Policy about Personal Data Protection and Processing

Published: 5 July 2018

PART 1

1.1. INTRODUCTION

For Akın Tekstil AŞ, it is of paramount importance to protect personal data and it is one of our company's priorities. The most important aspect of this is protection of personal data of our company's employees, job applicants, interns, visitors, suppliers, third persons and customers, which is managed by this Policy.

As per article 20 of the Constitution of the Republic of Turkey, everyone has the right of demanding protection of personal data concerning him or her. With regards the protection of personal data, a Constitutional right, Akın Tekstil AŞ. takes due care of the protection of personal data of our company's employees, subcontractor employees, job applicants, interns, visitors, suppliers, third persons and customers, which is managed by this Policy, and has turned this into a corporate policy.

Therefore, Akın Tekstil AŞ takes required technical and administrative measures with a view to protecting personal data so processed in accordance with the relevant legislation.

This Policy outlines studies conducted in connection with fundamental principles adopted by Akın Tekstil AŞ which are listed below:

Processing of the personal data in compliance with with the law and rules of honesty,
Ensuring that Personal Data is accurate and up-to-date, when require,
Processing the personal data for specific, clear and legitimate purposes,
Processing the personal data in a manner connected with, limited to and commensurate with the purposes of processing,
Storage of data for a period stipulated by the respective legislation or required for the processing purpose,
Disclosure and informing for personal data subjects,
Establishing the required system in order for personal data subjects to exercise their rights,
Taking necessary measures for protection of the personal data,
Acting in compliance with the relevant legislation and regulations of the PDP Committee,
Taking due care for processing and protection of sensitive personal data.

1.2. PURPOSE OF THE POLICY

The fundamental purpose of this Policy is assuring security of personal data of our company's employees, subcontractor employees, job applicants, interns, visitors, suppliers, third persons and customers with regards to administrative and technical measures adopted for personal data processing activity and protection of personal data, as carried out by Akın Tekstil AŞ. in compliance with the law.

1.3. SCOPE

This Policy covers all personal data, processed at Akın Tekstil AŞ., concerning employees, subcontractor employees, job applicants, interns, visitors, suppliers, third persons and customers by automated means or non-automated means provided that it is part of any data recording system.

1.4. IMPLEMENTATION OF THE POLICY AND RELEVANT LEGISLATION

Relevant legal regulations concerning processing and protection of personal data currently in force will be implemented as a priority. In the event of a conflict between the legislation in force and this Policy, Akın Tekstil AŞ. agrees that the legislation will prevail. This Policy consists of arrangement of rules introduced by the relevant legislation after embodying them within scope of Akın Tekstil AŞ. practices.

1.5. EFFECTIVE DATE OF THE POLICY

This Policy to be put into effect by Akın Tekstil AŞ. will become effective on November 8, 2017.

PART 2

2 - MATTERS ON PROTECTION OF PERSONAL DATA

Pursuant to article 12 of the PDP Law no. 6698, Akın Tekstil AŞ. takes necessary technical and administrative measures to prevent illegal processing of the personal data processed by it, to prevent illegal access to personal data and to provide appropriate level of security for storage of data and carries out or causes to be carried out required controls to that effect.

2.1. SECURING THE PERSONAL DATA

2.1.1. Technical And Administrative Measures Taken To Assure Processing of Personal Data in Compliance with the Law

Akın Tekstil AŞ. takes technical and administrative measures, depending on technologic facilities and cost of implementation, for processing of the personal data in compliance with the law.

(i) Technical Measures Taken to ensure that Personal Data is Processed in compliance with Law

Main technical measures taken by Akın Tekstil AŞ to ensure that personal data is processed in compliance with the law are listed below:

The system established within scope of personal data processing activities carried out at Akın Tekstil AŞ. is controlled by IT Department.
As a requirement of the internal control mechanism, technical measures so taken are periodically reported to the company's General Manager.
Employees specialized in technical issues are employed.

(ii) Administrative Measures Taken to ensure that Personal Data is Processed in compliance with the Law

Main administrative measures taken by Akın Tekstil AŞ to ensure that personal data is processed in compliance with the law are listed below:

Employees are informed and trained on the Law on Protection of Personal Data and Processing of Personal Data in Accordance with the Law.
Business operations conducted by all units are analyzed within scope of all operations run by Akın Tekstil AŞ., personal has been defined, those processing the data have been identified, their job descriptions have been created and a data processor agreement has been signed with each and every one of them and they have been assigned to specific jobs.
Personal data processing activities conducted by all units of Akın Tekstil AŞ. have been ascertained in line with personal data processing conditions that are mandatory under the PDP Law no. 6698. Besides, in order to meet legal compliance requirements identified on the basis of business unit, necessary administrative measures are put into effect through internal corporate policies and trainings with a view to raising awareness for data processors at relevant units and determining rules of implementation.
Employment contracts entered into by and between Akın Tekstil AŞ. and employees include obligations of not processing disclosing and using the personal data in breach of the workplace's internal regulation and law and awareness of employees in this regard are being expanded and controls are being carried out.

2.1.2. Technical And Administrative Measures Taken to prevent Illegal Access to Personal Data

Akın Tekstil AŞ. takes technical and administrative measures, depending on the nature of the data to be protected, technologic facilities and cost of implementation, for preventing reckless or unauthorized disclosure, access to, transfer or any and all all types of unlawful access to the personal data.

(i) Technical Measures Taken to prevent Illegal Access to Personal Data

Main technical measures taken by Akın Tekstil AŞ to prevent unlawful access to personal data are listed below:

Technical measures are taken in accordance with technological developments, measures taken are periodically updated and renewed.
In line with the legal compliance requirements determined on a business unit basis, technical solutions of access and authorization are being put into use.
Access authorizations are being limited and reviewed on a regular basis.
Technical measures taken are periodically reported to the person concerned as a result of internal controls mechanism, risk issues are re-evaluated and the necessary technological solution is produced.
Software and hardware including virus protection systems and firewalls are installed.
Employees knowledgeable in technical issues are employed.
Applications where personal data is collected are regularly put through security scans in order to detect security gaps. It is ensured that gaps so detected are closed.

(ii) Administrative Measures Taken to prevent Illegal Access to Personal Data

Main administrative measures taken by Akın Tekstil AŞ to prevent unlawful access to personal data are listed below:

Employees are trained on technical measures to be taken to prevent illegal access to personal data.
In line with the legal compliance requirements determined on a business unit basis, processes of access to personal data and authorization are designed and implemented across the company.
Employees are informed that they are not allowed to disclose to others any personal data which they acquire in breach of the provisions of the PDP Law and to use such data outside the purpose of processing, and that this obligation shall continue to apply even after they leave the company and, accordingly, employees are asked to sign necessary letters of undertaking (data processor agreement).
Provisions are added to agreements (confidentiality agreement) concluded by Akın Tekstil AŞ. with the persons to whom the personal data are transferred in accordance with the law in order to ensure that the persons to whom the personal data are transferred take the necessary security measures in order to protect the personal data and these measures shall are adhered to in their own organizations.

2.1.3. Storage of Personal Data in Secure Media

Akın Tekstil AŞ. takes technical and administrative precautions according to the technological facilities and cost of implementation in order to ensure that the personal data is stored in safe environments and prevent the same from being destructed, lost or changed by unlawful purposes.

(i) Technical Measures Taken for Storage of Personal Data in Secure Media

Main technical measures taken by Akın Tekstil AŞ for storage of personal data in secure media are listed below:

Systems introduced as a result of technological developments are in place for storage of personal data in secure media.
Employees specialized in technical issues are employed.
Technical security systems are established for storage areas, and technical measures taken are periodically reported to the person concerned as a result of internal controls mechanism, risk issues are re-evaluated and the necessary technological solution is produced.
The backup programs, in compliance with the law, are used to ensure the safe storage of personal data.
Access to data storage areas with personal data is logged and improper access or access attempts are instantly communicated to those concerned.

