Privacy Notice

With respect to the personal data you share through the channels described herein, the Data Controller under Turkish Personal Data Protection Law No. 6698 (“KVKK”) is ENVAPLAS PLASTIC MACHINERY MANUFACTURING HARDWARE TRANSPORTATION IMPORT EXPORT ENERGY INDUSTRY AND TRADE LTD. CO., registered with the Ankara Trade Registry under registry number 17386 and MERSIS number 0336104906700001, with its address at EOSB, 23100 Organize Sanayi Bölgesi, 96. Sk. No:8, 23200 Elazığ Merkez/Elazığ, Türkiye.

Protection of personal data is primarily guaranteed by Article 20 of the Constitution of the Republic of Türkiye, entitled “Privacy of Private Life.” Within this scope, everyone has rights including being informed about personal data obtained, processed and stored about them, accessing such data, requesting correction or deletion, and learning whether the data is used in accordance with its intended purpose.

Personal data may only be processed in cases prescribed by law or with the explicit consent of the data subject. ENVAPLAS attaches the utmost importance to the lawful protection and processing of personal data.

Article 20 of the Constitution provides that the principles and procedures regarding personal data protection shall be regulated by law. Accordingly, Law No. 6698 on the Protection of Personal Data was published in the Official Gazette dated 7 April 2016 and numbered 29677.

Law No. 6698 was enacted to protect the fundamental rights and freedoms of individuals, particularly the privacy of private life, in the processing of personal data; to regulate the obligations, procedures and principles applicable to natural and legal persons processing personal data; and to define the statutory rights available to data subjects.

1. Explicit Consent: Consent relating to a specific subject, based on information and expressed with free will.
2. Anonymization: Irreversibly altering personal data so that it can no longer be associated with an identified or identifiable person.
3. Employee: Persons employed by the Company under an employment contract.
4. Employee Candidate: Natural persons who apply for employment with the Company or make their CV and related information available for review.
5. Natural Persons and Private-Law Legal Entities: Persons and organizations defined under the Turkish Civil Code and Turkish Commercial Code.
6. Publicly Available: A general group of persons without any special characteristic.
7. Shareholders: Natural or legal persons holding shares in the Data Controller’s company.
8. Business Partner: Parties with whom the Data Controller conducts commercial activities and maintains commercial relations.
9. Employees, Shareholders and Authorized Persons of Cooperating Institutions: Natural persons working for, owning shares in, or authorized by institutions with which the Company has a business relationship.
10. Affiliates and Subsidiaries: Companies in which the Data Controller holds an equity interest or over which it exercises direct or indirect control.
11. Processing of Personal Data: Any operation performed on personal data, including collection, recording, storage, retention, alteration, reorganization, disclosure, transfer, acquisition, classification or restriction of use.
12. Data Subject: The natural person whose personal data is processed.
13. Personal Data: Any information relating to an identified or identifiable natural person.
14. Customer: Natural persons who use or have used products and services offered by the Company.
15. Special Categories of Personal Data: Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, association/foundation/trade-union membership, health, sexual life, criminal convictions and security measures, biometric and genetic data.
16. Potential Customer: Natural persons who have shown or may reasonably be considered likely to show interest in the Company’s products or services.
17. Intern: Persons applying for an internship to put theoretical vocational knowledge into practice.
18. Company Shareholder: Natural persons holding shares in the Company.
19. Company Official: Board members and other authorized natural persons.
20. Supplier: Parties having a business relationship with the Company under service procurement and/or agency agreements.
21. Group Companies: Companies directly or indirectly controlled by a parent company within the meaning of the Turkish Commercial Code.
22. Third Party: Other natural persons related to the persons described herein for purposes such as protecting rights and ensuring transaction security.
23. Data Processor: A natural or legal person processing personal data on behalf of the Data Controller under its authority.
24. Data Controller: The person or organization determining the purposes and means of personal data processing and responsible for establishing and managing the data filing system.
25. Authorized Public Institutions and Organizations: Institutions and organizations legally authorized to request information and documents from the Data Controller.
26. Visitor: Natural persons visiting the Company’s physical premises or websites.

