Personal Data Protection

Clarification Text on Personal Data Processing

a) Data Controller and Representative
In accordance with the Law No. 6698 On The Protection of Personal Data (“KVK Law”), your personal data may be processed by Demir Export Anonim Şirketi (“Company”) as the data controller within the scope described below.

b) The Purposes of Data Processing
Your collected personal data will be processed in accordance with the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVK Law for the purposes of ensuring the legal and commercial security of our Company and the third parties who have a business relationship with our Company, determining and implementing our Company's commercial and business strategies, and ensuring the execution of our Company's human resources policies.

c) The Recipients of the Processed Data and the Grounds for Data Transfer
Your collected personal data may be transferred to our business partners, suppliers, Koç Group companies, shareholders, legally authorized public institutions and private individuals within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the KVK Law for the purposes of ensuring the legal and commercial security of our Company and the third parties who have a business relationship with our Company, determining and implementing our Company's commercial and business strategies, and ensuring the execution of our Company's human resources policies.

ç) The Method Used in the Collection of Personal Data and the Legal Reason for Collecting Personal Data
Your personal data is collected by our Company through different channels and based on different legal reasons to carry out our commercial activities. Your personal data collected for the said legal reason can also be processed and transferred for the purposes specified in articles (b) and (c) of this text, within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVK Law.

d) The Rights of the Personal Data Owner Enumerated in Article 11 of the KVK Law
As personal data owners, if you submit your requests regarding your rights to our Company through the methods set out below in this Clarification Text, our Company will process your request free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, in the event that a fee is stipulated to process the request in question by the Personal Data Protection Board, the fee in the tariff determined by our Company will be charged. In this context, personal data owners have the right to:

• learn whether his/her personal data has been processed,
• if processed, to request information on the processing of his/her personal data,
• learn the purpose of processing his/her personal data and whether his/her personal data are used in accordance with this purpose
• get information about the third parties to whom his/her personal data has been transferred inside the country or abroad,
• request correction of his/her personal data in the event that his/her personal data have been processed incompletely or incorrectly, and notification of the correction made within this scope to the third parties to whom his/her personal data has been transferred,
• request the deletion or destruction of his/her personal data in the event that the reasons requiring the processing of his/her personal data are eliminated, regardless of whether his/her personal data have been processed in accordance with the provisions of the KVK Law and other relevant laws, and the notification of the deletion or destruction made within this scope to the third parties to whom his/her personal data has been transferred,
• appeal to the emergence of a result against the original owner of the personal data through analyzing the processed data exclusively through automated systems, and
• request the compensation of any damages that might incur due to unlawful processing of personal data.