(ii) Administrative Measures Taken for Storage of Personal Data in Secure Media

Main administrative measures taken by Akın Tekstil AŞ for storage of personal data in secure media are listed below:

Employees are trained on secure storage of personal data.
In the event that outsourced services are procured for storage of personal data due to technical requirements, provisions are added to agreements (confidentiality agreement) concluded by Akın Tekstil AŞ. with companies to which the personal data are transferred in accordance with the law in order to ensure that the persons to whom the personal data are transferred take the necessary security measures in order to protect the personal data and to ensure that these measures are adhered to in their own organizations.

2.1.4. Control of Measures Taken for Protection of Personal Data

Pursuant to article 12 of the PDP Law no. 6698, Akın Tekstil AŞ. carries out or causes to be carried out required controls across the company. The results of these audits are reported to the department in charge of the subject matter within the scope of the internal operation of Akın Tekstil AŞ. and necessary actions are taken to improve the measures taken.

2.1.5. Measures to be Taken in case of Unauthorized Disclosure of Personal Data

Akın Tekstil AŞ has a system in place which ensures that, if the personal data processed in accordance with article 12 of PDP Law no. 6698 is acquired by others through unlawful ways, such unlawful acquisition is reported to the data subject and PDP Board and the respective person as soon as possible.

If it is deemed necessary by the PDP Board, such situation will be declared on the website of the PDP Board or with another method.

2.2. PROTECTING THE RIGHTS OF THE DATA SUBJECT AND SATISFACTION OF HIS/HER REQUESTS

Akın Tekstil AŞ. conducts necessary channels, internal operation, administrative and technical regulations in line with article 13 of the PDP Law no. 6698 in order for data subjects to exercise their rights and inform data subjects.

In the event that data subjects notify Akın Tekstil AŞ. of their requests regarding their rights listed below in writing, Akın Tekstil AŞ. concludes the request free of charge as soon as possible but in no later than thirty days depending on the nature of such request. However, if the PDP Board sets a fee, Akın Tekstil AŞ. will charge the fee specified in the tariff established by PDP Board. Personal data subjects are entitled to:

Learn whether his/her personal data are processed or not,
Request information if his/her personal data are processed,
Learn the purpose of processing of the personal data and whether the data have been used in accordance with that purpose,
Know the third parties at home or abroad to whom personal data have been transferred,
Request correction of personal data if they are incomplete or incorrectly processed and ask that the process carried out in this context be notified to the third parties to whom personal data have been transmitted,
Request deletion or destruction of your personal data if the reasons for processing the same have ceased to exist, although it has been processed in accordance with the PDP Law and other relevant laws, and notification of third parties to whom your personal data are transmitted regarding the process carried out in this respect;
Raise an objection to any unfavorable result they suffer from due to analysis of processed data only by means of automatic systems,
Demand indemnification of loss if they suffer loss due to their personal data being processed in breach of the law.

2.3. PROTECTION OF SENSITIVE PERSONAL DATA

As per the PDP Law no. 6698, certain personal data is of paramount importance since it bears the risk of causing victimization or discrimination of individuals when it is processed illegally. Such data include any biometric or genetic data relating to racial or ethnic origin, political opinion, philosophical and religious beliefs, sect, or other beliefs, dressing, membership of an association, a foundation or a trade union, health, sexual life, the sentence of any punishment and security measures.

Akın Tekstil AŞ. shows sensitivity to protection of sensitive personal data which is defined as "sensitive data" by the PDP Law no. 6698 and processed in compliance with the law. In this regard, technical and administrative measures taken for protection of personal data are being implemented with great care by Akın Tekstil AŞ. with respect to sensitive personal data and necessary controls are put into use across Akın Tekstil AŞ.

2.4. EXPANDING AND CONTROLLING AWARENESS OF BUSINESS UNITS ABOUT PROTECTION AND PROCESSING OF PERSONAL DATA

Akın Tekstil AŞ. ensures that necessary trainings are organized for its business units with a view to expanding awareness about prevention of illegal processing of personal data, unlawful access to data as well as storage of data.

Systems are being established which are required to raise awareness in current employees of business units of Akın Tekstil AŞ. and new hires of business units about protection of personal data and the company collaborates with professionals in this regard, when required.

Results of the trainings organized for the purpose of expanding and controlling awareness of business units about protection and processing of personal data at Akın Tekstil AŞ. are reported to Akın Tekstil AŞ. Akın Tekstil AŞ. considers attendance to relevant trainings, seminars and informational sessions in this regard and carries out or causes to be carried out necessary audits. Akın Tekstil AŞ. updates and repeats its trainings in parallel to updates in the relevant legislation.

2.5. EXPANDING AND CONTROLLING AWARENESS ABOUT PROTECTION AND PROCESSING OF PERSONAL DATA OF SUBCONTRACTOR EMPLOYEES, INTERNS AND SUPPLIERS

Akın Tekstil AŞ. ensures that trainings and seminars are organized for its subcontractor employees, interns and suppliers with a view to expanding awareness about prevention of illegal processing of personal data, unlawful access to data as well as storage of data.

Trainings organized for suppliers of Akın Tekstil AŞ. are periodically repeated, and systems are being established which are required to raise awareness in subcontractor employees, interns as well as current employees of suppliers of the company and new hires of business units of the company about protection of personal data and the company collaborates with professionals in this regard, when required.

PART 3

3 - MATTERS REGARDING THE PROCESSING OF THE PERSONAL DATA

Akın Tekstil AŞ., in accordance with article 20 of the Constitution of the Republic of Turkey and article 4 of the PDP Law no. 6698, carries out personal data processing activity in a manner consistent with the law and rules of honesty, for true and up-to-date, when necessary, specific, clear and legitimate purposes; in a fashion limited to, connected with and commensurate with the purpose. Akın Tekstil AŞ. stores personal data for a period stipulated in laws or for a period required by the purpose of processing the personal data.

Akın Tekstil AŞ., as per article 20 of the Constitution of the Republic of Turkey and article 5 of the PDP Law no. 6698, processes personal data based on one or more than one of the conditions set forth in article 5 of the PDP Law concerning processing of personal data.

Akın Tekstil AŞ., in line with article 20 of the Constitution of the Republic of Turkey and article 10 of PDP Law no. 6698, informs data subjects and provided them with information if information is demanded by data subjects.

Akın Tekstil AŞ. acts in accordance with the regulations set forth in Article 6 of the PDP Law no. 6698 in terms of processing sensitive personal data.

Akın Tekstil AŞ., as per articles 8 and 9 of PDP Law no. 6698, acts in accordance with regulations concerning transfer of personal data as set forth in the law and regulations issued by PDP Board.

3.1. PROCESSING OF PERSONAL DATA IN COMPLIANCE WITH PRINCIPLES STIPULATED IN THE LEGISLATION

3.1.1. Processing in compliance with the Law and Rule of Honesty

Akın Tekstil AŞ. acts in accordance with the principles set forth with legal regulations and the principle of general trust and good faith in the processing of personal data. In this context, Akın Tekstil AŞ. takes into account the necessity of proportionality in the processing of personal data, and does not use personal data outside its purpose.

3.1.2. Ensuring that Personal Data is Accurate and up-to-date when needed

Akın Tekstil AŞ. ensures that the personal data it processes are accurate and up to date by taking into consideration the fundamental rights of personal data subjects and its legitimate interests. It takes necessary measures in this context. For instance, Akın Tekstil AŞ. has established a system in order for data subjects to correct and confirm accuracy of their personal data.

3.1.3. Processing of Data for Certain, Clear and Legitimate purposes

Akın Tekstil AŞ determines its purpose of processing personal data which is legitimate and lawful clearly and conclusively. Akın Tekstil AŞ. processes personal data in a manner connected with and to such extent as is necessary for the business activities it engages in. Akın Tekstil AŞ. sets forth the purpose for processing personal data before processing of personal data has been started.

3.1.4. Being Connected With, Limited To And Commensurate With The Purposes Of Processing

Akın Tekstil AŞ processes the personal data in a manner that enables to carry out specified purposes and avoids the processing of personal data that is not relevant or not required for the fulfillment of the purpose. For instance, no personal data processing activity is conducted in order to meet needs likely to arise in the future.

