Personal Data Protection and Processing Policy

This English translation is provided for information only. In case of any discrepancy, the Turkish version prevails.

DELTA İŞ MAKİNALARI TAMİR YEDEK PARÇA SAN. TİC. LTD. ŞTİ.

A. About the Policy

This Personal Data Protection and Processing Policy (the “Policy”) has been prepared in order to explain how we, as DELTA İŞ MAKİNALARI TAMİR YEDEK PARÇA SAN. TİC. LTD. ŞTİ. (“Delta İş Makinaları” or the “Company”), process personal data, the measures we take to protect personal data, and the rights of personal data owners (data subjects).

The Policy covers all natural persons whose personal data are processed by our Company, with the exception of our Company’s employees.

We recommend that you read this Policy together with the privacy (information) notice(s) we have provided to you within the scope of your relationship with us.

We may need to update the Policy from time to time due to changes in legislation and changes in our personal data processing activities. The date on which the Policy was last updated and the parts of the text changed by the update are indicated in the introduction of the Policy.

For all your questions regarding the Policy and the processing of your personal data, you can reach us using the contact details in the final section of the Policy.

B. Definitions Used in the Policy

The terms used in the Policy and their explanations are set out in the table below. Definitions not specified in the table shall be deemed to be used as defined in Law No. 6698 on the Protection of Personal Data and the secondary regulations.

C. What Is Personal Data?

Personal data means any information relating to an identified or identifiable natural person. In other words, any information that identifies a person or serves to identify that person is personal data. For example, your identity number, educational status, age and shopping habits are your personal data.

D. What Is the Processing of Personal Data?

The processing of personal data means any operation performed on data such as the obtaining, recording, storage, retention, alteration, reorganization, disclosure, transfer, takeover, making available, classification or prevention of the use of personal data, wholly or partially by automated means or by non-automated means provided that they form part of any data recording system.

The processing of personal data wholly by automated means refers to data processing that takes place automatically through information systems without any human intervention. For example, the taking of camera recordings or data processing by means of an algorithm.

The processing of personal data partially by automated means refers to data processing carried out partly with human intervention and partly automatically (through information systems). For example, the collection of personal data through a website contact form.

The processing of personal data by non-automated means provided that they form part of a data recording system refers to data processing by making operations carried out manually (with human intervention) part of a data recording system (by filing them or entering them into a computer program).

E. Who Is the Data Controller?

With respect to the personal data processing activities it carries out while conducting the Company’s operations, Delta İş Makinaları tamir yedek parça San. Tic. Ltd. Şti. determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system in which personal data are processed. In this context, our Company acts as data controller with respect to many personal data processing activities.

In the personal data processing activities in which it acts as data controller, our Company is responsible for deciding how your personal data will be stored, used and transferred. In some cases, however, our Company does not determine the purposes and means of personal data processing; it may process personal data on the instructions of another company. In this case, the Company will be acting as a data processor under the

Law. This Policy contains information on the personal data processing activities in which the Company acts as data controller.

In some cases, Delta İş Makinaları tamir yedek parça San. Tic. Ltd. Şti and another data controller may jointly determine the purposes and means of personal data processing (there may be more than one data controller responsible for the processing of your personal data). This Policy informs you about the data processing purposes and means of Delta İş Makinaları; in order to learn how other data controllers process your personal data, please review the policy of the relevant data controller.

F. Personal Data Collected

The categories of personal data collected within the scope of our Company’s main data processing activities, and the personal data each category may include, are set out in the table below:

The personal data collected/used may vary depending on the nature of each data processing activity. Where these data vary depending on the nature of the data processing activity, our Company informs you in accordance with the obligation to inform.

G. Personal Data Collection Channels

Delta İş Makinaları tamir yedek parça San. Tic. Ltd. Şti. collects your personal data through various channels. Your personal data may be collected by you providing them directly to us (for example, when you call our customer contact line or submit a job application). In some cases, your personal data are obtained through third parties (for example, when you apply to our authorized dealers to purchase a product).