• KVKK: Turkish Law No. 6698 on the Protection of Personal Data dated 24 March 2016.
• Constitution: Constitution of the Republic of Türkiye.
• KVK Board: Personal Data Protection Board.
• KVK Authority: Personal Data Protection Authority.
• Policy: Company Policy on the Protection and Processing of Personal Data.
• TBK: Turkish Code of Obligations No. 6098.
• TCK: Turkish Criminal Code No. 5237.
• TTK: Turkish Commercial Code No. 6102.

The Company may record, process or transfer data falling within the following categories:

1. Identity: name and surname, parents’ names, date and place of birth, marital status, identity number, etc.
2. Contact: address, e-mail, registered electronic mail (KEP), telephone number, etc.
3. Location: location data.
4. Personnel: payroll, disciplinary records, employment entry/exit records, CV and performance information.
5. Legal Transactions: correspondence with judicial authorities and litigation-file information.
6. Customer Transactions: call records, invoices, promissory notes, checks, orders and requests.
7. Physical Premises Security: entry/exit and camera records.
8. Transaction Security: IP address, website access logs, password and credential information.
9. Risk Management: information processed for commercial, technical and administrative risk management.
10. Finance: balance-sheet, financial performance, credit, risk and asset information.
11. Professional Experience: diploma, course, training, certificate and transcript information.
12. Visual Records: camera and other visual records.
13. Health Information: disability status, blood group, health information and information on medical devices/prostheses.
14. Criminal Convictions and Security Measures: information relating to convictions and security measures.
15. Biometric Data: fingerprints, palm data, retinal scans, facial-recognition data and similar data.

Personal data means any information relating to an identified or identifiable natural person. This includes not only information that directly identifies an individual, such as name, surname, date and place of birth, but also information that reflects a person’s physical, familial, economic, social or psychological identity or makes that person identifiable when linked with another record.

Examples include names, telephone numbers, vehicle registration plates, social-security numbers, passport numbers, CVs, photographs, image and audio recordings, fingerprints and genetic information.

Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect, appearance and clothing, association/foundation/trade-union membership, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, are treated as special categories of personal data.

We may collect your personal data by automated or non-automated means, verbally, in writing, electronically or through audio-based channels.

Data may be obtained through our internet and mobile platforms, social-media accounts, e-mail, SMS/MMS, sales and marketing activities, contracts, commercial offers, printed and electronic forms, business cards and documents provided during customer visits, dealer and sales channels, manufacturers or suppliers, and sources such as trade registries.

Your personal data may be processed on one or more of the following legal grounds:

• Your explicit consent.
• Processing being permitted by applicable laws and regulations.
• Processing being necessary to protect life or physical integrity where consent cannot be expressed due to factual impossibility.
• Processing being necessary for the establishment or performance of a contract.
• Processing being necessary to comply with legal obligations.
• The personal data having been made public by you.
• Processing being necessary for the establishment, exercise or protection of a right.
• Processing being necessary for our legitimate interests, provided that your fundamental rights and freedoms are not harmed.

Special categories of personal data are processed in accordance with the conditions and security measures prescribed by KVKK.

ENVAPLAS retains processed personal data for the periods prescribed by KVKK and applicable legislation while taking the necessary administrative and technical measures.

Depending on their nature, the personal data we collect may be processed for the following general purposes:

1. Performance of contracts and provision, production, sale, delivery and installation of products and services.
2. Monitoring obligations arising from consumer legislation and responding to consumer applications.
3. Evaluating requests and complaints, providing support services and managing customer-satisfaction processes.
4. Carrying out quality assessment and improvement activities and auditing suppliers and subcontractors.
5. Advertising, marketing, promotion, campaigns, offers and event activities.
6. Conducting marketing and CRM activities.
7. Conducting corporate communications, events and market research.
8. Improving digital platforms, generating user statistics and providing personalized experiences.
9. Ensuring the legal and commercial security of the Company, customers, business partners and suppliers.
10. Exercising legal rights and preserving transaction history as evidence in potential disputes.
11. Determining and implementing ENVAPLAS’s commercial, legal and business strategies.
12. Conducting human-resources and accounting/finance policies.
13. Planning, auditing and conducting information-security processes.
14. Complying with national and international legislation, providing information to public institutions and fulfilling reporting obligations.