3.1.5. Storage of Data for a period stipulated by the Respective Legislation or required for the processing purpose

Akın Tekstil AŞ. stores the personal data only for a period stipulated by the respective legislation that it is obliged to observe or required for the processing purpose. In this context, Akın Tekstil AŞ., first of all, determines whether any time period is set forth in the legislation for the storage of personal data, and if a time frame has been set, then it abides by the stipulated time period, or if not, then it stores the personal data for such time as is necessary for the purpose for which the personal data is processed. If the time period expires or the reasons for processing no longer exist, your personal data are erased, destroyed or anonymized by Akın Tekstil AŞ. Akın Tekstil AŞ. does not retain personal data in case that it may be used in the future.

3.2. PROCESSING OF PERSONAL DATA BASED ON AND WITH LIMITATION TO ONE OR MORE THAN ONE OF PERSONAL DATA PROCESSING CONDITIONS SET FORTH IN ARTICLE 5 OF PDP LAW

The protection of personal data is a constitutional right. Fundamental rights and liberties may only be restricted by law, without prejudice to their essence, and only based on the reasons set forth in the relevant articles of the Constitution. As per paragraph three, article 20 of the Constitution of the Republic of Turkey, personal data may only be processed under circumstances stipulated in the law or with the explicit consent of the person concerned. Accordingly, and in compliance with the Constitution, Akın Tekstil AŞ. processes the personal data either under the respectively foreseen circumstances, or upon the explicit consent of the person concerned.

3.3.DISCLOSURE TO AND INFORMING PERSONAL DATA SUBJECT

Pursuant to article 10 of the PDP Law no. 6698, Akın Tekstil AŞ. informs Data Subjects at the time of acquiring personal data. In this context, Akın Tekstil AŞ. informs personal data subjects about the identity of its representative, if any, the purpose for which the personal data will be processed, the parties to which and for what purposes the personal data might be transferred, the method and legal reason for collecting personal data and rights personal data subject have.

It has been established in the Article 20 of the Constitution of the Republic of Turkey that everyone has the right to be informed about the personal data concerning themselves. In this respect, in Article 11 of the PDP Law no. 6698, among the rights of the personal data subject, "requesting for information" is also included. Akın Tekstil AŞ., in line with article 20 of the Constitution of the Republic of Turkey and article 11 of PDP Law no. 6698, provides necessary information upon demand of the Personal Data Subject.

3.5 PROCESSING OF SENSITIVE PERSONAL DATA

Akın Tekstil AŞ. shows sensitivity, in accordance with the regulations set forth in the PDP Law, for processing of personal data described as "sensitive" by PDP Law no. 6698.

In this context, a number of personal data bearing the risk of causing victimization or discrimination of the individuals when they are processed illegally have been specified as "sensitive" in Article 6 of the PDP Law no. 6698. Such data include any biometric or genetic data relating to racial or ethnic origin, political opinion, philosophical and religious beliefs, sect, or other beliefs, dressing, membership of an association, a foundation or a trade union, health, sexual life, the sentence of any punishment and security measures.

Sensitive personal data are processed by Akın Tekstil AŞ. under the conditions specified below, in a manner in compliance with the Law and on condition that the adequate measures to be determined by the Personal Data Protection Board ("PDP Board") are taken:

If the personal data subject has given his/her explicit consent or If the personal data subject has not given his/her explicit consent,

Sensitive personal data apart from those relating to health and sexual life of the Personal Data Subject may be processed in cases set forth in the Law,
Sensitive personal data relating to health and sexual life of the Personal Data Subject may only be processed by persons who is subject to confidentiality obligation or authorized agencies and administrations for purposes such as preserving public health, rendering services such as preventive medicine, medical diagnosis, treatment and care giving, planning and management of health services and financing of such services.

3.6.TRANSFER OF PERSONAL DATA

Akın Tekstil AŞ. transfers personal data of personal data subjects and sensitive personal data to third persons by taking necessary security measures in line with legal personal data processing purposes. Akın Tekstil AŞ. acts in accordance with the regulations set forth in Article 8 of the PDP Law no. 6698 in this context.

3.6.1.Transfer of Personal Data

Akın Tekstil AŞ. may transfer personal data to third persons based on and with limitation to one or more than one of following personal data processing conditions, as set forth in article 5 of PDP Law, in line with its legal and legitimate personal data processing purposes:

If the personal data subject has given his/her explicit consent,
If laws have a clear provision that personal data may be transferred,
If it is imperative to protect life or physical integrity of the personal data subject and that of another person or when a person is unable to disclose her/his consent due to actual inability or when the consent of such person is not legally valid,
When it is required to transfer personal data pertaining to the parties of a contract to the extent personal data are directly related to the conclusion or execution of the contract,
When it is required to transfer personal data in order for Akın Tekstil AŞ to fulfill its legal obligation,
When the personal data subject has made public the personal data,
When personal data transfer is necessary for the establishment, exercise or protection of any right,
When it is required to transfer personal data for legitimate interests of Akın Tekstil AŞ, to the extent that fundamental rights and freedoms of the data subject are not prejudiced.

3.6.2.Transfer of Sensitive Personal Data

Akın Tekstil AŞ. may transfer sensitive personal data of personal data subjects to third persons in the following circumstances by taking necessary security measures in line with legal personal data processing purposes, provided that it takes due care, takes necessary security measures and takes sufficient measures stipulated by PDP Board..
If the personal data subject has given his/her explicit consent or If the personal data subject has not given his/her explicit consent,

The personal data subject's sensitive personal data other than the data concerning his or her health and sexual life may be transferred (biometric or genetic data relating to racial or ethnic origin, political opinion, philosophical and religious beliefs, sect, or other beliefs, dressing, membership of an association, a foundation or a trade union, the sentence of any punishment and security measures) in cases stipulated in laws,
Sensitive personal data relating to health and sexual life of the Personal Data Subject may only be transferred by persons who is subject to confidentiality obligation or authorized agencies and administrations for purposes such as preserving public health, rendering services such as preventive medicine, medical diagnosis, treatment and care giving, planning and management of health services and financing of such services.

3.7.TRANSFERRING PERSONAL DATA ABROAD

Akın Tekstil AŞ. may transfer personal data to those foreign countries which PDP Board has announced has sufficient protection (“Foreign Country with Sufficient Protection”) or, in case of no sufficient protection, to those countries data controllers in Turkey and relevant foreign countries has committed a sufficient protection in writing and those foreign countries permitted by the PDP Board (“Foreign Country where Data Controller Commits Sufficient Protection”). Akın Tekstil AŞ. acts in accordance with the regulations set forth in Article 9 of the PDP Law in this context.

3.7.1.Transferring Personal Data Abroad

Akın Tekstil AŞ. may transfer personal data to to Foreign Countries with Sufficient Protection or Foreign Countries where Data Controller Committing Sufficient Protection is Based, in line with its legitimate and lawful personal data processing purposes, if the personal data subject has given his/her explicit consent or in presence of the any one of the following circumstances If the personal data subject has not given his/her explicit consent:

If laws have a clear provision that personal data may be transferred,
If it is imperative to protect life or physical integrity of the personal data subject and that of another person or when a person is unable to disclose her/his consent due to actual inability or when the consent of such person is not legally valid,
When it is required to transfer personal data pertaining to the parties of a contract to the extent personal data are directly related to the conclusion or execution of the contract,
When it is required to transfer personal data in order for Akın Tekstil AŞ to fulfill its legal obligation,
When the personal data subject has made public the personal data,
When personal data transfer is necessary for the establishment, exercise or protection of any right,
When it is required to transfer personal data for legitimate interests of Akın Tekstil AŞ, to the extent that fundamental rights and freedoms of the data subject are not prejudiced.

3.7.2.Transferring Sensitive Personal Data Abroad

Akın Tekstil AŞ. may transfer sensitive personal data of personal data subjects in the following circumstances to Foreign Countries with Sufficient Protection or Foreign Countries where Data Controller Committing Sufficient Protection is Based by taking necessary security measures in line with legal personal data processing purposes, provided that it takes due care, takes necessary security measures and takes sufficient measures stipulated by PDP Board.

