PERSONAL DATA PROTECTION, PROCESSING AND DESTRUCTION POLICY

I. Definitions

Explicit Consent	It is consent regarding a specific subject, based on informed consent and expressed with free will.
Anonymization	It means making personal data impossible to associate with an identified or identifiable natural person in any way, even by matching it with other data.
Personal Data	It is any information about an identified or identifiable natural person.
Special Personal Data	Data regarding race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, appearance, association, foundation or union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data are special data.
Processing of Personal Data	All kinds of operations performed on data such as obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by fully or partially automatic or non-automatic means provided that it is part of any data recording system.
panel	Personal Data Protection Board
Policy	RECSAN TECHNOLOGY INDUSTRY TRADE. INC. It is the Personal Data Protection and Processing Policy
Data Processor	It is a real or legal person who processes personal data on behalf of the data controller, based on the authority given by the data controller.
Data Controller	The data controller is the person who determines the purposes and means of processing personal data and manages the place where the data is systematically kept (data recording system).

II.                  Aim

This Policy; RECSAN TECHNOLOGY INDUSTRY TRADE. Inc. (". RECSAN TECHNOLOGY INDUSTRY TRADE INC") was established to determine the basic principles and principles of practice to be adopted in ensuring compliance with the obligations imposed on data controllers within the scope of the Personal Data Protection Law No. 6698 ("KVKK"), which came into force after being published in the Official Gazette dated 7 April 2016.

III.        Scope and Changes

This Policy, prepared in accordance with KVKK, relates to all personal data of our current and potential customers and employees, employees, shareholders and officials of the institutions we cooperate with, and third parties, processed automatically or non-automatically as part of any data recording system. RECSAN TEKNOLOJİ SANAYİ TİCARET A.Ş. reserves the right to make changes to the Protocol in line with the changes to be made in KVKK and the relevant regulation.

IV.        Principles to be Applied in Processing Personal Data

V. RECSAN TECHNOLOGY INDUSTRY TRADE INC. has adopted the following principles in collecting, processing and analyzing personal data.         

a.         Acting in Compliance with Law and Honesty Rules

2. . RECSAN TECHNOLOGY INDUSTRY TRADE INC. will collect and process personal data in a lawful and fair manner to protect the rights of data owners. The principles of proportionality and necessity will be taken into account in carrying out these activities.

b.         Purpose-specific Restriction

Personal data may only be processed for purposes defined before the data collection. Additional changes to the purpose are possible only to a limited extent and with justification.

c.         Transparency and Lighting

Data owners must be informed in detail before the collection and processing of their personal data.  Before collecting data, rights holders should be informed about the following:

• Identity of the data controller and his representative, if any

• Purpose of processing personal data

• To whom and for what purpose the processed personal data is transferred

• Method and legal reason for collecting personal data,

• Rights of the person whose personal data is processed in accordance with Article 11 of the KVKK.     

d.         Data Economy

Before processing personal data, it must be determined whether the processing is necessary to achieve the purpose and to what extent it is necessary. Anonymous or statistical data may be used where the purpose is acceptable and proportionate.      

to.       Deletion of Personal Data

After the expiry of the periods stipulated in the relevant laws for record keeping obligations and record keeping processes required for proof, personal data that is no longer required is deleted or destroyed or anonymized.

f.          Accuracy and Data Currentness

Personal data must be accurate, complete and, if known, up-to-date. Inaccurate or incomplete data must be deleted, corrected, completed or updated.      

g.         Privacy and data security

Personal data must be stored and maintained as confidential information. Personal Data must be protected and kept confidential at the personal level by taking the necessary administrative and technical measures to prevent unauthorized access, illegal transactions, sharing, accidental loss, alteration or destruction.

V. Personal Data Processing Purposes

Collection and processing of personal data will be carried out within the scope of the Information Text and the purposes stated below.

a.         Customer and business partners data

• Data processing for contractual relationship: Personal data of existing and potential customers and business partners (business partner representative if the business partner is a legal entity) may be processed for the establishment, implementation and termination of a contract without further approval. Personal data before the contract, at the stage of starting the contract; It may be processed for the purpose of preparing an offer, preparing a purchase form or meeting the data owner's requests regarding the implementation of the contract. During the contract preparation process, data owners can be contacted based on the information they provide.

