Law on the Protection of Personal Data

As Güneş Melamin, we attach great importance to the privacy and security of your personal data.

In this context, it is one of our priorities to process and store all kinds of personal data belonging to all individuals associated with Güneş Melamin, including our customers and business connections benefiting from our products and services, in accordance with the Law on the Protection of Personal Data No. 6698 (“KVKK”). With the title of "Data Controller" we bear pursuant to KVKK and with the awareness of this responsibility, we would like to inform you about the purposes of processing your personal data, the methods and reasons for collecting your data, your rights regarding the processing of your personal data, and the application procedures and principles, which are the methods of exercising these rights, as follows.

a. What is Personal Data? Which Personal Data do we collect?

Personal data refers to any information relating to you such as identity information (name, surname, Turkish ID number, etc.), address and telephone information, vehicle and license plate information, family status information, IP address, bank account information (“Personal Data”); and Special Categories of Personal Data, which is a special type thereof, refers to sensitive personal data such as your race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, association, foundation or union membership, health, sexual life, criminal conviction and security measures, and your biometric and genetic data (“Special Categories of Personal Data”). The explanations we make for your Personal Data on this page also cover your Special Categories of Personal Data.

In this context, as Güneş Melamin, we collect Personal Data belonging to our customers, business connections, employees, employee candidates, platform (internet / mobile sites and applications) users, visitors, officials and employees of institutions with whom we have subcontractor and similar business relationships, in accordance with KVKK when necessary. We can detail the Personal Data we collect as follows:

• Identity Data: Data regarding the identity of the person such as name, surname, T.R. identity number, photocopy of identity card collected from our customers, business connections, employees, employee candidates, platform (internet / mobile sites and applications) users, visitors, officials and employees of institutions with whom we have subcontractor and similar business relationships.
• Communication Data: Data that enables communication with the person such as phone number, address, e-mail address, IP address collected from our customers, business connections, employees, employee candidates, platform (internet / mobile sites and applications) users, visitors, and officials and employees of institutions with whom we have subcontractor and similar business relationships.
• Data on Family Members: Data about the family members and relatives of the relevant person collected from our employees, employee candidates, and officials and employees of institutions with whom we have subcontractor and similar business relationships, due to relevant legislation requirements and/or to protect the legal and other interests of our Company or the relevant person.
• Financial Data: Data such as wage, salary information, bank account information collected from our employees, employee candidates, customers, business connections, officials and employees of institutions with whom we have subcontractor and similar business relationships, according to the legal relationship our Company has established with the relevant data owner.
• Personnel Data: All kinds of personal data that form the basis for the formation of personal rights of real persons who have a working relationship with our Company, collected from our employees, employee candidates, and employees of institutions with whom we have subcontractor and similar business relationships.
• Physical Space Security Data: Personal data such as security and camera recordings taken at the entrance to the physical space and during the stay inside the space from our customers, business connections, employees, employee candidates, visitors, and officials and employees of institutions with whom we have subcontractor and similar business relationships.
• Communication and Complaint Management Data: Personal data obtained from our customers, business connections, platform (internet / mobile sites and applications) users, visitors, officials and employees of institutions with whom we have subcontractor and similar business relationships during the processes of receiving and evaluating all kinds of requests or complaints directed to our Company.
• Special Categories of Personal Data: Data such as health data, biometric data (voice and image recordings), religion and association, union membership information specified in Article 6 of KVKK, collected from our customers, business connections, employees, employee candidates, visitors, officials and employees of institutions with whom we have subcontractor and similar business relationships.
• Other Data: Data processed for technical transaction security, purchasing information, cookies, and data collected through automatic means via other tools collected from our customers, business connections, employees, employee candidates, platform (internet / mobile sites and applications) users, and officials and employees of institutions with whom we have subcontractor and similar business relationships.

b. Through Which Methods and For What Legal Reasons Do We Collect / Process Your Personal Data?

We collect your Personal Data automatically or non-automatically, verbally, orally, in writing, or electronically through the following main purposes and methods and other channels that may be added to these in the future.

We collect your Personal Data via our internet and mobile platforms (internet / mobile sites and applications), through our social media accounts operated on behalf of Güneş Melamin on various social media channels, via our call center managed by Güneş Melamin, through other communication methods including e-mail, short messages (“SMS”) or multimedia messages (“MMS”), within the scope of Güneş Melamin sales and marketing activities through Contracts signed with you or the company you are authorized to represent, commercial offers presented, printed and electronic forms, business cards and other documents given by you during customer visits, through third parties such as Güneş Melamin group companies, business connections, dealers and sales channels, manufacturer companies or companies supplying services/products, and through various channels including sources such as the Trade Registry, provided that it is verbal, written or electronic, by fully or partially automatic means or non-automatic means as part of any data recording system.