If the personal data subject has given his/her explicit consent or If the personal data subject has not given his/her explicit consent,

The personal data subject's sensitive personal data other than the data concerning his or her health and sexual life may be transferred (biometric or genetic data relating to racial or ethnic origin, political opinion, philosophical and religious beliefs, sect, or other beliefs, dressing, membership of an association, a foundation or a trade union, the sentence of any punishment and security measures) in cases stipulated in laws,
Sensitive personal data relating to health and sexual life of the Personal Data Subject may only be transferred within scope of processing by persons who are subject to confidentiality obligation or authorized agencies and administrations for purposes such as preserving public health, rendering services such as preventive medicine, medical diagnosis, treatment and care giving, planning and management of health services and financing of such services.

PART 4 4- CATEGORIZATION OF PERSONAL DATA BEING PROCESSED BY OUR COMPANY, PROCESSING
PURPOSES AND RETENTION PERIODS

Akın Tekstil AŞ., within scope of obligation of disclosure under article 10 of the PDP Law, notifies the personal data subject of which personal data subject groups process which personal data, purposes for processing of the personal data subject's personal data and periods of retention.

4.1.CATEGORIZATION OF PERSONAL DATA

According to the company's legitimate and lawful purposes for processing the personal data, personal data from following categories is processed at Akın Tekstil AŞ. by informing the respective persons based on one or more than one of personal data processing conditions specified in Article 5 of the PDP Law and in a limited manner, in compliance with general principles stipulated in the PDP Law, notably principles set forth in article 4 concerning processing of personal data, all obligations set out in the PDP Law, in limitation to periods set forth in this Policy (Employees, Subcontractor Employees, Job Applicants, Customers, Suppliers, Visitors, Interns and Third Persons), as per article 10 of the PDP Law.

PERSONAL DATA CATEGORIZATION	EXPLANATION REGARDING THE CATEGORIZATION OF PERSONAL DATA
Identity Information	Data that clearly concerns a real person who is identified or identifiable, is completely or partially processed automatically or in a non-automatic manner as part of a data recording system, contains information related to the person concerned; documents containing information such as name-surname, T.R. ID number, nationality details, name of mother & father, place of birth, gender contained in documents such as driver's license, national identity card, passport, as well as information such as SSI number, one's signature details, registration plate of one's vehicle.
Contact Details	Means all information such as telephone number, address, e-mail address, fax number and IP address, which clearly belongs to a real person who is identified or identifiable and is completely or partially processed automatically, or in a non-automatic manner as part of a data recording system.
Location Data	All the information identifying the location of the place where the personal data subject, while using products and services of the company within framework of operations run by business units of Akın Tekstil AŞ. or employees of those institutions we cooperate with while using vehicles of Akın Tekstil AŞ., GPS location, travel data, etc., which clearly belongs to an identified or identifiable natural person, processed automatically, or non-automatically as part of a data recording system in part or in whole.
Information on Family Members and Relatives	All the information concerning family members (e.g., spouse, parents, children), relatives and of the personal data subject and others persons who could be contacted in case of emergency in connection the personal data subject, with respect to products and services provided by the company within framework of operations run by business units of Akın Tekstil AŞ. or for the purpose of protecting legal and other interests of the company and personal data subject, which clearly belongs to an identified or identifiable natural person, processed automatically, or non-automatically as part of a data recording system in part or in whole.
Physical Environment Security Information	Personal data that are clearly belonging to an identified or identifiable natural person, that are completely or partially processed either automatically or non-automatically as part of a data recording system, that are related to recordings and documents made/obtained while the relevant individual is entering a physical environment and staying in that environment, video recordings and records obtained at a security point, etc.
Financial Information	Means the personal data that are clearly belonging to a real person who is identified or identifiable, and that are completely or partially processed automatically, or manually as part of a data recording system, and processed with regards to the information, documents and records that show any financial result created in accordance with the type of the legal relationship that Akın Tekstil AŞ. has established with the personal data subject and bank account details, IBAN, credit card details, wealth data, income details.
Visual/Audio Information	Photograph and camera records (excluding the records falling within scope of Physical Environment Security Information) voice records clearly belonging to an identified or identifiable natural person as well as the data contained in the documents that are in the form of copies of documents containing personal data.
Personal Information	Any and all personal data clearly belonging to an identified or identifiable natural person, processed automatically or non-automatically as part of a data recording system in part or in whole, processed to obtain information that will be the basis for the establishment of the personal rights of natural persons with an employment relationship with Akın Tekstil AŞ.
Sensitive Personal Data	Any and all data specified in the Article 6 of the PDP Law, clearly belonging to an identified or identifiable natural person, processed automatically or non-automatically as part of a data recording system in part or in whole (e.g. health data including blood group, biometric data, information regarding associations and trade unions the person concerned is a member of).
Demand/Complaint Management Information	Personal data related to receiving and assessing any kind of demand and complaints directed to Akın Tekstil AŞ., clearly belonging to an identified or identifiable natural person, processed automatically, or non-automatically as part of a data recording system in part or in whole.

4.2. PURPOSES OF PROCESSING OF PERSONAL DATA

Akın Tekstil AŞ. processes personal data in accordance with the purposes and conditions stated in the personal data processing terms which are specified in paragraph 2, Article 5 and paragraph 3, Article 6 of the PDP Law. These purposes and conditions are as follows:

When laws expressly provide for related activities being carried out by Akın Tekstil AŞ. with regard to processing of your personal data
When Akın Tekstil AŞ. is required to process your personal data to the extent personal data is directly related to the conclusion or execution of the contract
When processing of your personal data is mandatory to perform a legal obligation of Akın Tekstil AŞ.
Processing of personal data by Akın Tekstil AŞ. in limitation to the data subject's purpose of making public, provided that personal data has been made public by the data subject
When Akın Tekstil AŞ. is required to process personal data for establishment, use or protection of rights of Akın Tekstil AŞ. or the data subject or third persons
When it is required to process personal data for legitimate interests of Akın Tekstil AŞ, to the extent that fundamental rights and freedoms of the data subject are not prejudiced
When Akın Tekstil AŞ. is required to carry out personal data processing activities to protect life or physical integrity of the personal data subject and that of another person and when the personal data subject is unable to disclose her/his consent due to actual or legal invalidity
When laws provide for processing of personal data apart from the data relating to health and sexual life of the personal data subject
Processing of sensitive personal data relating to health and sexual life of the personal data subject by persons who is subject to confidentiality obligation or authorized agencies and administrations for the sole purpose of preserving public health, rendering services such as preventive medicine, medical diagnosis, treatment and care giving, planning and management of health services and financing of such services.

In this context, Akın Tekstil AŞ. processes personal data for following purposes:

Planning and performance of corporate sustainability operations
Event management
Management of relationships with suppliers
Management of relationships with subcontractors
Akın Tekstil AŞ. Conducting of personnel recruitment processes
Performance/follow-up of financial reporting ve risk management procedures of Akın Tekstil AŞ.
Performance/follow-up of legal affairs of Akın Tekstil AŞ.
Planning and conducting corporate communication activities
Performance of corporate compliance operations
Demand and complaint management
Providing information to authorized agencies as a requirement of the legislation
Creating and monitoring of visitor records

In the event that the processing activity carried out for the said purposes fails to cover conditions stipulated under the PDP Law, Akın Tekstil AŞ. asks you for your explicit consent regarding the relevant processing.

4.3. RETENTION PERIODS OF PERSONAL DATA

If stipulated in the relevant laws and legislations, Akın Tekstil AŞ. retains personal data for periods stipulated in the said legislations.

If the legislation is silent about the period for retention of the personal data, Personal Data is is processed by Akın Tekstil AŞ.’ for the period of processing required by activities and applications conducted whilst processing such data as well as practices of the business life and then deleted, destroyed or anonymized.

