the Purposes of Processing

Your Personal Data is processed securely and in compliance with the Law on the Protection of Personal Data, as required by legal obligations or for the purpose of providing a more suitable service in the business and transactions of the company.

In this context, the data set out below is collected as personal data:

Identity: This is the data group containing information relating to the identity of a person. (Name, Surname)

Contact: This is the data group that may be used to reach a person. (E-mail address)

Transaction Security Data: This is the data group containing the digital traces arising as a result of the processing of information belonging to a person (IP address information, website entry and exit information, log records).

Your personal data collected will be processed for the purposes of;

• enabling the necessary work to be carried out by our relevant business units so that third-party natural or legal persons, institutions and organisations having a relationship with the Company (employees, visitors, suppliers, business partners, etc.) may benefit from the products and services of our Company and of the Head Office and units affiliated with our Company,

• fulfilling the legal and regulatory requirements arising or that may arise from all relevant laws and secondary regulations, and taking the necessary measures in this respect,

• carrying out the audit and regulatory duties to be performed by the competent and authorised public institutions and organisations and by professional organisations having the status of a public institution,

• fulfilling the requests for information and documents demanded by judicial bodies and administrative authorities,

• carrying out listing, reporting, verification and analysis work regarding the manner of use of the products and services offered by our Company and by all centres and units affiliated with the company, producing statistical and scientific information in this respect, and accordingly improving our products and services, increasing satisfaction with our products and services and making customisations relating to the user in this context,

• conducting market research, promotion and the necessary information activities regarding our products and services, being able to evaluate complaints and suggestions, and contacting you directly through the communication channels shared with the Company,

• taking all technical and administrative measures necessary for systems and applications within the scope of data security

and will be processed within the scope of the personal data processing conditions and purposes set out in Articles 5 and 6 of Law No. 6698.

To Whom and for What Purpose Your Processed Personal Data May Be Transferred

By ensuring that all necessary technical and administrative measures aimed at providing an appropriate level of security in accordance with the KVKK and the legislation are taken, your Personal Data/Personal Data may, in line with the purposes stated above, be transferred to;

·  persons/institutions and/or organisations permitted by the provisions of other relevant legislation

·  lawyers or attorney partnerships for the purpose of following up legal matters

·  our subsidiaries and/or affiliates

·  auditors

·  business partners

and to domestic/foreign organisations from which we receive services and/or to which we provide services on a contractual basis and with which we cooperate in order to carry out our activities, within the framework of the personal data processing conditions and purposes set out in Articles 8 and 9 of the KVK Law.

Data Processing Period and Retention Period

Your personal data will be processed, limited to the purposes stated in this Information Notice, in compliance with the data processing and statute of limitation periods set out in all relevant laws and other legal legislation to which our Company and the centres and units affiliated with our Company are subject. In the event that the data processing periods are amended by law, the newly determined periods shall apply.

As a requirement of the principle of purpose limitation, your personal data is processed only for the fulfilment of the purposes explained in this Information Notice and, in any event, limited to the period requiring its processing in accordance with the statutory periods, company practices and the customs of commercial life; once such periods expire, it is erased, destroyed or anonymised. Should you wish to obtain detailed information regarding the retention periods of your personal data, you may contact us via the addresses provided in the Contact section.

Rights of the Data Subject and the Exercise of These Rights

As a data subject, you may exercise the rights listed by submitting your requests within the scope of Article 11 of the Law, which regulates the rights of the data subject, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, in writing to the address “Koşuyolu Mahallesi Koşuyolu Caddesi no:31 Kadıköy/İSTANBUL”  or by transmitting them electronically to the e-mail address info@toi.com.tr (provided that your e-mail address is registered in the company systems). You may access the relevant application form on our corporate website.