We process your Personal Data collected in line with the above methods based on one or more of the following legal grounds:

• Existence of your explicit consent,
• Provisions of laws and regulations in force in the Republic of Turkey permitting the processing,
• Being mandatory for the protection of life or physical integrity of yourself or someone else when you are unable to disclose your consent due to actual impossibility,
• Being necessary for the performance of the contract we have concluded with you or your company,
• Processing of your Personal Data being necessary for the fulfillment of our legal obligations,
• Your Personal Data having been made public by you,
• Being necessary for the exercise or protection of our legal or contractual rights as Güneş Melamin,
• Processing of your Personal Data being necessary for our legitimate interests, provided that it does not harm your fundamental rights and freedoms.

As Güneş Melamin, we store all Personal Data we process in accordance with the periods required by KVKK and other legislation and in any case by taking all necessary administrative and technical measures as long as the above legitimate purposes do not disappear.

c. For What Purpose Do We Process Your Personal Data?

We process your collected Personal Data for the following general purposes according to its nature:

1. Fulfillment of the requirements of contracts concluded by Güneş Melamin, procurement, production, sales, delivery, and installation of offered products and services, carrying out necessary work and evaluations to improve products and services and to make you benefit from them, carrying out after-sales maintenance and repair operations
2. Follow-up and fulfillment of obligations arising from consumer legislation and answering consumer applications
3. Follow-up, evaluation of requests and complaints of relevant persons such as customers and consumers and providing support services, consumer satisfaction management and implementation of planning, statistics, and satisfaction surveys in this context
4. Conducting quality assessment and improvement works to provide better and reliable products and services and ensure sustainability, auditing suppliers, subcontractors, and persons with whom we have similar business relationships
5. Carrying out advertising and marketing activities regarding products and services offered by Güneş Melamin, informing about promotion, campaigns, offers, events, and similar issues and new products and services, carrying out corporate communication activities
6. Carrying out Marketing and CRM (Customer Relationship Management) studies
7. Organizing corporate communication and other events and invitations in this context and informing about them, conducting market research studies
8. Improving digital platforms we offer to the use of our customers, consumers, and business connections, extracting statistics such as the number, type, visit frequency, behaviors, geographical locations of users to provide an efficient and personalized experience to platform users, offering personalized content, campaigns, and advertisements according to the interests and needs of platform (internet and mobile site and applications) users, using cookies for this purpose
9. Ensuring the legal and commercial security of persons in a business relationship with Güneş Melamin (Planning of administrative operations regarding communication carried out by our Company, ensuring the physical security and audit of Company locations, business partner/customer/supplier (authorized or employees) evaluation and audit processes, legal compliance process, etc.)
10. Exercise of legal rights, use of transaction history information as evidence in case of dispute after the termination of the legal relationship
11. Determination and implementation of Güneş Melamin commercial, legal, and business strategies
12. Execution of Güneş Melamin human resources, accounting/finance policies
13. Planning, auditing, and execution of information security processes
14. Compliance with domestic and international legislation, provision of information requested by public institutions and organizations, fulfillment of reporting obligations.

d. Transfer of Personal Data and Processing of Personal Data by Third Parties

The Company may transfer personal data to a third real or legal person in accordance with KVKK regulations. In this case, the Company ensures that the third parties to whom it transfers data also comply with this Policy. In this context, necessary protective regulations are added to the contracts concluded with the third party.

• Transfer of personal data to third parties in Turkey; Personal Data may be transferred by the Company to third parties in Turkey without seeking explicit consent in exceptional cases specified in Article 5.2 and Article 6.3 of KVKK or by obtaining the Explicit Consent of the Relevant Person in other cases (KVKK Article 5.1 and Article 6.2).
• Transfer of personal data to third parties abroad; Personal Data may be transferred by the Company to third parties abroad without seeking explicit consent in exceptional cases specified in Article 5.2 and Article 6.3 of KVKK or by obtaining the Explicit Consent of the Relevant Person in other cases (KVKK Article 5.1 and Article 6.2). However, the existence of one of the following conditions is required regarding the foreign country to which the transfer will be made.
• The foreign country where personal data is transferred must have the status of countries with adequate protection by the Board
• If the foreign country where the transfer will take place is not on the Board's list of safe countries, provided that the Company and the Data Controllers in the relevant country commit in writing to provide adequate protection and obtain permission from the Board

e. Your Rights and Application Procedure

e.1. Your Rights Regarding Your Personal Data

We would like to state that you have the following rights regarding your data being processed within Güneş Melamin and its subsidiaries:

