INDUSTRIAL ELECTRIC ELECTRONICS IND. AND TRADE LTD. CO.

PERSONAL DATA PROCESSING AND PROTECTION POLICY It is clear that the Location Identity belongs to a certain or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; Information that determines the location of the Personal Data Owner within the framework of the operations carried out by the business units of Endüstri, when using the products and services of group companies, or when the employees of the institutions with which it cooperates are using Company vehicles; GPS location, travel data, etc.
It is clear that it belongs to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; All kinds of personal data processed to obtain information that will be the basis for the formation of personal rights of real persons who have a working relationship with the industry.
Legal Transaction Information Data processed within the scope of the determination and follow-up of Industrial’s legal receivables and rights, and the performance of its debts and legal obligations.
Data such as Customer Transaction Invoice, promissory note, check information, order information, request information etc.
Physical Location Security Information Clearly belonging to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; Personal data regarding records and documents received upon entering the physical location and during the stay in the physical location; camera records, fingerprint records and records taken at security points, etc.
Transaction Security Information: While conducting the activities of Endüstri, information regarding the technical, administrative, legal and commercial security of both the Personal Data Owner and the Industrial

CHAPTER ONE

GENERAL INFORMATION 1.1. Introduction

INDUSTRIAL ELECTRIC ELECTRONICS IND. AND TRADE LTD. CO. (“Industrial” and/or “the company”) attaches the utmost importance to the lawful processing and protection of personal data in accordance with Personal Data Protection Law No. 6698 (“the Law”) and acts with this care in all our planning and activities. With this awareness, we present this Personal Data Processing and Protection Policy (“the Policy”) to inform you about our administrative and technical measures taken to comply with the Law, particularly to fulfill the obligation to inform under Article 10 of the Law.

1.2. Purpose of the Policy

The primary purpose of this Policy is to explain the systems for the lawful processing and protection of personal data and to inform individuals whose personal data are processed by our company, including but not limited to Company Stakeholders, Company Real Person Business Partners, Company Officials, Employees, Employee Candidates, Interns, Company Customers, Potential Customers, Visitors, Supplier Employees, Supplier Officials, Guardians / Trustees / Representatives, and Third Parties. This ensures full compliance with the legislation in our personal data processing and protection activities and aims to protect all rights of personal data owners arising from the legislation.

1.3. Scope of the Policy and Personal Data Owners

This Policy has been prepared for and will be applied to individuals whose personal data are processed by our company through automated or non-automated means, provided that they are part of any data recording system, including Company Stakeholders, Company Officials, Company Business Partners, Employees, Employee Candidates, Interns, Visitors, Company and Group Company Customers, Potential Customers, Supplier Employees, Supplier Officials, Guardians / Trustees / Representatives, and Third Parties. This Policy will not apply to legal entities and legal entity data.

Our company informs these Personal Data Owners about the Law by publishing this Policy on its website. If the data do not fall under the “Personal Data” as defined below, or if the Personal Data processing activities carried out by our company are not performed in the ways specified above, this Policy will not apply.

1.4. Definitions

The terms used in this Policy have the meanings specified below:1.5. Enforcement of Policy

This Policy, which was issued by Endüstri and entered into force on the date of its publication, is published on Endüstri’s website (www.endustriyel.com) and is made available to relevant persons upon the request of Personal Data Owners.

SECOND PART

PROCESSING AND TRANSFER OF PERSONAL DATA

2.1. General Principles in Processing Personal Data

Your personal data is processed by Endüstri in accordance with the personal data processing principles contained in Article 4 of the KVKK. It is mandatory to comply with these principles for each personal data processing activity. Industrial acts with the following principles when processing Personal Data:

Personal Data,

It is processed in accordance with the rules of law and the requirements of the rule of honesty.

Personal Data is ensured to be accurate and up to date. In this context, issues such as determining the sources from which the data is obtained, confirming its accuracy, and evaluating whether it needs to be updated are carefully taken into consideration.

Personal Data; Processed for specific, explicit and legitimate purposes. The legitimacy of the purpose means that the Personal Data processed by Endüstri is related to and necessary for the work it performs or the service it offers.