• Data processing for advertising purposes: Personal data is processed for advertising or market and public opinion research only if the purpose of collecting this information is compatible with these purposes. The data owner is informed that their information will be used for advertising purposes. Data owners may refrain from providing their data that is reported to be used for advertising purposes or from consenting to their processing.  For data processed for advertising purposes, explicit consent of the data owner is required. The data controller may obtain the data owner's explicit consent via mail, e-mail or telephone. The use of personal data for advertising purposes is prevented without the explicit consent of the data owner.

• Data processing carried out due to our legal obligations or as expressly prescribed by law: Personal data may be processed without obtaining separate consent in order to clearly state the processing in the relevant legislation or to fulfill a legal obligation determined by the legislation. The type and scope of data processing must be necessary for the legally permissible data processing activity and must comply with the relevant legal provisions.

3. Principle of legitimate interest in the processing of Personal Data: Personal data may be processed without further consent when necessary for a legitimate interest of RECSAN TECHNOLOGY INDUSTRY TRADE INC.. Legitimate interests are generally legal interests.

• Processing of special categories of data: Special categories of personal data are processed within the framework of the provisions of KVKK and provided that adequate measures to be determined by the Board are taken. Special personal data of the personal data owner, other than their health and sexual life, are processed with their express consent, or in the absence of express consent, within the scope of the exceptions stipulated in the KVKK. Special personal data regarding people's health and sexual life can only be processed by persons or authorized institutions and organizations under the obligation of confidentiality, in the absence of explicit consent, for the purpose of protecting public health, preventive medicine, medical diagnosis, execution of treatment and care services, planning and management of health services and their financing.

4. Data processed exclusively through automatic systems: The processing of personal data obtained through automatic systems does not legitimize and legitimize the use and processing of these data in works that will negatively affect the personal data owner. The personal data owner has the right to object to the emergence of a negative result by analyzing the processed data exclusively through automatic systems. RECSAN TECHNOLOGY INDUSTRY TRADE INC. will try to take the necessary measures in line with the request of the personal data owner.

• User information and the internet: In case of collection, processing and use of personal data on the website or applications, users who have personal data must be informed about the use of the information they have saved on the site, privacy statement and cookies. The privacy statement and cookie information are integrated in a way that is easily identifiable, directly accessible and constantly relevant to the data subject.

b.         Principles regarding the processing of personal data of employees

It is mandatory to collect and process personal data of employees in the process from establishment, implementation and termination of the employment contract. Explicit consent of employees may not be obtained for these. Personal data of potential employee candidates are also processed during job applications. In case the candidate's job application is rejected, the personal data obtained during the application is kept for the appropriate data retention period for a later selection stage, and is deleted, destroyed or anonymized at the end of this period. The following principles should be taken into consideration when processing personal data regarding employees.

• Data transactions clearly stipulated in the law and carried out due to legal obligations: Personal data belonging to the employee may be processed without obtaining separate consent in order to clearly state the processing in the relevant legislation or to fulfill a legal obligation determined by the legislation.

5. Processing of data in accordance with legitimate interest: Personal data of employees can be processed without further approval in cases where RECSAN TECHNOLOGY INDUSTRY TRADE INC.. has a legitimate interest. Legitimate interests are generally interests of a legal or economic nature. In personal cases where the interests of employees must be protected, personal data is not processed for legitimate interest purposes. Before the data is processed, it is determined whether there are interests that require protection. If employee data is processed based on the legitimate interest of RECSAN TECHNOLOGY INDUSTRY TRADE INC, it should be examined whether this processing is proportionate and it should be checked that the legitimate interest does not violate a right of the relevant employee that needs to be protected.