In accordance with the obligation to inform, Delta İş Makinaları tamir yedek parça San. Tic. Ltd. Şti informs data subjects of the methods by which it collects personal data.

H. Principles Observed When Processing Personal Data

Delta İş Makinaları tamir yedek parça San. Tic. Ltd. Şti acts in accordance with the principles set out below in all of its activities in which it processes personal data:

• Compliance with the law and the rules of good faith. à We carry out our data processing activities in compliance with all legislation in force, in particular Law No. 6698 and the secondary regulations.
• Being accurate and, where necessary, up to date. à We always keep open the channels that ensure your personal data are accurate and up to date.
• Being processed for specified, explicit and legitimate purposes. à We determine the purposes for which personal data will be processed and bring these purposes to the attention of the data subject in a transparent and comprehensible manner
• Being relevant, limited and proportionate to the purposes for which they are processed. à We do not process personal data that are not relevant to or not needed for the achievement of the purpose, and we do not carry out personal data processing activities aimed at meeting possible needs.
• Retention for the period stipulated in the relevant legislation or required for the purpose for which they are processed à If a period is stipulated in the legislation for the retention of personal data, we comply with that period; if no such period is stipulated, we retain personal data only for the period required for the purposes of processing.

I. Legal Grounds for Processing Personal Data

Under the Law on the Protection of Personal Data, at least one of the legal grounds (conditions for data processing) set out in the Law must exist in order for personal data to be processed. These legal grounds are regulated separately for special categories of personal data and for personal data that are not of a special category (hereinafter briefly referred to as personal data). The legal grounds for processing personal data and for processing special categories of personal data are explained below under two headings:

1. Legal Grounds for Processing Personal Data

The legal grounds for processing personal data are set out in Article 5 of the Law. According to this article, personal data

• where the data processing is expressly provided for by the laws (“Expressly provided for by the laws”),
• where it is necessary for the protection of the life or bodily integrity of the person himself/herself or of another person, where the person is unable to express his/her consent due to actual impossibility or his/her consent is not given legal validity (“Actual impossibility”),
• where the processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of a contract (“Establishment or performance of a contract”),
• where the data processing activity is necessary for the Company to fulfil its legal obligations (“Legal obligation”),
• where the personal data have been made public by the data subject himself/herself (“Made public by the data subject”),
• where the data processing is necessary for the establishment, exercise or protection of a right (“Establishment, exercise or protection of a right”),
• where the data processing is necessary for the legitimate interests of the Company, provided that it does not harm fundamental rights and freedoms (“Legitimate interest”),

may be processed if one or more of these legal grounds exist.

If none of the listed legal grounds exists, your personal data may be processed only if your explicit consent exists. If one of the specified legal grounds exists, the method of obtaining your explicit consent is not resorted to in order to process your personal data.

When determining whether a data processing activity is necessary for our Company’s legitimate interests, we are required to carry out a separate assessment. When determining the existence of the legal ground of data processing being necessary for our legitimate interests, we, as Delta İş Makinaları tamir yedek parça San. Tic. Ltd. Şti, take into account the matters set out below:

• We require that the interest to be obtained as a result of processing the personal data and the fundamental rights and freedoms of the data subject be at comparable levels,
• We take into account the requirement that the data processing be necessary in order to achieve the interest in question,
• We assess whether the legitimate interest is currently existing, specific and clear,
• We require that a benefit will be gained if the legitimate interest is achieved and that it is not possible for this benefit to arise by any other method without processing personal data,

• When determining the legitimate interest, we take into account that the benefit in question affects a large number of persons, is not aimed solely at making a profit or obtaining an economic benefit, and facilitates business processes or an operation (for example, in a way that affects the organization as a whole rather than a single unit or a small number of staff), and we base our assessment on criteria of a transparent and accountable nature such as these,
• We take measures to ensure that the data subject is kept away from any foreseeable, clear and imminent danger, in order to prevent harm to his/her fundamental rights and freedoms, in particular the protection of his/her personal data,
• We take all technical and administrative measures to ensure the lawful processing of personal data limited to the purpose and to prevent damage and breaches,
• We assess whether compliance with the general principles is ensured in the processing of personal data,
• In this context, we carry out a balancing test by comparing the fundamental rights and freedoms of the person with the legitimate interest that will arise.