If personal data is no longer required to be processed and and periods of retention established in the legislation and Akın Tekstil AŞ. have expired, personal data may only be retained for the purpose of using it as evidence in case of possible legal conflicts, or for the purpose of asserting the relevant right connected with the personal data or creating a defense. At the time of determining aforesaid periods, periods of retention are determined based on periods of prescription associated with bringing forward the said right as well as examples included in claims brought against Akın Tekstil AŞ. with regards to same subject matters despite the expiry of prescription period. In such case, personal data so retained is not accessed for any other purpose, and such personal data is only accessed when it is required to use such personal data for the purpose of the relevant legal conflict.. Following the expiration of the aforesaid period, personal data is deleted, destroyed or anonymized.

PART 5 5 - CATEGORIZATION REGARDING DATA SUBJECTS OF PERSONAL DATA PROCESSED BY AKIN TEKSTİL AŞ

Although Akın Tekstil AŞ. processed personal data of personal data subject categories listed below, this Policy is only applicable to Employees, Subcontractor employees, Job Applicants, Interns, Customers, Suppliers, Third Persons and Visitors.

Below are clarifications for concepts used in this Policy such as Employees, Subcontractor employees, Interns, Job Applicants, Visitors, Suppliers, Third Persons and Customers.

Personal Data Subject Category	Description
Employees	Natural persons who is employed by Akın Tekstil AŞ. as per the Labor Law no. 4857 and whose personal data is acquired through employment relations.
Visitor	Natural persons, in their capacity as visitors, entering the physical premises owned by Akın Tekstil AŞ. for various purposes.
Third Person	Other natural persons not covered by this Policy and the Policy of Akın Tekstil AŞ. Regarding Protection and Processing of Employees' Personal Data (e.g. family members and relatives, former employees).
Job Applicants	Natural persons who have applied for a job at Akın Tekstil AŞ. by any means or who have granted our company access to their CVs and related information.
Subcontractor Employees	Natural persons employed by subcontractors to whom Akın Tekstil AŞ. assigns a part of the main work or auxiliary works as per the Law no. 4857.
Interns	Natural persons doing internship at Akın Tekstil AŞ. as per the Vocational Training Law number 3308.
Suppliers	Natural persons who are employees of suppliers Akın Tekstil AŞ. does business with.
Customers	Natural persons with whom Akın Tekstil AŞ has a business relationship as part of its business operations.

The table below details out aforesaid personal data subject categories and which personal data of such persons from such categories is processed.

CATEGORIZATION OF PERSONAL DATA	DATA SUBJECT CATEGORY WITH WHOM THE RELEVANT PERSONAL DATA IS ASSOCIATED
Identity Information	Employees, Job Applicants, Interns, Visitors, Suppliers, Customers and Third Persons.
Contact Details	Employees, Job Applicants, Interns, Visitors, Suppliers, Customers and Third Persons.
Location Data	Employees, Subcontractor employees.
Job Applicants	Natural persons who have applied for a job at Akın Tekstil AŞ. by any means or who have granted our company access to their CVs and related information.
Information on Family Members and Relatives	Employees, Subcontractor employees, Interns, Third Persons.
Physical Environment Security Information	Employees, Job Applicants, Interns, Visitors, Suppliers, Customers and Third Person.
Financial Information	Employees, Job Applicants, Interns, Visitors, Suppliers, Customers.
Visual/Audio Information	Employees, Job Applicants, Interns, Visitors, Suppliers, Customers and Third Person.
Personal Information	Employees, Subcontractor employees, Job Applicants, Interns.
Sensitive Personal Data	Employees, Subcontractor employees, Job Applicants, Interns.
Demand/Complaint Management Information	Employees, Job Applicants, Interns, Visitors, Suppliers, Customers and Third Person.

PART 6 6 - THIRD PERSONS TO WHOM AKIN TEKSTİL AŞ. TRANSFERS PERSONAL DATA AND PURPOSES OF TRANSFER

Akın Tekstil AŞ., as per article 10 of the PDP Law, notifies the personal data subject of groups of persons to whom personal data has been transferred.

Akın Tekstil AŞ. may transfer personal data of data subjects managed under the Policy to categories of persons listed below as per articles 8 and 9 of the PDP Law:

(i) Senior management of AKIN TEKSTİL AŞ,
(ii) Officials of AKIN TEKSTİL AŞ.,
(iii) Legally authorized public institutions and organizations,
(iv) Legally Authorized private Entities/Persons

The scope of the above mentioned persons and the data transfer purposes are specified below.

Persons to whom Data Transfer Is permissible	Description	Purpose Of Data Transferring
Akın Tekstil AŞ. Company Officials	Akın Tekstil AŞ. Members of the Board of Directors and other authorized natural persons.	In limitation to the purpose of management and control of Akın Tekstil AŞ. employees at the highest level.
Akın Tekstil AŞ. Company Officials	Akın Tekstil AŞ. Members of the Board of Directors and other authorized natural persons.	According to provisions of the relevant legislation In limitation to the purpose of design, management and control at the highest level of strategies associated with business operations of Akın Tekstil AŞ.
Legally Authorized Public Institutions and Organizations	The public institutions and organizations authorized to collect the information and documents from Akın Tekstil AŞ. as per provisions of the relevant legislation.	In limitation to the purpose requested by relevant public/private institutions and organizations within the scope of their legal authorization.
Legally Authorized Private Entities/Persons	Private entities/persons authorized to collect the information and documents from Akın Tekstil AŞ. as per provisions of the relevant legislation.	In limitation to purposes requested by the relevant private entities / persons within scope of their legal authority.

PART 7 7 - PROCESSING OF PERSONAL DATA BASED ON AND IN LIMITATION TO CONDITIONS OF PROCESSING LAID DWON IN THE LAW

Akın Tekstil AŞ., informs the personal data subject about personal data processed in accordance with article 10 of the PDP Law.

7.1.PROCESSING OF PERSONAL DATA AND SENSITIVE PERSONAL DATA

7.1.1.Processing of Personal Data

Obtaining the explicit consent of the personal data subject is only one of the legal bases that make it possible for the personal data to be processed in accordance with the law. Apart from seeking for explicit consent, presence of any one of the conditions given below may permit the processing of the personal data. The basis of the personal data processing activity may be only as per one of the following conditions, and also more than one of these conditions may be the basis for the same personal data processing activity.

Although legal basis for Akın Tekstil AŞ. to process personal data differs, all personal data processing activities adhere to general principles set forth in article 4 of PDP Law.

(i) Explicit Consent of the Personal Data Subject

One of the requirements for the processing of personal data is the explicit consent of the data subject. The explicit consent of the personal data subject shall be related to a certain subject, subject to notification and stated with free will.

For personal data processing activities (secondary processing) other than purpose of processing for reasons for acquiring personal data (primary processing), at least one of the conditions specified in items (ii), (iii), (iv) (v), (vi), (vii) and (viii) of this heading needs to be fulfilled; in the event that none of such conditions is fulfilled, Akın Tekstil AŞ. carries out personal data processing activities based on the explicit consent of the personal data subject.

In order for the personal data to be processed subject to explicit consent given by the personal data subject, explicit consents of personal data subjects are taken with relevant methods.

(ii) When it is Clearly Stipulated in Laws

Data subject's personal data may be processed legally if it is expressly stipulated in the law.

Example: Acquiring health information because it is imperative to take a commencement of employment health report as per Occupational Health and Safety Law no. 6331.

(iii) When Express Consent cannot be Obtained Due To Actual Impossibility

The personal data of the data subject may be processed if it is compulsory to process the personal data in order to protect the life or body integrity of the person who can not state his/her consent due to the actual impossibility or of another person or when it is not possible to validate the consent of an employee.

Example: Delivery of the identity of an employee who suffered from a work accident to doctors at the hospital by a company employee.

(iv) When it is Directly Related to the Conclusion or Execution of the Contract

Personal data may be processed, to the extent personal data is directly related to the conclusion or execution of a contract, when it is required to process personal data pertaining to parties of the contract.

Example: acquisition of personal data since it is imperative to conclude an employment contract in writing as per article 8 of the Labor Law no. 4857.

(v) Fulfillment by Akın Tekstil AŞ to fulfill its legal obligation

If data processing is compulsory for Akın Tekstil AŞ. in its capacity as the data controller to fulfill its legal obligations, the data subject's personal data may be processed.