Personal Data is linked to the purpose in order to achieve the purposes determined by the Industrial, and the processing of Personal Data that is not necessary or not necessary for the achievement of the purpose is avoided. It limits the processed data only to what is necessary to achieve the purpose. Personal Data processed in this context is related to the purpose for which they are processed, limited and proportionate.

If there is a period stipulated in the relevant legislation for the storage of data, it complies with these periods; Otherwise, it retains Personal Data only for the period necessary for the purpose for which it is processed. If there is no valid reason to retain Personal Data any longer, the data in question will be deleted, destroyed or anonymized.

2.2. Conditions for Processing Personal Data 2.2. Conditions for Processing Personal Data

Your personal data is processed by Endüstri if at least one of the personal data processing conditions specified in Article 5 of the KVKK is met. Explanations regarding these conditions are given below:

Endüstri does not process Personal Data without the explicit consent of the data owner. If one of the following conditions exists, Personal Data may be processed without the explicit consent of the data owner.

Industrial may process the Personal Data of Personal Data Owners in cases clearly stipulated by law, even without explicit consent. For example; In accordance with the relevant article of the Tax Procedure Law, the express consent of the relevant person will not be required to include the relevant person’s name on the invoice.

Personal Data may be processed without explicit consent in order to protect the life or physical integrity of individuals or another person who are unable to express their consent due to actual impossibility or whose consent cannot be validated. For example, in a situation where the person’s consent is not valid due to unconsciousness or mental illness, the Personal Data Owner’s Personal Data may be processed during medical intervention to protect life or physical integrity. In this context, data such as blood type, diseases and surgeries, and medications used can be processed through the relevant health system.

Personal Data belonging to the parties to the contract may be processed, provided that it is directly related to the establishment or execution of a contract by Industrial. For example, in accordance with a contract, the account number of the creditor party may be obtained for the payment of money.

If it is mandatory to fulfill its legal obligations as an industrial data controller, it may process the Personal Data of Personal Data Owners.

Personal Data made public by the Personal Data Owners themselves, in other words, disclosed to the public in any way, may be processed by the Industrial Company as the legal benefit to be protected has disappeared. In cases where data processing is mandatory for the exercise or protection of a legitimate industrial right, the Personal Data of Personal Data Owners may be processed without seeking explicit consent.

Industrial may process the Personal Data of Personal Data Owners in cases where it is necessary to process Personal Data to ensure their legitimate interests, provided that it does not harm the fundamental rights and freedoms of Personal Data Owners protected under the Law and Policy. Endüstri shows the necessary sensitivity to comply with the basic principles regarding the protection of Personal Data and to observe the balance of interests of Personal Data Owners.

2.3. Conditions for Processing of Special Personal Data

In Article 6 of the KVKK, special personal data is specified in limited numbers. These; Data regarding people’s race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, appearance and clothing, association, foundation or union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data.

Industrial does not process Special Personal Data without the express consent of the person concerned. However, Personal Data other than health and sexual life may be processed without the explicit consent of the relevant person in cases stipulated by law.

Personal Data regarding health and sexual life are processed by the Industrial Company only for the purposes of protecting public health, preventive medicine, medical diagnosis and treatment and care services, planning and management of health services and their financing, without seeking the explicit consent of the relevant person, under conditions where we are under a confidentiality obligation. It carries out the necessary procedures to take adequate measures determined by the Board in the processing of Industrial Personal Data. 2.5. Conditions for Transfer of Personal Data

Personal data and special personal data of the Personal Data Owner, by taking the necessary security measures in line with industrial, lawful personal data processing purposes, to natural persons or private law legal entities, shareholders, business partners, affiliates and subsidiaries, suppliers, authorized public institutions. and transfer it to their organizations and other relevant parties. In this regard, we comply with the regulations stipulated in Article 8 of the KVKK.