2. Legal Grounds for Processing Special Categories of Personal Data

Special categories of personal data are data relating to persons’ race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data. The legal grounds for processing special categories of personal data are set out in Article 6 of the Law. According to this article, special categories of personal data

• for special categories of data other than health and sexual life, where provided for by the laws,

• for special categories of data relating to health and sexual life, where they are processed by persons under an obligation of confidentiality or by authorized institutions and organizations for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing,

may be processed if these legal grounds exist. If none of the listed legal grounds exists, your personal data may be processed only if your explicit consent exists. If one of the specified legal grounds exists, the method of obtaining your explicit consent is not resorted to in order to process your personal data.

J. Transfer of Personal Data

As with the processing of personal data, at least one of the legal grounds set out in the Law must exist in order for personal data to be transferred to third parties. When transferring personal data to third parties, Delta İş Makinaları tamir yedek parça San. Tic. Ltd. Şti carries out the transfer in accordance with the principles set out in Articles 8 and 9 of the Law. The table below sets out for which purposes and to which third parties the Company transfers personal data, and the legal grounds for the transfer:

The purposes for which personal data are transferred and the parties to which they are transferred may vary depending on the nature of each data processing activity. Should such a situation arise, the data subjects will be informed in the privacy notice specific to that process.

K. Our Company’s Personal Data Processing Activities and Purposes

Some of our Company’s personal data processing activities are listed below under headings:

1. Processing of Personal Data within the Scope of Job Applications
2. Processing of Personal Data in Processes Relating to the Provision of Products/Services
3. Processing of Personal Data within the Scope of Product/Service Procurement Processes
4. Processing of Personal Data within the Scope of Ensuring Physical Premises Security

1. Processing of Personal Data within the Scope of Guest Internet Access

1. Processing of Personal Data of Employees and Authorized Representatives of Authorized Service Centres and Dealers

1. Processing of Personal Data within the Scope of Job Applications

Certain personal data of persons who apply for a job at Delta İş Makinaları tamir yedek parça San. Tic. Ltd. Şti are processed within the scope of evaluating their applications and conducting recruitment processes. Within the scope of job applications, identity information (your name and surname, identity number, date and place of birth, nationality, gender, marital status, mother’s and father’s names), contact information (your telephone number, address, e-mail address), professional experience information (trainings, courses and seminars attended, work experience information) and other information required in processes relating to job candidates (CV, signature, photograph, military service status, personality inventory results, information on the data subject’s relatives, driving information, travel restriction information, interview notes, education information, salary and fringe benefits information, foreign language skills, computer skills, height, weight, clothing size information) are collected.

In addition, criminal record information, health information (pre-employment medical examination reports, disability status, blood group) and information on membership of associations, foundations and trade unions are collected regarding job candidates.

The said personal data are processed for the purposes of conducting the application processes of job candidates, evaluating the suitability of the job candidate for the position, planning human resources processes, carrying out reference checks regarding the job candidate, conducting the selection and placement processes of job candidates, and conducting personal development and assessment activities regarding job candidates.

Personal data collected within the scope of job applications are processed on the legal grounds of the establishment of an employment contract with the job candidate, the candidate’s exercise of the right to apply (exercise of a right), and the Company’s legitimate interest in conducting its staff recruitment processes. However, if you consent to personal data processing activities for which your consent is requested, the personal data concerned will be processed only on the legal ground of “explicit consent”.