• Processing of special categories of data: Special categories of personal data are processed only under certain conditions. Data regarding race and ethnic origin, political thought, religion, philosophical belief, sect or other beliefs, appearance and clothing, association, foundation or union membership, health, sexual life, criminal conviction and security measures, and biometric and genetic data are defined as special quality data. Special categories of personal data can only be processed with the employee's explicit consent and by taking the necessary administrative and technical measures. The following cases constitute an exception to this provision, and in the specified cases, special personal data may be processed even if there is no explicit consent of the employee.

o Special personal data, other than the employee's health and sexual life, in cases stipulated by law,

o Special personal data regarding the employee's health and sexual life can only be collected by persons or authorized institutions and organizations under the obligation of confidentiality, for the purpose of protecting public health, carrying out preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing.

• Data processed exclusively through automatic systems: If the personal data of employees is processed exclusively through automatic systems as part of the employment relationship, the employee has the right to object to the emergence of a result against him/her by using this data or to object to the resulting result.

6. Telecommunications and internet: Telephone equipment, e-mail addresses, intranet and internet, as well as intra-company networks, are provided by RECSAN TECHNOLOGY INDUSTRY TRADE INC.. primarily for business-related tasks. These are working tools and resources of RECSAN TECHNOLOGY INDUSTRY TRADE INC. These vehicles must be used in accordance with legal regulations and RECSAN TECHNOLOGY INDUSTRY TRADE INC. internal regulations. There is no general monitoring of telephone and e-mail communications or intranet and internet use. In order to prevent attacks against the IT infrastructure or individual users, protective measures are taken during transitions to the RECSAN TECHNOLOGY INDUSTRY TRADE INC. network, blocking technically harmful content or analyzing the modeling of attacks. Telephone Hardware usage, email addresses, intranet/internet and/or internal social networks are stored for a limited period of time for security reasons. Evaluation of these data regarding the person is made only if there is a concrete suspicion. These controls are only carried out by the relevant units, provided that the principle of proportionality is maintained.

7. Access Prohibition: RECSAN TECHNOLOGY INDUSTRY TRADE INC. processes, protects and preserves the personal data it collects with its legal obligations, legitimate interests and the explicit consent of its employees, in accordance with the purposes for which they were collected, and shares personal data only with its relevant employees. The personal responsibility of the relevant employee will be taken regarding the work carried out by the employees within the scope of their job descriptions and any work and transactions they carry out regarding personal data that do not require access permission or in cases where RECSAN TECHNOLOGY INDUSTRY TRADE INC. does not have express written authorization, and therefore legal measures will be taken. For this reason, employees should be provided with regular training on the issues of not disclosing and sharing personal data unlawfully, and a disciplinary process should be established if employees do not comply with security policies and procedures.

VI.        Transfer of Personal Data

8. Transfer of personal data to a third party other than RECSAN TECHNOLOGY INDUSTRY TRADE INC. will be carried out within the scope of the purposes stated in the Information Text and stated below. Accordingly, RECSAN TECHNOLOGY INDUSTRY TRADE INC will be able to transfer personal data to the following persons and institutions for certain purposes;

9. To RECSAN TECHNOLOGY INDUSTRY TRADE INC business partners on a limited basis in order to ensure that the purposes of establishing the business partnership are fulfilled,

10. RECSAN TECHNOLOGY INDUSTRY TRADE INC. To suppliers who provide the products and services necessary to carry out their commercial activities and are outsourced from the supplier,

11. It is limited to ensuring the execution of commercial activities that require the participation of RECSAN TECHNOLOGY INDUSTRY TRADE INC. its subsidiaries, RECSAN TECHNOLOGY INDUSTRY TRADE INC. To its shareholders, To legally authorized public institutions and organizations limited to the purpose requested by the relevant public institutions and organizations within their legal authority, To legally authorized private legal persons limited to the purpose requested by the relevant private law persons within their legal authority.

12. Your personal data processed by RECSAN TECHNOLOGY INDUSTRY TRADE INC. will be transferred to these countries after they are declared by the Board to have adequate protection. Personal data can only be transferred to countries and regions where it is declared that there is no adequate protection, if the data owner gives consent or if the data controllers in Turkey and the relevant foreign country undertake to provide adequate protection in writing and have the permission of the Board. RECSAN TECHNOLOGY INDUSTRY TRADE INC.  may also use cloud storage services in the processing of your personal data.