Example: Submission of information requested by a court order to the court as a result of a labor conflict between an employer and an employee or for other reasons.

(vi) When the Data Subject has made her/his Personal Data public

If Data Subject has made his/her personal data public, then such personal data may be processed.

Example: Publishing of contact details of those applying for a job via websites enabling individuals to apply for a job.

(vii) When Data Processing is mandatory to Establish, Exercise or Protect a right

The personal data of the personal data subject may be processed when data processing is mandatory to establish, exercise or protect a right.

Example: Retention of the data that can be used as proof (e.g. a professional qualification certificate) and use of the same, when necessary.

(viii) When Data Processing is imperative for the Legitimate Interests of Akın Tekstil AŞ.

Personal data of the data subject may be processed when it is mandatory to process data for legitimate interests of our Akın Tekstil AŞ., provided that fundamental rights and liberties of the data subject are not prejudiced.

Example: Camera footage recording at the buildings and facilities owned by the workplace.

7.1.2. Processing of Sensitive Personal Data

Sensitive personal data may only be processed by Akın Tekstil AŞ., without explicit consent of the personal data subject, under the conditions specified below, provided that adequate measures to be determined by the PDP Board are taken:

(i) Sensitive personal data apart from those relating to health and sexual life of the Personal Data Subject may be processed in cases set forth in the Law,
(ii) Sensitive personal data relating to health and sexual life of the Personal Data Subject may only be transferred by persons who is subject to confidentiality obligation or authorized agencies and administrations for purposes such as preserving public health, rendering services such as preventive medicine, medical diagnosis, treatment and care giving, planning and management of health services and financing of such services.

PART 8 8 - PERSONAL DATA PROCESSING ACTIVITIES CARRIED OUT AT ENTRANCES TO BUILDINGS, FACILITIES AND INSIDE BUILDINGS AND PREMISES

Personal data processing activities carried out by Akın Tekstil AŞ. at entrances to buildings and facilities and inside the premises are performed in accordance with the Constitution, the Law and the other applicable legislation.

Akın Tekstil AŞ. carries out video surveillance and personal data processing activity for monitoring of visitor entrance and exit at buildings and premises of Akın Tekstil AŞ. in order to assure the security.

Akın Tekstil AŞ. carries out personal data processing activity by using security cameras and recording of entrance and exit of visitors.

8.1.VIDEO SURVEILLANCE ACTIVITY CARRIED OUT AT ENTRANCES TO AND INSIDE THE BUILDING AND THE PREMISES OF AKIN TEKSTİL AŞ.

This part includes descriptions regarding camera surveillance system of Akın Tekstil AŞ. and information regarding how personal data is kept confidential and personal fundamental rights are protected.

Akın Tekstil AŞ. aims to protect interests associated with protecting security of the company ad other persons within scope of security camera surveillance activity.

8.1.1.Legal Basis of Camera Surveillance Activity

Camera surveillance activity, carried out by Akın Tekstil AŞ., is conducted in compliance with the Law on the Private Security Services and the relevant legislation.

8.1.2.Carrying Out Security Camera Surveillance Activity as per the PDP Law

Akın Tekstil AŞ. adheres to regulations set out in the PDP Law whilst carrying out camera surveillance activity for the purpose of security. Akın Tekstil AŞ. carries out security camera surveillance activities for purposes stipulated in the applicable legislation and in accordance with conditions of processing personal data listed in the PDP Law with a view to securing its buildings and premises.

8.1.3.Announcement of Camera Surveillance Activity

Personal data subject is informed by Akın Tekstil AŞ. in accordance with Article 10 of the PDP Law. Akın Tekstil AŞ. gives notices for the camera surveillance activity regarding the disclosure made by it in connection with general matters with more than one method. Thus, it is aimed to prevent damage to the fundamental rights and freedoms of the personal data subject, ensure transparency and provide information to the personal data subject.

8.1.4.Purpose of the Camera Surveillance Activity and Being Limited to the Purpose

In accordance with Article 4 of the PDP Law, Akın Tekstil AŞ. processes personal data in connection with and only for the purpose of their processing and in a prudent manner.

The purpose of video surveillance activity carried out by Akın Tekstil AŞ. is limited to purposes listed in this Policy. In this context, surveillance areas of security cameras, their number and designated time of surveillance are sufficient to achieve the security objective and the security cameras are only used for this purpose. The security cameras are not used in any areas where they intervene in a person's privacy outside the scope of the security purposes (e.g locker rooms, showers and toilets).

8.1.5.Securing the Data Acquired

In accordance with Article 12 of the PDP Law, technical and administrative measures are taken by Akın Tekstil AŞ. to ensure security of personal data obtained as a result of video surveillance.

8.1.6.Storage Period for Personal Data Acquired by Camera

Storage period for personal data acquired, by Akın Tekstil AŞ., via camera is limited to 90 days.

8.1.7.Those with Access to Data Acquired as a result of Surveillance and to Whom Such Data is Transferred

Only a limited number of Akın Tekstil AŞ employees have access to live camera footage and any records made and stored digitally. The limited number of persons with access to the footage declares to keep the data accessed by them by virtue of a confidentiality agreement.

8.2.MONITORING OF VISITOR ENTRANCES AND EXITS CARRIED OUT AT ENTRANCES TO AND INSIDE THE BUILDING AND THE PREMISES OF AKIN TEKSTİL AŞ.

Akın Tekstil AŞ. carries out personal data processing activity for monitoring of visitor entrance and exit at buildings and premises of Akın Tekstil AŞ. in order to assure the security and for purposes specified in this Policy.

Names and surnames of persons coming to buildings of Akın Tekstil AŞ. as visitors are acquired, and such personal data subjects are informed through texts hung across Akın Tekstil AŞ. premises or otherwise made available to guests Data acquired for the purpose of monitoring guest entrance-exit is solely processed for such purpose and relevant personal data is physically recorded to the data recording system.

8.3. RETENTION OF RECORDS REGARDING INTERNET ACCESS GRANTED TO OUR VISITORS AT AKIN TEKSTİL AŞ. BUILDINGS AND PREMISES

Internet access is provided to our visitors who request it throughout the period of time they spend in buildings and premises of Akın Tekstil AŞ. for ensuring the security and for the purposes set forth in this Policy. In that case, the log records relating to your internet access are recorded in accordance with the Law No. 5651 and the mandatory provisions of the legislation enacted on the basis of the said Law, and these records are processed if required by the authorized public institutions and organizations or to fulfill our legal obligation during the inspection processes to be carried out at Akın Tekstil AŞ.

In this framework, the log records to be obtained can only be accessed by a limited number of Akın Tekstil AŞ. employees. Akın Tekstil AŞ. employees who have access to such records access these in order to use them upon demands from the competent public authorities and entities or during audit processes and share these only with legally authorized persons. The limited number of persons with access to the footage declares to keep the data accessed by them by virtue of a confidentiality agreement.

PART 9 9 - CONDITIONS FOR DELETION, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA

As laid down in article 138 of the Turkish Criminal Code no. 5237 and articles 5 and 6 of PDP Law, Akın Tekstil AŞ. deletes, destroys or anonymizes the personal data when it is no longer necessary to process such personal data, upon direct demand of the data controller or the personal data subject in accordance with provision of the relevant law.

9.1. OBLIGATION OF AKIN TEKSTİL AŞ. DELETE, DESTROY AND ANONYMIZE PERSONAL DATA

It is is no longer required to process personal data, as laid down in article 138 of the Turkish Criminal Code no. 5237 and articles 5 and 6 of PDP Law, it is required to delete, destroy or anonymize personal data upon direct demand of the data controller or the personal data subject.

It is imperative to adhere to general principles specified in article 4 of PDP Law as well as technical and administrative measures required to be taken as per article 12, provision of the relevant legislation, decisions of the Board and personal data storage and destruction policy while deleting, destroying or anonymizing the personal data.

All transactions carried out regarding the erasure, destruction and anonymization of personal data are recorded, and these records are kept for at least three years, excluding other legal obligations.

