Personal Data Protection (KVKK) Information Notice

CORPORATE GENERAL INFORMATION NOTICE

ON THE PROCESSING OF PERSONAL DATA

As ISBI ISTANBUL AHL SERBEST BOLGE KURUCU VE ISL. A.S. ("ISBI"), we have prepared this information notice in order to inform you, our Visitors, Online Visitors, Customers, Potential Customers, Supplier Employees and Supplier Representatives, about the processing, storage and transfer of your personal data within the framework of our activities arising from Personal Data Protection Law No. 6698 (the "KVKK") and the related legislation and legal arrangements.

1) What Categories of Your Personal Data Do We Process and for What Purposes?

Your personal information may be processed by ISBI ISTANBUL AHL SERBEST BOLGE KURUCU VE ISL. A.S. in accordance with the principles set out in Article 4.2 of the KVKK, namely:

(i) being processed lawfully and fairly,

(ii) being accurate and, where necessary, kept up to date,

(iii) being processed for specified, explicit and legitimate purposes,

(iv) being relevant, limited and proportionate to the purposes for which they are processed,

(v) being retained for the period stipulated in the relevant legislation or required for the purpose for which they are processed,

and within the scope of the business relationships we have established and maintain with our business partners (it is possible for one person to fall into more than one category), for the purposes set out below.

A. Our Visitors

Our visitors’ identity data (e.g. name, surname) and physical premises security data (e.g. camera recordings) will be processed for the purposes of:

a) creating and monitoring visitor records,

b) ensuring the security of physical premises.

B. Our Online Visitors

The transaction security data (e.g. your IP address), marketing data (e.g. purchase history data, survey and cookie records) and (where you notify us of them) identity data and contact data (e.g. your e-mail address) of our online visitors who use our website will be processed for the purposes of:

a) carrying out activities in compliance with the legislation,

b) conducting information security processes,

c) following up requests and complaints,

d) conducting communication activities,

e) providing information to authorised persons, institutions and organisations,

f) enabling your access to our website over the internet.

C. Our Customers

The identity data, contact data, customer transaction data (e.g. order details), physical premises security data, financial data (e.g. balance sheet data), legal transaction data and marketing data (e.g. purchase history data) of our individual customers or of the representatives and/or employees of our corporate customers will be processed for the purposes of:

a) carrying out activities in compliance with the legislation,

b) conducting finance and accounting affairs,

c) conducting/auditing business activities,

d) conducting logistics activities,

e) conducting after-sales support services for goods/services,

f) conducting goods/services sales processes,

g) conducting marketing analysis work,

h) conducting contract processes,

i) providing information to authorised persons, institutions and organisations,

j) ensuring the security of physical premises,

k) resolving legal disputes,

l) conducting storage and archiving activities,

m) conducting risk management processes,

n) conducting loyalty processes relating to the company/products/services,

o) conducting communication activities.

D. Our Potential Customers

The identity data, contact data, customer transaction data, physical premises security data and marketing data of our individual customers or of the representatives and/or employees of our corporate customers will be processed for the purposes of:

a) managing goods/services sales processes,

b) conducting contract processes,

c) ensuring the security of physical premises,

d) conducting marketing analysis work.

E. Our Supplier Employees

The identity data, contact data, physical premises security data and professional experience data (e.g. in-service training records) of our supplier employees will be processed for the purposes of:

a) conducting communication activities,

b) conducting/auditing business activities,

c) ensuring the security of physical premises,

d) conducting supply chain management processes,

e) conducting logistics activities,

f) carrying out activities in compliance with the legislation,

g) conducting occupational health and safety activities.

F. Our Supplier Representatives

The identity data, contact data, physical premises security data, customer transaction data, financial data, marketing data and legal transaction data of our individual suppliers or of the representatives of our corporate suppliers will be processed for the purposes of:

a) conducting/auditing business activities,

b) conducting goods/services procurement processes,

c) conducting finance and accounting affairs,

d) conducting contract processes,

e) conducting investment processes,

f) ensuring the security of physical premises,

g) following up and conducting legal affairs.

G. Relatives of Our Employees

The identity data and contact data (e.g. address details) of our employees’ relatives will be processed for the purpose of:

a) making the necessary social security notifications in the event of workplace accidents.

2) By What Methods Is Your Personal Data Collected?

