General Data Protection Regulation

TOSYALI DEMİR ÇELİK DISCLOSURE TEXT ON PROTECTION AND PROCESSING OF PERSONAL DATA

Tosyalı Demir Çelik SAN.A.Ş. attaches importance to the security of all personal data belonging to all persons associated with our company and the processing and storage of personal data in accordance with the Personal Data Protection Law No. 6698. Tosyalı Demir Çelik SAN.A.Ş. Disclosure Text on the Protection and Processing of Personal Data has been issued pursuant to Article 10 of the Personal Data Protection Law (“PDPL”) and other relevant legislation, in order to inform and enlighten the real person during the acquisition of personal data.

Tosyalı Demir Çelik SAN.A.Ş. Disclosure Text on the Protection and Processing of Personal Data has been issued pursuant to Article 10 of the Personal Data Protection Law (“PDPL”) and other relevant legislation, in order to inform and enlighten the real person during the acquisition of personal data.

1- IDENTITY OF DATA OWNER

Pursuant to Personal Data Protection Law No. 6698, Tosyalı Demir Çelik SAN.A.Ş. has the capacity of data owner as defined in PDPL.

2- PROCESSING OF PERSONAL DATA AND PURPOSES OF PROCESSING

Your personal data will be processed in accordance with the personal data processing conditions and purposes specified in articles 5 and 6 of PDPL, by being used, recorded, stored, updated, transferred and/or classified in accordance with the principles of personal data processing in article 4 of PDPL, for the purposes of helping you and/or organizations you are representing benefit from the products and services offered by our Company; determining and implementing commercial and business strategies of our Company; conducting marketing, business development and planning activities; conducting administrative operations of our corporate communication; ensuring the physical security and control of our Company's locations; establishing business partner / customer / supplier (authorized or employees) relationships; fulfilling contractual and financial reconciliation requirements regarding the products and services offered with our business partners, suppliers or other third parties; carrying out our Company’s human resources policies; contacting our company's call center or using the website; and/or participating in trainings, seminars or events organized by our Company. You will be responsible for ensuring that the personal data you submit to our Company is accurate, complete and up to date, and that any necessary changes have been notified.

3- PERSONAL DATA TRANSFER

Your personal data may be transferred to Tosyalı Demir Çelik SAN.A.Ş. group companies, affiliates and subsidiaries, Company officials and shareholders; companies authorized by and operating on behalf of the Company; our representatives; regulatory and supervisory bodies; public organizations expressly authorized to request your personal data under applicable law; business partnerships; suppliers and contractors, banks, credit risk and financial institutions, and other real or legal persons for the specified purposes; tax and similar consultants; compulsory persons, institutions and organizations related to legal follow-up processes; third parties from which we receive consultancy services, including auditors; business partners, third parties, and authorized persons and organizations both in Turkey and abroad; and legally authorized public organizations and natural persons, pursuant to personal data processing conditions and purposes specified in Articles 8 and 9 of PDPL, within the limits set by the laws and other legislative provisions (limited to the fulfillment of the aforementioned objectives and the fulfillment of the obligations imposed by the relevant legislation).

4- THE LEGAL REASON FOR AND THE METHOD OF PERSONAL DATA COLLECTION

Your personal data can be collected either verbally, in writing or electronically, by automatic or non-automatic methods through offices, branches, call centers, websites, social media, mobile applications, etc. Your personal data will be stored in electronic and/or physical environments. Our company designs the necessary business processes and develops technical and security infrastructures in order to prevent unauthorized access, manipulation, loss and damage of your personal data in the environments in which they are stored. Your personal data will be processed by taking all necessary information security measures and provided that they are not used beyond specified purposes and scope and will be stored for the duration of the statutory retention period or, if such a period is not foreseen, as required by the processing purpose. At the end of this period, your personal data will be removed from our company's data flows by deletion, destruction or anonymization methods. Your personal data collected for this legal reason may also be processed and transferred for the purposes specified in Articles (2) and (3) of this text, under the personal data processing conditions and purposes specified in Articles 5 and 6 of the PDPL.

5- RIGHTS OF PERSONAL DATA HOLDER

The rights of the Personal Data Holder as set out in Article 11 of the Personal Data Protection Law:

ARTICLE 11- “(1) Everyone is entitled to contact the data owner to:

a) learn whether personal data are processed,

b) request information if personal data have been processed,

c) learn the purpose of processing personal data and whether they are used in accordance with their purpose,

ç) know the third parties to which personal data is transferred locally or internationally,

d) request correction of any missing or incorrectly processed personal data,

e) request the deletion or destruction of personal data pursuant to conditions provided for in Article 7 of the PDPL (if the reasons for processing the data disappear, even though they have been processed in accordance with the provisions of the PDPL and other relevant laws),

f) request that the transactions carried out in accordance with paragraphs (d) and (e) be notified to the third parties to whom the personal data are transferred,

g) object to a result obtained against him/herself from the analysis of processed data exclusively,

ğ) request compensation for any damages arising from unlawful processing of personal data.

“Pursuant to paragraph 1 of Article 13 of the PDPL, you may submit your request to exercise your aforementioned rights in writing or by other methods specified by the Personal Data Protection Board. Our company will conclude your request free of charge within maximum thirty days according to the nature of your request. However, if the transaction entails a separate cost, the tariff set by the Personal Data Protection Board will be charged. The channels and procedures for submitting your application in writing to our Company in accordance with Article 11 of PDPL are explained below. Your original signed petition to use your aforementioned rights:

Your petition can be personally delivered to Org.San.Böl.Necati Özsoy Cad.No:12 Sarıseki İskenderun / HATAY along with the documents proving your identity,
Or sent to the same address (Org.San.Böl.Necati Özsoy Cad.No:12 Sarıseki İskenderun / HATAY) via notary public,
Or sent to info@toscelik.com.tr with secure electronic signature. Our Company reserves the right to update this Disclosure Text on the Protection and Processing of Personal Data at any time in line with amendments to the applicable legislation and changes to Tosyalı Demir Çelik A.Ş.'s Policy on Processing and Protection of Personal Data.