The data controller is obliged to describe methods implemented for erasure, destruction or anonymization of personal data in its relevant policies and procedures.

Unless otherwise decided by the Board, the data controller chooses the suitable one among methods of direct erasure, destruction or anonymization. It chooses the suitable method upon demand of the relevant person.

9.2.TECHNIQUES FOR DELETION, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA

9.2.1.Techniques for Deletion and Destruction of Personal Data

Erasure of personal data is the process of making personal data inaccessible and non-reusable for the users concerned. The data control is obliged to take all necessary technical and administrative measures to make the erased personal data inaccessible and non-reusable for the users concerned.

Destruction of the personal data is a process, by which personal data are made inaccessible, non-recoverable, or non-reusable for anyone. The data controller is obliged to take all necessary technical and administrative measures for the destruction of personal data.

Akın Tekstil AŞ. may delete or destroy personal data controller although such data has been processed in accordance with provisions of the relevant law, in the event that it is no longer required to process personal data upon direct demand of the data controller or the personal data subject. Most common erasure or destruction techniques used by Akın Tekstil AŞ. are listed below.

(i) Physical Destruction

The personal data can be processed by non-automated means, provided that it is part of any data recording system. The system requires physical destruction of the personal data while the data is erased / destroyed in a way that it cannot be used subsequently.

(ii) Secure Erasure from the Software

While any data processed by fully or partially automated ways and stored in digital media is deleted/destroyed, methods that enable to erase the data irretrievably from the related software are used.

(iii) Secure Erasure by a Specialist

In some cases, Akın Tekstil AŞ. can agree with a specialist to erase the personal data on its behalf. In this case, the personal data is erased/destroyed securely and irretrievably by the person skilled in the art.

9.2.2.Techniques for Anonymization of Personal Data

Anonymization of personal data is rendering personal data impossible to link with an identified or identifiable natural person, even through matching them with other data;

In order to anonymize personal data, the personal data must be rendered impossible to associate with a specific or identifiable natural person, even by using the suitable techniques for the recording medium and relevant field of activity, such as the return of data by the data controller or recipient groups and/or matching the data to other data. The data controller is obliged to take all necessary technical and administrative measures for the anonymization of personal data. Akın Tekstil AŞ. may anonymize personal data when the causes for the lawful processing of personal data cease to exist.

Any personal data made anonym in accordance with Article 28 of the LPPD can be processed for research, planning and statistical purposes. Such operations are outside the scope of the PDP Law and will not require explicit consent of the personal data subject. Personal data processed through anonymization will be excluded from scope of PDP Law, thereby, rights laid down in Part 10 of this Policy do not apply to such data. Most common anonymization techniques used by Akın Tekstil AŞ. are listed below.

(i) Masking

Data masking is a method of reoving the basic decisive information of the personal data and anonymizing the personal data.
Example: Transforming the personal data into a set of data from which it is impossible to identify the personal data subject by removing name, T.R. ID number that helps identify the personal data subject

(ii) Amalgamation

A great deal of data is amalgamated by way of data amalgamation personal data is given a form which cannot be associated with any one.

Example: Indicating that there are Z number of employees aged X without individually showing ages of employees.

(iii) Data Data Derivation

A content more general than the content of the personal data is generated with the data derivation method and it is ensured that the personal data takes a form that cannot be associated with anyone.

Example: Indicating ages instead of dates of birth; specifying the area of residence instead of mailing address.

(iv) Data Mixing

By mixing values within the personal data set through data mixing method ensures that the connection between values and persons is broken.

Example: Changing quality of audio records and giving them a form that may not be associated with the data subject.

9.2.3.Periods for direct erasure, destruction or anonymization of Personal Data

(1) The data controller who has prepared personal data retention and destruction policy erases, destroys or anonymize the personal data at the first destruction process that succeeds the date when the obligation to erase, destroy or anonymize personal data has arisen.
(2) Time interval during which the periodic destruction is to take place is established by the data controller within the personal data retention and destruction policy. Under no circumstances may such period exceed six months.
(3) The data controller who is not obliged to prepare personal data retention and destruction policy erases, destroys or anonymize the personal data within three months following the date when the obligation to erase, destroy or anonymize personal data has arisen.
(4) The Board may shorten such periods in the event that irreparable or impossible damages occur and an explicit breach of the law arises.

9.2.4. Erasure and destruction periods for Personal Data upon demand of the person concerned

(1) When the person concerned applies to the data controller and requests erasure or destruction of the personal data concerning him or her as per article 13 of the PDP Law;

a) if conditions for processing of personal data have been fully eliminated, the data controller erases, destroys or anonymizes the personal data subject to such request. The data controller finalizes the request of the person concerned within thirty days at the latest and informs the person concerned.
b) if conditions for processing of personal data have been fully eliminated and information which is the subject of the request has been transferred to third persons, the data controller will notify the third person of this situation and ensure that the necessary actions are taken by the third person.
c) If not all conditions for processing of personal data have been eliminated, such request may be rejected with an explanation of the reason by the party in charge as per article 13 of the PDP Law and the rejection will be notified to the person concerned either in writing or electronically within no later than thirty days.

PART 10 10 - RIGHTS OF PERSONAL DATA SUBJECTS; PROCEDURE FOR EXERCISING AND EVALUATION OF SUCH RIGHTS

Akın Tekstil AŞ. notifies the data subject of his or her rights under article 10 of the PDP Law, guides the data subject on how to exercise such rights, and Akın Tekstil AŞ. conducts necessary channels, internal operation, administrative and technical regulations in line with article 13 of the PDP Law in order for data subjects to exercise their rights and inform data subjects.

10.1 RIGHTS OF THE DATA SUBJECT AND EXERCISE OF SUCH RIGHTS

10.1.1.Rights of the Personal Data Subject

Personal data subjects are entitled to:

(1)   Learn whether his/her personal data are processed or not,
(2)   Request information if his/her personal data are processed,
(3)   Learn the purpose of processing of the personal data and whether the data have been used in accordance with that purpose,
(4)   Know the third parties at home or abroad to whom personal data have been transferred,
(5)   Request correction of personal data if they are incomplete or incorrectly processed and ask that the process carried out in this context be notified to the third parties to whom personal data have been transmitted,
(6)   Request deletion or destruction of your personal data if the reasons for processing the same have ceased to exist, although it has been processed in accordance with the PDP Law and other relevant laws, and notification of third parties to whom your personal data are transmitted regarding the process carried out in this respect;
(7)   Raise an objection to any unfavorable result they suffer from due to analysis of processed data only by means of automatic systems,
(8)   To claim compensation for the damage arising from the unlawful processing of his/her personal data.

10.1.2.Events Whereby the Personal Data Subject may not Assert his or her Rights

The personal data subjects cannot assert their rights mentioned in 10.1.1. in accordance with Article 28 of the PDP Law because the following circumstances are excluded from the scope of the PDP Law:

(1)   Processing of Personal Data is necessary for the prevention of crime or for a criminal investigation,
(2)   Any personal data made public by the personal data subject is processed;
(3)   Processing of the personal data is necessary for the execution of inspection or regulation duties or disciplinary investigation or inquiry by the authorized and competent public authorities and entities, or professional institutions that are in the nature of a public institution based on the authorities granted to them by the laws,
(4)   is necessary for protection of economic and financial interests of State related to budget, tax and financial matters.

10.1.3.Exercise by the Personal Data Subject of his/her Rights

Personal data subjects may submit their requests associated with their rights listed under heading 10.1.1. of this part to Akın Tekstil AŞ., free of charge, along with identification information and documents with following methods or other methods fixed by the Personal Data Protection Board by completing and signing the application form:
personal delivery of a copy bearing wet signature of the form available at www.akintekstil.com.tr after completing it or sending such form through a notary office to BAKIRKÖY OSMANİYE MAH. ÇIRPICI KOŞUYOLU SOK. NO:5/1-2-3-4, 34144 / ISTANBUL

In order for third persons to file a request on behalf of the personal data subjects, the data subject should issue a special power of attorney authorizing the person who is to file the application.

