Data Controller:: ENEKO HAVALANDIRMA VE ISI EKONOMİSİ SİSTEM TEKNOLOJİLERİ MAKİNE SAN. VE TİC. A.Ş

Address: 10049 SOKAK NO: 4 A.O.S.B 35620 ÇİĞLİ/ İZMİR

Tax Number: 3340399897

MERSIS Number: 334039989700002

‘’ ENEKO HAVALANDIRMA VE ISI EKONOMİSİ SİSTEM TEKNOLOJİLERİ MAKİNE SAN.VE TİC. A.Ş’’

Hereafter referred to as the “COMPANY”; we take the utmost care in processing and protecting your personal data. In accordance with the relevant legislation of the Personal Data Protection Law, as the data controller, all necessary technical and administrative measures are taken to prevent the unlawful processing of personal data, to prevent unauthorized access to personal data, and to ensure the protection of personal data.

This clarification text has been prepared by the “COMPANY” in its capacity as the data controller, within the framework of the Regulation on the Procedure and Principles to Fulfill the Disclosure Obligation under the Personal Data Protection Law (“Law”).

In this context, as the “Data Controller” defined in the Personal Data Protection Law, we would like to inform you about the purposes for which your personal data is processed by our Company. Detailed information about the processing purposes of your personal data can be found in the Personal Data Processing and Protection Policy.

With a full understanding of this responsibility, we process your personal data as described below and within the limits prescribed by the legislation. Personal data shared by you with our Company, as a business partner, supplier, consumer, subscriber, or customer, will be processed in accordance with the Personal Data Protection Law (KVKK), and can be transferred to third parties, stored, used for profiling, and classified in relation to our business activities and service objectives, as long as they are relevant and proportionate.

Collection, Processing, and Purposes of Processing Personal Data:

In accordance with the legislation related to the Personal Data Protection Law, your personal data is collected automatically or non-automatically (as part of any data recording system) and processed by recording, storing, modifying, reorganizing, etc., in accordance with the principles set forth in the law.

Your personal data is processed in line with Articles 4, 5, and 6 of the Law and related regulations for the following purposes within the scope of COMPANY’s activities:

The collected personal data:

• Management of after-sales support processes for goods/services
• Tracking of requests/complaints
• Conducting communication activities
• Ensuring physical security of premises
• Receiving and evaluating suggestions for the improvement of business processes
• Managing customer relations
• Conducting activities for customer satisfaction
• Managing marketing processes for products/services
• Managing advertising/campaign/promotion processes
• Creating and tracking visitor records
• Managing investment processes
• Ensuring the security of movable goods and resources
• Managing supply chain processes
• Conducting auditing/ethical activities
• Managing finance and accounting operations
• Following up and managing legal matters
• Conducting logistics activities
• Managing purchasing processes for goods/services
• Providing after-sales support services for goods/services
• Managing sales processes for goods/services
• Managing production and operational processes for goods/services
• Managing customer relations management processes
• Managing contract processes
• Conducting marketing analysis studies
• Conducting activities for customer satisfaction
• Managing customer relations management processes
• Your personal data will be processed in accordance with the processing conditions and purposes specified in Articles 5 and 6 of the Personal Data Protection Law to ensure the legal, technical, and commercial security of our company and the relevant individuals involved in our business relationships.

In cases where explicit consent is required as per the relevant provisions, your explicit consent will be obtained. However, in accordance with the conditions stated in the second paragraph of Article 5, it is possible to process personal data without obtaining the individual’s consent, provided it meets the specified conditions.

As per the mandatory provisions of the laws, it is essential to maintain accurate and up-to-date information about individuals. Therefore, personal information may be requested to be updated periodically.