2. Processing of Personal Data in Processes Relating to the Provision of Products/Services

1. Ordinary Operational Processes Relating to the Provision of Products/Services

Delta İş Makinaları tamir yedek parça San. Tic. Ltd. Şti processes certain personal data of customers and corporate customer employees in order to provide products or services to its customers and to conduct ordinary operational processes in this context. Within the scope of ordinary operational processes relating to the provision of products/services, identity information (your name and surname, identity number, tax number, date of birth, father’s name), contact information (your telephone number, address, e-mail address), financial information (bank account details, IBAN number, credit card details, financial transaction information, outstanding debt balance), customer transaction information (invoice information, order information, customer instructions, call centre voice recordings, customer number, cookie records, user name and password), profession/position/title information and other information required for conducting our business processes (signature, vehicle licence plate, photocopy of identity card, suggestion, request and complaint information, comprehensive motor insurance (kasko), vehicle and vehicle registration information) are collected.

The said personal data are processed domestically or abroad for the purposes of conducting customer relationship management processes, conducting communication activities, conducting goods / services sales and after-sales support processes, conducting finance and accounting affairs, conducting goods/services production and operation processes, conducting contract processes, conducting business continuity activities, conducting logistics processes, conducting training activities, managing access authorizations, conducting our activities in compliance with the legislation, conducting advertising/campaign/promotion processes, conducting strategic planning

activities, conducting processes for reporting company activities, conducting market research activities for the sale and marketing of products and services, planning and executing the company’s financial risk processes, following up requests/complaints and providing information to authorized institutions and organizations.

Personal data collected within the scope of ordinary operational processes are processed on the legal grounds of data processing being necessary for our legitimate interests and of the establishment, exercise or protection of a right. If you are a customer with whom we have a contractual relationship, your personal data are also processed on the legal ground of the performance of the contract.

1. Marketing Activities

Delta İş Makinaları tamir yedek parça San. Tic. Ltd. Şti processes certain personal data of customers and corporate customer employees within the scope of conducting marketing activities. Within the scope of marketing activities, identity information (your name and surname, identity number, date of birth, father’s name), contact information (your telephone number, address, e-mail address) and marketing information (your usage habits, your preferences and likes regarding our products and services, cookie records, customer satisfaction survey results) are collected.

The said personal data are processed for the purposes of conducting marketing processes for products/services, examining your preferences, habits and likes regarding the products and services you have purchased or are interested in; customizing products and services accordingly, and conducting campaign and promotion activities specific to you.

Your personal data will be processed within the scope of marketing activities specific to you on the legal ground of your explicit consent.

1. Machine (Location) Tracking Processes

Through the machine tracking systems available in certain product groups, Delta İş Makinaları tamir yedek parça San. Tic. Ltd. Şti collects persons’ location (position) information where our customers wish to benefit from these services of ours. Within the scope of machine tracking processes, identity information (your name and surname), contact information (your telephone number, e-mail address), location information (location data) and data relating to machine efficiency and performance (fuel, usage details, operating hours, capacity, machine status) are collected.

The said personal data are processed domestically or abroad for the purposes of tracking and detecting machine faults, determining, monitoring and improving the efficiency and performance of the machine, reaching you and the machine in situations requiring intervention such as maintenance and faults, assisting with the intervention, analysing the data obtained through the machine tracking system, conducting after-sales support services for the machine, conducting goods / services production and operation processes, conducting communication activities, conducting contract processes and conducting customer relationship management processes.

Personal data collected within the scope of machine tracking processes are processed on the legal grounds of data processing being necessary for our legitimate interests and of the establishment, exercise or protection of a right. If you are a customer with whom we have a contractual relationship, your personal data are also processed on the legal ground of the performance of the contract.