10.1.4. Right of the Personal Data Subject to file a Complaint at PDP Board

If the application is rejected, the answer given is found inadequate or the application is not responded in due time, the personal data subject may file a complaint at the PDP Board within thirty days from the date, when he/she learns the response of Akın Tekstil AŞ. but within sixty days from the date of application pursuant to article 14 of the PDP Law.

10.2. RESPONSE BY AKIN TEKSTİL AŞ. TO APPLICATIONS

Akın Tekstil AŞ. may, in its capacity as the data controller under the PDP Law, may, directly or indirectly, send a response to applicants due to personal data collected from respective persons.

10.2.1. Procedure and Period of Responding to Applications of Akın Tekstil AŞ.

If the personal data subject submits his/her request to Akın Tekstil AŞ. in accordance with the procedure specified in the heading 10.1.3. of this part, Akın Tekstil AŞ. will conclude the request free of charge within thirty days at the latest according to the nature of the request. However, if the PDP Board sets a fee, Akın Tekstil AŞ. will charge the applicant the fee specified in the tariff established by PDP Board.

10.2.2. Information to be Demanded by Akın Tekstil AŞ. from the Applicant Personal Data Subject

Akın Tekstil AŞ. may require the relevant person any information to determine whether the applicant is a personal data subject or not. To clarify the matters set forth in the application of the personal data subject, Akın Tekstil AŞ. may ask questions about the application of the personal data subject.

10.2.3.The Right of Akın Tekstil AŞ. to Reject the Application of the Personal Data Subject

Akın Tekstil AŞ. may reject the application of the applicant, in following circumstances, by explaining the reason of such rejection:

(1)   Processing of personal data for official statistics and purposes such as research, planning and statistics by anonymizing the data;
(2)   Processing of personal data within the scope of artistic, historical, literal, or scientific purposes, provided that such processing shall not violate national defense, national security, public security, public order, economic security, confidentiality of private life, or personal rights, or constitute any crime;
(3)   Processing of personal data within the scope of the preventive, protective, and intelligence activities conducted by the competent legal public institutions and organizations with the intent of maintaining national defense, national security, public security, public order, or economic security;
(4)   Personal data are processed by judicial authorities or execution authorities with regard to investigation, prosecution, judicial or execution proceedings.
(5)   Processing of Personal Data is necessary for the prevention of crime or for a criminal investigation,
(6)   Any personal data made public by the personal data subject is processed;
(7)   Processing of the personal data is necessary for the execution of inspection or regulation duties or disciplinary investigation or inquiry by the authorized and competent public authorities and entities, or professional institutions that are in the nature of a public institution based on the authorities granted to them by the laws,
(8)   is necessary for protection of economic and financial interests of State related to budget, tax and financial matters.
(9)   Request by the personal data subject is likely to prevent rights and freedom of other people
(10) The request requires a disproportionate effort.
(11) The information requested is in the public domain.

ANNEX-1 DEFINITIONS

Explicit consent: Means a consent that relates to a specified issue, declared by free will and based on information.

Anonymization: Changing the personal data so that the data is no longer personal data and this cannot be undone. Example: Giving personal data a form that cannot be associated with a natural person through techniques such as masking, amalgamation and data corruption, etc.

Application Form: “Application Form Regarding Applications to be Filed with Data Controller by the person Concerned (Personal Data Subject) as per Law on Protection of Personal Data no. 6698” that contains the application to be filed by personal data subjects for exercising their rights.

Job Applicants: Natural persons who have applied for a job at Akın Tekstil AŞ. by any means or who have granted the company access to their CVs and related information.

Processing of Personal Data: Means any operation performed upon personal data such as collection, recording, storage, retention, alteration, re-organization, disclosure, transferring, taking over, making retrievable, classification or preventing the use thereof, fully or partially through automatic means or provided that the process is a part of any data registry system, through non-automatic means.

Personal Data Subject: The natural person whose personal data is being processed, E.g. employees.

Personal Data: Means any kind of information relating to an identified or identifiable natural person Therefore, the processing of information regarding legal entities is not covered by the Law E.g., name-surname, TR ID no, e-mail, address, date of birth, credit card number, etc.

Sensitive Personal Data: Means any biometric or genetic data relating to racial or ethnic origin, political opinion, philosophical and religious beliefs, sect, or other beliefs, dressing, membership of an association, a foundation or a trade union, health, sexual life, the sentence of any punishment and security measures.

Supplier: Parties rendering services in compliance with the company’s orders and instructions and on a contractual basis whilst Akın Tekstil AŞ. carries out its business operations

Third Person: Natural persons whose personal data is being processed under this Policy, who have been defined differently under this Policy (family members of employees and former employees).

Data Processor: A real and legal entity that processes personal data on behalf of the data controller based on the authority vested by the latter. E.g., HR department, IT department, finance and accounting department, etc., which keep personal data of employees of Akın Tekstil AŞ.

Data Controller: The person who determines the purposes and means of processing personal data, and manages the place where the data is kept systematically.

Visitor: Natural persons, in their capacity as visitors, entering the physical premises owned by Akın Tekstil AŞ. for various purposes.

ANNEX-4 PROCESSING OF PERSONAL DATA OF JOB APPLICANTS

COLLECTION AND PROCESSING OF PERSONAL DATA	EXERCISE OF RIGHTS AND APPLICATION
Personal data of Job Applicants collected during recruitment process and sensitive data collected according to nature of the job is processed by Akın Tekstil AŞ. for purposes specified in part 4.2. and 7 of this Policy, which are listed below: • Evaluation of Job Applicants' qualifications, experience, interest and suitability for the open position, • If necessary, checking information given by Job Applicants for correctness or conducting an investigation about Job Applicants by contacting third persons, • Contacting the Job Applicants about application and recruitment process, or, if suitable, contacting the candidate for a position that may subsequently open at home or abroad, • Meeting requirements of the related legislation or demands of competent institutions or organizations, • Enhancing hiring principles implemented by Akın Tekstil AŞ. Personal data of Job Applicants may be collected through following methods and means: • Hardcopy application form or digital application form published electronically; • Resumes sent by Job Applicants to Akın Tekstil AŞ. through e-mail, courier, reference and other similar methods; • Employment or consultancy firms; • During interview in cases where an interview is conducted through video conference, phone or face-to-face; • Checks made to confirm the accuracy of the information provided by Job Applicants and researches carried out by Akın Tekstil AŞ; • Recruitment tests applied by experienced specialists of which results are examined to establish personal traits.	The Job Applicants may submit their requests regarding their rights arising out of being data subject to Akın Tekstil AŞ. with the method described in Part 10 of this Policy.

COLLECTION AND PROCESSING OF PERSONAL DATA

EXERCISE OF RIGHTS AND APPLICATION

Personal data of Job Applicants collected during recruitment process and sensitive data collected according to nature of the job is processed by Akın Tekstil AŞ. for purposes specified in part 4.2. and 7 of this Policy, which are listed below:
• Evaluation of Job Applicants' qualifications, experience, interest and suitability for the open position,
• If necessary, checking information given by Job Applicants for correctness or conducting an investigation about Job Applicants by contacting third persons,
• Contacting the Job Applicants about application and recruitment process, or, if suitable, contacting the candidate for a position that may subsequently open at home or abroad,
• Meeting requirements of the related legislation or demands of competent institutions or organizations,
• Enhancing hiring principles implemented by Akın Tekstil AŞ.

Personal data of Job Applicants may be collected through following methods and means:
• Hardcopy application form or digital application form published electronically;
• Resumes sent by Job Applicants to Akın Tekstil AŞ. through e-mail, courier, reference and other similar methods;
• Employment or consultancy firms;
• During interview in cases where an interview is conducted through video conference, phone or face-to-face;
• Checks made to confirm the accuracy of the information provided by Job Applicants and researches carried out by Akın Tekstil AŞ;
• Recruitment tests applied by experienced specialists of which results are examined to establish personal traits.

The Job Applicants may submit their requests regarding their rights arising out of being data subject to Akın Tekstil AŞ. with the method described in Part 10 of this Policy.