Your personal data set out in the categories above is collected by automated or non-automated means through physical channels such as order forms, contracts and visitor forms, or through information systems and electronic devices (e.g. telecommunications infrastructure, computers and telephones), third parties (e.g. KKB and Findeks), our website and other documents declared by the data subject.

3) What Is the Legal Basis for the Collection of Your Personal Data?

Your personal data is processed by ISBI ISTANBUL AHL SERBEST BOLGE KURUCU VE ISL. A.S., in order to achieve the purposes set out above, on the legal grounds specified in Article 5 of the KVKK, namely:

(i) it being expressly provided for by law,

(ii) it being necessary to process the personal data of the parties to a contract, provided that it is directly related to the conclusion or performance of that contract,

(iii) it being necessary for the data controller to fulfil its legal obligation,

(iv) processing of data being necessary for the establishment, exercise or protection of a right,

(v) processing of data being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

4) Do We Transfer Your Personal Data to Third Parties?

a) The personal data of our visitors may be shared with law enforcement bodies and judicial authorities for the resolution of legal disputes and where requested in accordance with the relevant legislation.

b) The personal data of our online visitors may be shared with judicial authorities and authorised public institutions and organisations for the resolution of legal disputes and where requested in accordance with the relevant legislation.

c) The personal data of our customers is transferred, to the extent provided for by legal regulations, to authorised public institutions and organisations for the purposes of carrying out activities in compliance with the legislation, following up and conducting legal affairs and providing information to authorised persons, institutions and organisations; and, to the extent necessary for conducting/auditing business activities, conducting risk management processes and duly performing our services, to our group companies, our IT company, suppliers, courier companies, insurance companies, banks and our financial adviser. In addition, the personal data in question may be transferred to the law firm from which we receive services and to judicial authorities so that it may be used as evidence in any legal disputes that may arise in the future.

d) The personal data of our potential customers may be transferred to the law firm from which we receive services and to judicial authorities so that it may be used as evidence in any legal disputes that may arise in the future.

e) The personal data of our supplier employees is transferred, to the extent provided for by legal regulation, to authorised public institutions and organisations for the purposes of carrying out activities in compliance with the legislation, following up and conducting legal affairs, providing information to authorised persons, institutions and organisations and conducting/auditing business activities; and, to the extent necessary for the due performance of the service, to group companies, the IT company, suppliers, courier companies, banks and our financial adviser. In addition, the personal data in question may be transferred to the law firm from which we receive services and to judicial authorities so that it may be used as evidence in any legal disputes that may arise in the future.

e) The personal data of our supplier representatives is transferred, to the extent provided for by legal regulations, to authorised public institutions and organisations for the purposes of carrying out activities in compliance with the legislation, following up and conducting legal affairs, providing information to authorised persons, institutions and organisations and conducting/auditing business activities; and, to the extent necessary for the due performance of the service, to group companies, the IT company, suppliers, courier companies, banks and our financial adviser. In addition, the personal data in question may be transferred to the law firm from which we receive services and to judicial authorities so that it may be used as evidence in any legal disputes that may arise in the future.

f) The personal data of our employees’ relatives is transferred to authorised public institutions and organisations for the purposes of carrying out activities in compliance with the legislation, following up and conducting legal affairs, providing information to authorised persons, institutions and organisations and conducting/auditing business activities. In addition, the personal data in question may be transferred to the law firm from which we receive services and to judicial authorities so that it may be used as evidence in any legal disputes that may arise in the future.

5) Do We Transfer Your Personal Data Abroad?

Your personal data such as identity and contact data is transferred abroad because the servers of the Microsoft products used to enable the continuity of our business processes are located outside Turkiye. Your personal data is transferred in line with our legitimate interest, by concluding standard contracts and taking measures relating to the security of your data.

6) How Can You Exercise Your Rights Regarding Your Personal Data?

You may submit your requests under Article 11 of the KVKK, which governs the rights of data subjects, to ISBI Istanbul AHL Serbest Bolge Kurucu ve Isl. A.S. by means of the "Application Form to the Data Controller" prepared for your convenience in accordance with the "Communique on the Procedures and Principles of Application to the Data Controller" and published at "https://www.isbi.com.tr/".

Data Controller: ISBI ISTANBUL AHL SERBEST BOLGE KURUCU VE ISL. A.S.

Address: YESILKOY SB MAH. B-BLOK SOK. NO: 1 BAKIRKOY ISTANBUL

E-mail: kvkk@isbi.com.tr

Download the Application Form to the Data Controller