Even if the Personal Data Owner does not have Explicit Consent, personal data may be transferred to third parties by taking necessary care and taking all necessary security measures, including the methods prescribed by the KVK Board, if one or more of the following conditions are present:

*Relevant activities regarding the transfer of personal data are clearly foreseen in the law,

*The transfer of personal data is directly related to the establishment or performance of a contract,

that’s the choice

*Transfer of personal data is mandatory to fulfill a legal obligation,

*Limited transfer of personal data for the purpose of publicization, provided that it has been made public by the Personal Data Owner,

*Transfer of personal data is mandatory for the establishment, use or protection of the rights of the Industrial or the relevant person or third parties,

* It is mandatory to carry out personal data transfer activities for the legitimate interests of Endüstri, provided that it does not harm the fundamental rights and freedoms of the Personal Data Owner,

In addition to the above, personal data may be transferred to foreign countries declared by the KVK Board to have adequate protection, if any of the above conditions are met. In case there is not sufficient protection, it may be transferred without the Explicit Consent of the Personal Data Owner to foreign countries where the data controllers in Turkey and the relevant foreign country have committed in writing to adequate protection and where the KVK Board has permission, in line with the data transfer conditions stipulated in the legislation. 2.6. Conditions for Transfer of Special Personal Data

Special categories of personal data can be transferred by the Industrial Company in accordance with the principles specified in this Policy and by taking all necessary administrative and technical measures, including the methods determined by the KVK Board, and if the following conditions are met.

*Special categories of personal data, other than health and sexual life, may be processed without seeking the Explicit Consent of the Personal Data Owner, if it is clearly provided for in the law, in other words, if there is a clear provision in the relevant law regarding the processing of personal data. Otherwise, the Explicit Consent of the Relevant Person will be obtained.

*Special personal data regarding health and sexual life may be processed by persons under the obligation of confidentiality or authorized institutions and organizations with explicit consent for the purpose of protecting public health, preventive medicine, medical diagnosis, execution of treatment and care services, planning and management of health services and their financing. It can be processed without any request. Otherwise, the Explicit Consent of the Personal Data Owner will be obtained.

In addition to the above, personal data can be transferred to foreign countries with adequate protection if any of the above conditions are met. In case there is not sufficient protection, it can be transferred to foreign countries where the Data Controller / Data Processor is located, in line with the data transfer conditions stipulated in the legislation.

THIRD PART

CLASSIFICATION OF PERSONAL DATA, PURPOSES OF PROCESSING AND TRANSFER, PERSONS TO WHICH IT WILL BE TRANSFERRED

3.1. Classification of Personal 

In terms of industry; In line with the legitimate and lawful personal data processing purposes of Endüstri, based on one or more of the personal data processing conditions specified in Article 5 of the Law and in a limited manner, in accordance with the general principles specified in the Law, especially the principles specified in Article 4 regarding the processing of personal data. and in compliance with all obligations set out in the Law and limited to the periods covered by this Policy, personal data in the categories specified below are processed by informing the relevant persons in accordance with Article 10 of the Law. It is also stated in this section which data owners the personal data processed in these categories are associated with and which are regulated within the scope of this Policy.

PERSONAL DATA CATEGORIZATION PERSONAL DATA CATEGORIZATION EXPLANATION

Identity Information: Clearly belonging to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; These are data containing information regarding the identity of the person; name-surname, T.R. Documents such as driver’s license, identity card and passport containing information such as identity number, nationality information, mother’s name-father’s name, place of birth, date of birth, gender, as well as tax number, SSI number, signature information, vehicle license plate, etc. informations.

Contact Information Clearly belonging to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; Information such as telephone number, address, e-mail address, fax number, IP address.

It is clear that the Location Identity belongs to a certain or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; Information that determines the location of the Personal Data Owner within the framework of the operations carried out by the business units of Endüstri, when using the products and services of group companies, or when the employees of the institutions with which it cooperates are using Company vehicles; GPS location, travel data, etc.  In terms of industry; In line with the legitimate and lawful personal data processing purposes of Endüstri, based on one or more of the personal data processing conditions specified in Article 5 of the Law and in a limited manner, in accordance with the general principles specified in the Law, especially the principles specified in Article 4 regarding the processing of personal data. and in compliance with all obligations set out in the Law and limited to the periods covered by this Policy, personal data in the categories specified below are processed by informing the relevant persons in accordance with Article 10 of the Law. It is also stated in this section which data owners the personal data processed in these categories are associated with and which are regulated within the scope of this Policy.