3. Processing of Personal Data within the Scope of Product/Service Procurement Processes

1. Processing of Personal Data of Supplier and Business Partner Employees/Officers

Delta İş Makinaları tamir yedek parça San. Tic. Ltd. Şti processes certain personal data of the employees and officers of the suppliers with which it has a business relationship for the purpose of procuring products or services, and of the business partners with which it cooperates in order to conduct the company’s operational activities. In this context, the identity information (your name and surname, identity number, date of birth), contact information (your telephone number, address, e-mail address), financial information (bank account details, IBAN number), transaction security information (computer ID, IP address, system and application user account information), risk management information (assessments and opinions about the supplier, financial risk assessments), profession/position/title information and other information required for conducting our business processes (signature, vehicle licence plate, clothing size information, photocopy of identity card, licence/registration information) of the employees of suppliers/business partners are collected.

The said personal data are processed domestically or abroad for the purposes of contacting you in order to conduct our business processes, conducting business continuity activities, conducting goods/services production and operation processes, conducting finance and accounting affairs, conducting risk management processes, conducting information security processes, establishing and managing information technology infrastructure, managing access authorizations, managing relationships with business partners and/or suppliers, organization and event management, conducting activities in compliance with the legislation, conducting import/export processes, conducting logistics processes, conducting goods / services after-sales support services, conducting goods / services sales processes, conducting customer relationship management processes, conducting activities aimed at customer satisfaction, conducting risk management processes, conducting strategic planning activities, planning and/or executing the company’s financial risk processes, following up requests

/ complaints, conducting supply chain management processes, ensuring that data are accurate and up to date, and providing information to authorized institutions and organizations.

Personal data collected within the scope of product/service procurement processes are processed on the legal grounds of data processing being necessary for our legitimate interests and of the establishment, exercise or protection of a right.

1. Processing of Personal Data of Subcontractor Employees/Officers

Delta İş Makinaları tamir yedek parça San. Tic. Ltd. Şti processes certain personal data of the employees of subcontractor firms from which it obtains support within the scope of the supply of products or services. In this context, the identity information (your name and surname, identity number, date of birth, father’s name), contact information (your telephone number, e-mail address), transaction security information (internet access logs, computer ID, IP address, cookie records, system and application user account information) and other information required for conducting our business processes (requests and suggestions for improving business processes, copy of identity document) of subcontractor employees are collected. In addition, criminal record information is collected within the scope of the trainings conducted for subcontractor employees.

The said personal data are processed domestically or abroad for the purposes of contacting you in order to conduct our business processes, conducting contract processes, providing information to authorized persons/institutions and organizations, conducting goods / services production and operation processes, conducting occupational health and/or safety processes, fulfilling obligations arising from contracts and legislation

for subcontractor employees, following up the personnel processes of subcontractor employees, conducting training activities, conducting information security processes, establishing and managing information technology infrastructure, managing access authorizations, conducting the processes of receiving and evaluating suggestions for improving business or production processes, and planning human resources processes.

Personal data collected within the scope of product/service procurement processes are processed on the legal grounds of data processing being necessary for our legitimate interests and of the establishment, exercise or protection of a right. However, if you consent to personal data processing activities for which your consent is requested, the personal data concerned will be processed only on the legal ground of “explicit consent”.

4. Processing of Personal Data within the Scope of Ensuring Physical Premises Security

1. Recording of Security Camera Footage

Monitoring with security cameras is carried out in certain parts of our Company’s facilities. In areas where camera monitoring is carried out, data subjects are informed by means of warning signs regarding the monitoring.

Delta İş Makinaları tamir yedek parça San. Tic. Ltd. Şti processes the personal data it collects through security cameras for the purposes of ensuring physical premises security, ensuring the security of movable property and resources, and providing information to authorized persons/institutions and organizations.

Footage recorded by security cameras is retained for 10 days from the date on which it is recorded and is destroyed at the end of this period, unless it needs to be retained for a longer period within the scope of a legal investigation or our legal obligations.

The processing of personal data through the keeping of camera recordings is carried out on the legal grounds of data processing being necessary for our legitimate interests and of the establishment, exercise or protection of a right.