1. To learn whether your Personal Data is processed,
2. If your Personal Data has been processed, to request information regarding this,
3. To learn the purpose of processing your Personal Data and whether your personal data is used in accordance with its purpose,
4. To know the third parties to whom data is transferred domestically or abroad, if any, and which data is transferred,
5. To request correction of processed Personal Data if it is incomplete or incorrect,
6. To request notification of these transactions to third parties to whom your Personal Data has been transferred in case of correction, deletion, or destruction of your personal data,
7. To request the deletion or destruction of your processed Personal Data in the event that the reasons requiring the processing of your Personal Data disappear or your Personal Data loses its currency,
8. To object to the occurrence of a result against you by analyzing your processed Personal Data exclusively through automated systems,
9. To demand compensation for the damage if you suffer damage due to the unlawful processing of your Personal Data.

e.2. Application

You can make your requests regarding your Personal Data by filling out the application form linked below:

1. By delivering it to the information desk at our company address located in the Data Controller Identity Information field or by sending a notification via Notary to the same address,
2. By registered electronic mail.

Güneş Melamin will conclude the requests directed to it free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request. In case a cost arises due to the fulfillment of your requests, we may request fees from you only in the tariff determined by the Personal Data Protection Board.

As a result of the requests directed to Güneş Melamin, we may accept the requests or reject them by explaining the reason and forward this response to the requesting person in writing or electronically. If the request is accepted, as Güneş Melamin, we are obliged to fulfill the requirement of the request immediately.

e.3. Complaint

In case your requests directed to Güneş Melamin are rejected by Güneş Melamin, you are not satisfied with the response given by Güneş Melamin, or no response is given, you may file a complaint with the Personal Data Protection Board within 30 (thirty) days from the date the response is notified to you, and within 30 days from the end of the 30 (thirty) day period if no response is given.

f. Data Controller Identity Information

The expression Güneş Melamin used in this text is arranged for the Güneş Melamin subsidiary established in Turkey whose information is given below and is addressed to the relevant persons of the data for which the company specified below is the data controller:

Address: Mercan Mahallesi, Tacirhane Sk. 21/A, 34116 Fatih - İstanbul

Phone: +90 212 512 95 69

E-mail: info@gunesmelamin.com.tr

Application Form Within the Scope of KVKK

Personal data owners defined as the relevant person in the Law on the Protection of Personal Data No. 6698 (“KVK Law”) (hereinafter referred to as “Applicant”) have been granted the right to make certain requests regarding the processing of their personal data in Article 11 of the KVK Law. Pursuant to the first paragraph of Article 13 of the KVK Law; applications to be made to our Company, which is the data controller, regarding these rights must be submitted to us personally, in writing in Turkish, and by the following methods determined by the Personal Data Protection Board (“Board”).

Below is information on how written applications will be delivered to us.

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller (Official Gazette dated 10/03/2018 and numbered 30356), the following information is mandatory in applications.

Information to be Filled During Application:

• Name, surname, and signature if the application is written,
• For citizens of the Republic of Turkey, T.R. identity number; for foreigners, nationality, passport number or identification number if any,
• Residence or workplace address for notification,
• Electronic mail address, telephone, and fax number for notification if any,
• Subject of request

Additionally, information and documents related to the subject are attached to the application.

In case you want to make an application regarding your personal data, the application form below must be filled out completely. This application form has been issued to determine your relationship with our Company, to completely determine your personal data processed by our Company, if any, and to respond to your relevant application correctly and within the legal period. Our Company reserves the right to request additional documents and information (copy of identity card or driver's license, etc.) for identity and authority determination in order to eliminate legal risks that may arise from unlawful and unjust data sharing and especially to ensure the security of your personal data. In case the information regarding your requests you transmit within the scope of the form is not correct and up-to-date or an unauthorized application is made, our Company does not accept liability for requests arising from such incorrect information or unauthorized application.

Your applications submitted to us will be answered in writing free of charge within thirty days at the latest from the date your request reaches us, depending on the nature of the request, pursuant to paragraph 2 of Article 13 of the KVK Law.