PERSONAL DATA CATEGORIZATION PERSONAL DATA CATEGORIZATION EXPLANATION

Identity Information: Clearly belonging to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; These are data containing information regarding the identity of the person; name-surname, T.R. Documents such as driver’s license, identity card and passport containing information such as identity number, nationality information, mother’s name-father’s name, place of birth, date of birth, gender, as well as tax number, SSI number, signature information, vehicle license plate, etc. informations.

Contact Information Clearly belonging to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; Information such as telephone number, address, e-mail address, fax number, IP address.

It is clear that the Location Identity belongs to a certain or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; Information that determines the location of the Personal Data Owner within the framework of the operations carried out by the business units of Endüstri, when using the products and services of group companies, or when the employees of the institutions with which it cooperates are using Company vehicles; GPS location, travel data, etc. PERSONAL DATA CATEGORIZATION PERSONAL DATA CATEGORIZATION EXPLANATION

Identity Information: Clearly belonging to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; These are data containing information regarding the identity of the person; name-surname, T.R. Documents such as driver’s license, identity card and passport containing information such as identity number, nationality information, mother’s name-father’s name, place of birth, date of birth, gender, as well as tax number, SSI number, signature information, vehicle license plate, etc. informations.

Contact Information Clearly belonging to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; Information such as telephone number, address, e-mail address, fax number, IP address. processed personal data.

Risk Management Data processed to manage commercial, technical and administrative risks

Financial Information: Clearly belonging to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of the data recording system; Personal data processed regarding information, documents and records showing all kinds of financial results created according to the type of legal relationship that Endüstri has established with the Personal Data Owner, and data such as bank account number, IBAN number, credit card information, financial profile, asset data, income information. .

Professional Experience Diploma information, Courses attended, In-service training information, Certificates, Transcript information and similar data.

Marketing Shopping history information, Survey, Cookie records, Data obtained through campaign work

Audio/Visual Records Clearly belong to an identified or identifiable natural person; Photographs and camera records (except for records included within the scope of Physical Space Security Information), voice recordings and data contained in documents that are copies of documents containing personal data.

Attire and Clothing: Shoe size, upper and lower clothing information, general attire-related data and similar data.

Health Information Information regarding disability status, blood type information, personal health information, device and prosthesis information used, etc.

Criminal Conviction and Security Measures Information regarding criminal convictions, information regarding security measures, etc.

Biometric Data Palm information, Fingerprint information, Retina scan information, Face recognition information, etc.

3.2. Purposes of Processing and Transfer of Personal Data

Personal Data; In accordance with the law and the purpose of the Law;  Execution of Information Security Processes

Conducting Employee Candidate / Intern / Student Selection and Placement Processes

Carrying out the application processes of employee candidates

Conducting Employee Satisfaction and Loyalty Processes

Fulfillment of Employment Contract and Legislation Obligations for Employees

Execution of Fringe Benefits and Benefits Processes for Employees

Conducting Audit / Ethics Activities

Conducting Educational Activities

Execution of Access Authorizations

Conducting Activities in Compliance with Legislation

Carrying out Finance and Accounting Affairs

Execution of Commitment Processes for Company / Product / Services

Ensuring Physical Space Security

Execution of Assignment Processes

Follow-up and Execution of Legal Affairs

Conducting Internal Audit / Investigation / Intelligence Activities

Carrying out Communication Activities

Planning Human Resources Processes  *Identity of the industrial,

*For what purposes personal data will be processed,

*To whom and for what purposes it can be transferred,

*Method of collecting personal data (which of the fully or partially automated methods or which of the non-automatic methods is used provided that it is part of a data recording system),

*The legal basis for collecting personal data,

* Other rights of the Data Owner listed in Article 11 of the KVKK are explained.

In addition to the above, it must be ensured that the information in question includes the Data Owner’s rights listed in the KVKK and this Policy. The following points are taken into consideration when lighting:

*Information within the scope of enlightenment is provided using clear and simple language. Statements that suggest that personal data may be processed for other purposes that may arise in the future are not used.

*Clarification can be made verbally, in writing, through voice recording, through various physical or electronic channels through the call center, and directions can be made to the web page containing personal data disclosure texts and other channels that may be announced later. The relevant department, which provides information and fulfills its obligation to inform, takes measures to prove this in accordance with the law and procedure.