1. Keeping of Visitor Entry and Exit Records

Delta İş Makinaları tamir yedek parça San. Tic. Ltd. Şti processes certain personal data of persons visiting the Company’s facilities and buildings. Within the scope of visits to the Company’s facilities and buildings, persons’ identity information (your name and surname), contact information (telephone number) and visit information (date of visit, the areas through which the visitor entered and exited, reason for the visit) are collected.

The said personal data are processed for the purposes of creating and following up visitor records, ensuring the security of movable property and resources, ensuring physical premises security, and providing information to authorized persons/institutions and organizations.

Personal data collected within the scope of visits to the Company’s facilities and buildings are processed on the legal grounds of the fulfilment of our legal obligations and our legitimate interest in ensuring the security of the Company’s facilities and its employees.

1. Processing of Personal Data within the Scope of Guest Internet Access

Certain personal data of persons connecting to the internet network of Delta İş Makinaları tamir yedek parça San. Tic. Ltd. Şti as guest users are processed. The identity information (your name and surname, identity number, year of birth) and transaction security information (computer ID, IP address, cookie records, start and end time of internet use, web pages you visit, log records) of persons wishing to use internet access are collected.

The said personal data are processed for the purposes of enabling access to the internet network as a guest user, conducting information security processes, establishing and managing information technology infrastructure, managing access authorizations, conducting our activities in compliance with the legislation and providing information to authorized persons/institutions and organizations.

Personal data collected within the scope of guest internet access are processed on the legal grounds of the personal data processing activity being expressly provided for in Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications, the fulfilment of our legal obligations under the Regulation on Mass Internet Use Providers (Official Gazette date and issue no.: 11.04.2017, 30035), and the provision of the right of internet access to guests (establishment of a right).

6. Processing of Personal Data of Employees and Authorized Representatives of Authorized Service Centres and Dealers

Delta İş Makinaları tamir yedek parça San. Tic. Ltd. Şti collects certain personal data relating to the employees or authorized representatives of the authorized service centres and dealers with which it has a business relationship. Within the scope of processes relating to authorized service centres and dealers, persons’ identity information (your name and surname, identity and passport number, date of birth), contact information (your telephone number, address, e-mail address), financial information (bank account details, IBAN number, financial transaction information, outstanding debt balance), transaction security information (system and application user account information), risk management information (evaluations of potential dealer applications, performance evaluations of existing dealers), professional experience information (trainings, courses and seminars attended) and other information required for conducting our business processes (signature, vehicle licence plate, clothing size information, title, travel and accommodation information, photocopy of identity card) are collected.

In addition, criminal record information is collected within the scope of authorized dealer applications.

The said personal data are processed domestically or abroad for the purposes of contacting you in order to conduct our business processes, conducting activities in compliance with the legislation, conducting and auditing business activities, conducting logistics processes, conducting goods / services after-sales support services, conducting authorized service/dealer application processes, conducting business continuity activities, conducting goods/services production and operation processes, managing relationships with authorized service centres and dealers, organization and event management, conducting training activities, conducting information security processes, establishing and managing information technology infrastructure, managing access authorizations, conducting finance and accounting affairs, conducting risk management processes, conducting customer relationship management processes, planning and monitoring performance evaluation processes, conducting retention and archiving activities, conducting contract processes, ensuring that data are accurate and up to date, providing information to authorized institutions/organizations, planning and delivering trainings for authorized service/dealer employees, and conducting strategic planning activities.

The personal data of employees of authorized service centres and dealers are processed on the legal grounds of the establishment, exercise or protection of a right and of data processing being necessary for our legitimate interests. However, if you consent to personal data processing activities for which your consent is requested, the personal data concerned will be processed only on the legal ground of “explicit consent”.

L. Retention of Personal Data

Personal data are retained by our Company in accordance with the principle that “personal data shall be retained for the period stipulated in the relevant legislation or required for the purpose for which they are processed”. Upon expiry of the period stipulated in the legislation or required by the purpose of processing, personal data are erased, destroyed or anonymized by our Company.