Personal Data Processed for the Purposes Written Above

For the purposes outlined above, and limited to COMPANY activities, the following personal data is processed:

• Identity Information (National ID number, your name and surname, place and date of birth, your mother’s and father’s names, marital status, gender)
• Contact Information (Your phone numbers, contact address, email address)
• Financial Information (Billing and payment information, bank account number, IBAN number, credit card information, tax identification number, tax office information, invoices, delivery notes, signature circulars, personal information on delivery and receipt documents, information on contracts made with third parties)
• Marketing Information (Your shopping history, website visit history)
• Legal Process Information (Legal contacts with relevant individuals, services provided, personal information in correspondence with courts, prosecutors, mediators, arbitration boards, judicial authorities in the context of legal disputes, information in litigation and enforcement files)
• Visual and Audio Records (Photographs on documents prepared as part of COMPANY activities, photographs on printed forms, documents, and official ID cards taken during appointment creation, communication with the company, and tracking of requests and complaints, images in videos/camera recordings on the company website, social media accounts, or written and visual media for promotional and informational purposes)
• Physical Security Information (Camera footage, security logbook information, information in maintained forms, vehicle plate information)
• Request and Complaint Information (Information and records collected from electronic and physical environments, internet and social media, online channels, information regarding management processes)

Duration

Your personal data is stored by the Company for a period not shorter than the statute of limitations applicable to the legal relationship the data is subject to, for a period of 10 (ten) years. Physical security information will be stored for a period of 1 (one) month. After this period, your personal data will be deleted, destroyed, or anonymized by the Company or upon your request, using the methods stipulated by the Personal Data Protection Law and relevant regulations. You can always withdraw your consent for the processing of personal data that is not legally required.

Conditions for Processing Personal Data

(1) Personal data cannot be processed without the explicit consent of the data subject.

(2) Personal data may be processed without the explicit consent of the data subject if one of the following conditions is met:

• It is explicitly stipulated in laws.
• It is necessary to protect the life or bodily integrity of the individual or another person in case the individual cannot give consent due to physical impossibility or if legal validity is not recognized for their consent.
• It is directly related to the establishment or performance of a contract, and it is necessary to process the personal data of the parties to the contract.
• It is mandatory for the data controller to fulfill its legal obligations.
• The data subject has made the data public.
• Processing of personal data is necessary for the establishment, exercise, or protection of a right.
• Processing personal data is necessary for the legitimate interests of the data controller, provided it does not harm the fundamental rights and freedoms of the data subject.

Conditions for Processing Sensitive Personal Data

(1) Personal data regarding individuals’ race, ethnic origin, political opinion, philosophical belief, religion, sect, or other beliefs, their attire, membership in associations, foundations, or unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data, are considered sensitive personal data.

(2) The processing of sensitive personal data without the explicit consent of the data subject is prohibited.

(3) Personal data other than health and sexual life, as listed in paragraph one, may be processed without the explicit consent of the data subject in cases explicitly foreseen by laws. Personal data related to health and sexual life may only be processed without the explicit consent of the data subject if it is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, the planning and management of health services and financing, by persons under an obligation of confidentiality or authorized institutions and organizations.

(4) In the processing of sensitive personal data, sufficient precautions determined by the Personal Data Protection Board must be taken.

Who Personal Data Can Be Transferred To and for What Purposes

Your personal data may be transferred by our Company to real persons or legal entities under private law, shareholders, suppliers, institutions from which we receive TÜBİTAK and information technology support, and authorized public institutions and individuals, within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of Law No. 6698, and by complying with the required conditions and taking necessary precautions, in order to fulfill the stated purposes.

TRANSFER ABROAD

Based on the legal reasons specified in Article 5 (2) of the KVKK (Personal Data Protection Law), your personal data may be transferred abroad without obtaining the explicit consent of the data subject, due to the fact that all of the Company’s product and service-related activities are carried out via online software systems whose databases are located abroad, in accordance with the conditions of transfer abroad specified in Article 9 (2) of the KVKK, as follows:

(i) To foreign countries declared by the Personal Data Protection Board (hereinafter referred to as the “Board”) as having adequate protection (“Foreign Country with Adequate Protection”)

(ii) To foreign countries and/or regions where the data controllers in Turkey and the relevant foreign country have provided written guarantees of adequate protection and where the Board’s permission is granted (“Foreign Country with a Data Controller Providing Adequate Protection”), but limited to these cases.

The transfer of your personal data processed for the purposes described above will be carried out by our Company with due care, in compliance with the KVKK and relevant regulations, including the decisions made by the Board, and all necessary security measures will be taken.