*If the purpose of data processing specified in the disclosure changes while obtaining personal data, the obligation to inform for this new purpose is fulfilled separately in accordance with the procedures stipulated above.

*If the personal data obtained will be used only for the purpose of communicating with the Personal Data Owner, clarification can be made during the first communication. *If the personal data obtained will be transferred to third parties, care is taken to ensure that clarification is made at the latest when the personal data is transferred for the first time.

6.2. Rights of the Personal Data Owner in accordance with the Personal Data Protection Law

In accordance with Article 10 of the Law, Endüstri notifies the Personal Data Owner of his rights; It provides guidance on how to use these rights and carries out the necessary internal functioning, administrative and technical arrangements for all these. Industrial, to the persons whose Personal Data is received in accordance with Article 11 of the Law;

*Learning whether Personal Data is processed or not,

*Requesting information about Personal Data if it has been processed,

*Learning the purpose of processing Personal Data and whether they are used for their intended purpose

*Knowing the third parties to whom Personal Data is transferred domestically or abroad,

*Request correction of Personal Data if it is incomplete or incorrectly processed, *Requesting that the transactions carried out in accordance with paragraphs (d) and (e) of Article 11 of the Law be notified to third parties to whom personal data is transferred,

*Objecting to the emergence of a result against the person by analyzing the processed data exclusively through automatic systems,

*Requesting compensation for damage in case of damage due to illegal processing of Personal Data

explains that they have rights. explains that they have rights.

The Data Owner may make his requests regarding his rights listed in this article in Turkish, in accordance with the Communiqué on Application Procedures and Principles to the Data Controller, by filling out the Industrial Application Form in writing (available at www.endustriyel.com) or by using the Registered Electronic Mail (KEP) address, Secure It can be forwarded to Endusteriyel using Electronic Signature, Mobile Signature or the e-mail address previously notified and registered in our system.

6.3. Situations in which the Personal Data Owner Cannot Assert His Rights

Since the following cases are excluded from the scope of the Law in accordance with Article 28 of the Law, Personal Data Owners cannot assert their rights listed in Article (6.2.) of this Policy in the following cases: Processing of Personal Data by natural persons within the scope of activities related to themselves or their family members living in the same residence, provided that they are not given to third parties and obligations regarding data security are complied with.

Processing of Personal Data for purposes such as research, planning and statistics by anonymizing it with official statistics.

Processing of Personal Data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defence, national security, public security, public order, economic security, privacy of private life or personal rights or constitute a crime.

Processing of Personal Data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defence, national security, public security, public order or economic security.

Processing of Personal Data by judicial authorities or enforcement authorities regarding investigation, prosecution, trial or enforcement proceedings. In accordance with Article 28/2 of the Law; In the cases listed below, Personal Data Owners cannot assert their rights listed in Article (6.2.) of this Policy, except for the right to demand compensation for damage:

Processing of Personal Data is necessary for the prevention of crime or criminal investigation.

Processing of personal data made public by the Personal Data Owner.

Processing of Personal Data is necessary for the execution of auditing or regulatory duties and disciplinary investigation or prosecution by public institutions and organizations and professional organizations that are public institutions, based on the authority granted by the law.

Personal Data processing is necessary to protect the economic and financial interests of the State regarding budget, tax and financial matters.

6.4. Procedure and Duration of Response to Applications Endustrtiyel takes all necessary administrative and technical measures to finalize the applications made by the Data Owner effectively, in accordance with the law and the rule of honesty. Industrial finalizes the requests in the application free of charge as soon as possible, within thirty days at the latest, depending on the nature of the request. Industrial, Data Owner’s applications may be accepted or rejected by explaining the reason. It submits its industrial response in writing or electronically. However, if the transaction requires an additional cost, the fee in the tariff may be requested if the conditions determined by the KVK Board are met.

CHAPTER SEVEN

UPDATES, ADAPTATION AND CHANGES

7.1. Update and Compatibility

Endustrial reserves the right to make changes to this Policy and other policies related to this Policy due to changes made in the Law, in accordance with the decisions of the KVK Board or in line with developments in the sector or the field of informatics.

Changes made to this Policy are immediately incorporated into the text and explanations regarding the changes are explained at the end of the Policy.

The policy is published on the website www.endustriyel.com.