The period for which our Company must retain personal data in accordance with its personal data processing activities, and the destruction operations to be applied at the end of these periods, are determined in the “Policy on the Retention and Destruction of Personal Data”. The retention and destruction periods specified in that Policy are reviewed by our Company at regular intervals.

M. Ensuring Personal Data Security

Our Company takes the necessary technical and administrative measures in order to prevent the unlawful processing of personal data, to prevent unlawful access to data and to ensure that data are retained securely.

The main technical and administrative measures taken by the Company regarding data security are set out below:

• Network security and application security are ensured.
• Disciplinary regulations containing data security provisions for employees
• Training and awareness activities on data security are carried out for employees at regular intervals.
• An authorization matrix has been created for employees.
• Access logs are kept regularly.
• Corporate policies on access, information security, use, retention and destruction have been prepared and put into practice.
• Confidentiality undertakings are executed.
• The access rights to personal data of employees who change roles or leave the company are revoked.
• Up-to-date anti-virus systems are used.
• Firewalls are used.
• The contracts signed contain data security provisions.
• Personal data security policies and procedures have been determined.
• Personal data security is monitored.
• The necessary security measures are taken regarding entry to and exit from physical environments containing personal data.
• The security of physical environments containing personal data against external risks (fire, flood) is ensured.
• The security of environments containing personal data is ensured.
• Personal data are minimized as far as possible.

• Periodic and/or random internal audits are carried out and commissioned.
• Log records are kept in a manner that does not allow user intervention.
• Existing risks and measures have been identified.
• If special categories of personal data are to be sent by electronic mail, they are always sent encrypted and by using a KEP (registered electronic mail) or corporate e-mail account.
• Intrusion detection and prevention systems are used.
• Penetration testing is performed.
• Cyber security measures have been taken and their implementation is continuously monitored
• Encryption is performed.
• Special categories of personal data transferred on portable memory, CD or DVD media are transferred in encrypted form.

In addition to those specified here, other technical and administrative measures are also taken by the Company, taking into account the nature of the personal data and the degree of confidentiality they require. The measures taken to ensure the security of special categories of personal data are set out in the “Policy on the Protection and Processing of Special Categories of Personal Data”.

N. Rights Relating to Personal Data

Data subjects who are personal data owners have a number of rights regarding the processing of their personal data under Article 11 of the Law. What these rights are and how they can be exercised are explained below:

• To learn whether your personal data are processed,
• To request information in this regard if we process your personal data,
• To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
• To know the third parties, domestically or abroad, to whom we transfer your personal data -if any-,
• To request the rectification of your personal data if they have been processed incompletely or inaccurately, and to request that we notify the operation carried out in this context to the third parties to whom we have transferred the personal data -if any-,
• To request the erasure or destruction of your personal data if the reasons requiring their processing cease to exist, even though we have processed them in compliance with the Law and the relevant legislation, and to request that we notify the operation carried out in this context to the third parties to whom we have transferred your personal data -if any-,
• To object to the occurrence of a result to your detriment through the analysis of the personal data we process exclusively by means of automated systems, if any such cases exist,
• To request compensation for the damage if you suffer damage due to the unlawful processing of your personal data.

In addition to the above, where we process your personal data on the basis of your explicit consent,

you have the right to withdraw the explicit consent you have given at any time by contacting us.

To exercise your rights, you may fill in the Data Subject Application Form available at www.deltaismakinalari.com, send your request from your e-mail address registered in our systems to the Contact Person’s e-mail address [info@deltamak.com], or submit your requests to us by the other methods specified in the Communiqué on the Procedures and Principles for Applications to the Data Controller.

If you submit to us your request regarding your rights, we will respond to your request as soon as possible and at the latest within thirty days, depending on the nature of your request.

No separate fee will be charged to you for exercising your rights. However, if your request requires an additional cost, we may charge you the fee in the tariff determined by the Personal Data Protection Authority. In such a case, we will inform you of the additional cost.

O. Contact

For all your questions regarding this Policy or the processing of your personal data, you may contact us using the contact details below.