The purpose of this Policy is to ensure compliance with personal-data protection obligations, apply a risk-based approach to data processing, transfer and confidentiality, define the necessary strategies, controls, measures and responsibilities, and transparently inform relevant persons.

Where a valid legal basis exists and in accordance with applicable legislation, your personal data may be shared domestically or internationally with companies affiliated with ENVAPLAS, business partners, suppliers, banks, financial institutions, legal and tax advisers, information-technology and cloud-service providers, call-center service providers, and authorized public institutions and organizations.

The Company may transfer personal data to the following recipient groups:

• Shareholders.
• Business partners.
• Suppliers.
• Group companies.
• Authorized public institutions and organizations.
• Legal and professional advisers.

Groups of data subjects may include employee candidates, employees, shareholders/partners, potential purchasers of products and services, interns, supplier employees and representatives, product or service recipients, and visitors.

International transfers are carried out in accordance with the conditions and safeguards prescribed by KVKK and applicable secondary legislation.

Personal-data retention periods are regulated in detail in the Company’s Personal Data Retention and Destruction Policy. Personal data is retained for the period prescribed by applicable legislation or for as long as necessary for the relevant processing purpose.

1. Even where personal data has been processed lawfully, if the reasons requiring its processing cease to exist, the data shall be deleted, destroyed or anonymized ex officio or upon the request of the data subject.
2. The Data Controller carries out the required deletion, destruction or anonymization during the first periodic destruction process following the date on which the obligation arises.
3. The procedures governing these operations are described in detail in the Personal Data Retention and Destruction Policy.

Lawfulness and fairness

Personal data is processed in compliance with laws and other legal regulations, and processing activities are conducted in accordance with principles of fairness and good faith.

Accuracy and keeping data up to date where necessary

Maintaining accurate and up-to-date personal data is important for protecting fundamental rights and freedoms.

Processing for specified, explicit and legitimate purposes

The purpose of data processing is clearly and precisely determined and must be legitimate.

Relevance, limitation and proportionality

Only data that is necessary and suitable for achieving the specified purposes is processed; unnecessary processing is avoided.

Retention only for the period required

Personal data is retained only for the period prescribed by applicable legislation or required for the processing purpose, after which it is deleted, destroyed or anonymized.

Under Article 11 of KVKK, a data subject may apply to the Company and exercise the following rights:

• Learning whether personal data is processed.
• Requesting information if personal data has been processed.
• Learning the purpose of processing and whether the data is used in accordance with that purpose.
• Knowing the third parties to whom personal data has been transferred domestically or internationally.
• Requesting correction of incomplete or inaccurate personal data.
• Requesting deletion or destruction of personal data under the conditions prescribed by KVKK.
• Requesting notification of correction, deletion or destruction to third parties to whom the data has been transferred.
• Objecting to a result arising against the data subject due exclusively to analysis by automated systems.
• Claiming compensation for damage suffered as a result of unlawful processing of personal data.

Applications are concluded as soon as possible depending on the nature of the request and, in any event, within thirty days.

Under Article 13 of KVKK, requests concerning the exercise of the rights listed above may be submitted in writing in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller or via an e-mail address previously notified to the Company and registered in our systems.

Your application must include information sufficient to verify your identity and explanations regarding the right you wish to exercise under Article 11 of KVKK.

Written applications may be delivered in person or sent by post, together with identity-verification documents, to EOSB, 23100 Organize Sanayi Bölgesi, 96. Sk. No:8, 23200 Elazığ Merkez/Elazığ, Türkiye.

Rights relating to personal data may only be exercised in respect of the applicant’s own data. Applications lacking the necessary identity-verification information may not be considered.

ENVAPLAS reserves the right to amend this Notice due to changes arising from the Law, secondary legislation or decisions of the Personal Data Protection Board.

If your request submitted to ENVAPLAS is rejected, if you are dissatisfied with the response, or if no response is provided within the prescribed period, you may lodge a complaint with the Turkish Personal Data Protection Board within the periods specified by KVKK.

SIGNATURE