Method and Legal Grounds for Personal Data Collection:

Your personal data is collected through various means by our Company (via our headquarters, branches, or other subcontractors or business partners, physical environments such as offices where you can contact us, websites, and similar electronic processing platforms, social media or other publicly available platforms, your participation in training, conferences, and similar events organized by us, investigative methods, or through other group companies or contracted third parties in written, verbal, recorded, or other physical or electronic environments).

Your personal data is collected in all forms such as written, verbal, recorded, or through other physical or electronic environments, in accordance with the purposes specified above, to ensure the provision of our products and services within the legal framework and to fully and accurately fulfill the contractual and legal obligations of our Company.

Your personal data is collected through various tools such as websites, digital channels, various contracts, emails, application forms, and written or verbal communications with the Company, including but not limited to, through data processors acting on behalf of our Company, whether they are real or legal persons. The personal data collected for these purposes and legal reasons may also be processed and transferred for the purposes outlined in sections (1) and (2) of this text under the personal data processing conditions and purposes set forth in Articles 5 and 6 of the KVKK.

Additionally, your personal data is processed without explicit consent based on the following legal grounds:

• Because it is explicitly foreseen in the laws,
• Due to physical impossibility where the individual cannot declare consent or if legal validity is not recognized for their consent, it is necessary to protect the life or bodily integrity of the individual or another person.
• If it is directly related to the establishment or performance of contracts between our Company and real or legal persons, and processing the personal data of the contract parties is necessary.
• If the personal data has been made public by the relevant individual,
• If the processing of data is necessary for the establishment, exercise, or protection of a right,
• If processing personal data is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the individual.

Your personal data is processed, collected, and transferred as limited to the purposes outlined above, in accordance with the Personal Data Protection Law, Article 5 and 6, and in line with the principles of the Communiqué on the Procedures and Principles for Fulfillment of the Obligation of Disclosure in Articles 5/1-h and other relevant regulations. Your personal data will be stored and preserved for the period specified in relevant legislation within the scope of Company activities.

Rights of the Personal Data Subject (Right to Apply):

Under Article 11 of the Personal Data Protection Law, every individual has the right to apply to the data controller to:

• Learn whether personal data is being processed,
• Request information if their personal data has been processed,
• Learn the purpose of processing personal data and whether it is being used for its intended purpose,
• Learn about third parties to whom personal data has been transferred, both domestically and internationally,
• Request the correction of personal data if it is incomplete or inaccurate,
• Request the deletion or destruction of personal data under the conditions specified in Article 7 of the KVKK,
• Request that the correction, deletion, or destruction of personal data be communicated to third parties to whom the data has been transferred,
• Object to the processing of personal data solely through automated systems leading to a negative decision that affects them,
• Request compensation for any damages incurred due to unlawful processing of personal data.

Application Procedure:

Requests within the scope of Article 11 of the Personal Data Protection Law can be submitted by the personal data subject to the Company in writing or using methods specified by the KVKK. You can submit your application to the following address:
10049 SOKAK NO: 4 A.O.S.B 35620 ÇİĞLİ/ İZMİR
Alternatively, you can complete the application form available on our website at http://eneko.com.tr/tr, sign it, and send a copy with identifying documents to our company address in person, or send it via secure electronic signature, mobile signature, or from the email address registered in our system to enekohavalandirma@hs03.kep.tr.

In accordance with Article 13/1 of the KVKK, requests regarding the use of the above rights must be communicated to us in writing or through the methods specified by the KVKK.

Our Company will respond to your requests as soon as possible and no later than thirty days, free of charge. However, if the process requires an additional fee, a fee will be charged according to the tariff determined by the Board. If a response is given in writing, there will be no charge for up to ten pages, but a fee of 1 TL per page will be charged for each additional page.

If the response to the application is provided in electronic form, such as CD or USB, the company may charge for the cost of the storage medium, not exceeding the actual cost.

I have read, understood, and have been fully informed by the data controller, the “COMPANY,” regarding how my personal data will be processed, for what purposes, who the recipients will be, how the data is collected, and my rights under Article 11 of the Law.