VII.       Data Owner's Rights

Personal Data Owners:

• Learning whether personal data is processed or not,

• Requesting information if personal data has been processed,

• Learning the purpose of processing personal data and whether they are used for their intended purpose,

• Knowing the third parties to whom personal data is transferred domestically or abroad,

• Requesting correction of personal data in case of incomplete or incorrect processing and requesting that the action taken in this context be notified to third parties to whom personal data has been transferred,

• Requesting the deletion or destruction of personal data in case the reasons requiring processing no longer exist, even though it has been processed in accordance with the provisions of KVKK and other relevant laws, and requesting that the transaction carried out in this context be notified to third parties to whom personal data has been transferred,

• Object to the emergence of a result that is unfavorable to the individual by analyzing the processed data exclusively through automatic systems,

• In case of damage due to illegal processing of personal data, request compensation for the damage. has the rights and authorities to make a request, and if a request in this direction reaches RECSAN TECHNOLOGY INDUSTRY TRADE INC., RECSAN TECHNOLOGY INDUSTRY TRADE INC must respond to the request within the time limit. For this reason, RECSAN TECHNOLOGY INDUSTRY TRADE INC. will provide the necessary information to data owners about the use of the above-mentioned rights and the evaluation of the requests.

• The exceptions to the above rights granted to personal data owners in KVKK are listed below, and in these cases, RECSAN TECHNOLOGY INDUSTRY TRADE INC is not obliged to respond to the requests from data owners: Processing of personal data for purposes such as research, planning and statistics by anonymizing them with official statistics, Not to violate national defence, national security, public security, public order, economic security, privacy of private life or personal rights or not to constitute a crime. provided that it is processed for artistic, historical, literary or scientific purposes or within the scope of freedom of expression,

• Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defence, national security, public safety, public order or economic security.

• Personal data regarding investigation, prosecution, trial or execution procedures

Processing by judicial authorities or enforcement authorities. In accordance with KVKK, relevant persons cannot assert their other rights, except for the right to demand compensation for damage, in the following cases:

• Processing personal data is necessary for the prevention of crime or criminal investigation.

• Processing of personal data made public by the personal data owner.

• Processing of personal data is necessary for the execution of auditing or regulatory duties and disciplinary investigation or prosecution by public institutions and organizations and professional organizations that are public institutions, based on the authority granted by the law.

• Personal data processing is necessary to protect the economic and financial interests of the State regarding budget, tax and financial matters.

13. Personal data owners will be able to exercise their above-mentioned rights after filling out the Personal Data Application Form on our website with the extension www.duoactive.com, then sign it and send the original to RECSAN TECHNOLOGY INDUSTRY TRADE INC. along with photocopies of their ID cards to Firuzköy Mah Çavuş Cad. N022/8C Avcılar / İstanbul, by hand or by registered letter. In applications made on behalf of a person other than the personal data owner, the personal data owner must have a power of attorney duly issued by the rightful person. RECSAN TECHNOLOGY INDUSTRY TRADE INC. may request additional information from the relevant person in order to determine whether the applicant is the personal data owner, and may ask questions about the application to the personal data owner in order to clarify the issues stated in the application.

14. RECSAN TECHNOLOGY INDUSTRY TRADE INC. will finalize the request free of charge as soon as possible and within thirty (30) days at the latest, depending on the nature of the request.

VIII.      Security

Personal data is subject to confidentiality. Employees are prohibited from collecting, processing or using data without permission. Unauthorized use is unauthorized data processing carried out by employees outside of their legitimate duties. The Know principle applies: Employees can only access personal data if it is appropriate for the scope and nature of the task in question.

Employees are prohibited from using personal data for private or commercial purposes, distributing it to unauthorized persons, or otherwise making it accessible. Managers must inform their employees about data protection obligations at the beginning of the employment relationship. This obligation continues after the termination of the employment relationship.

.         Security

X. Recsan Technology Industry Trade Inc. is taking the necessary measures and controls in order to prevent the process of unlawful processing of the personal data it is processing, to prevent the access to the data unlawfully and to ensure the appropriate safety level in order to ensure the preservation of the data. This applies regardless of whether data processing is done electronically or in writing. Before starting new methods of data processing, especially in the transition to new IT systems, technical and organizational measures for the protection of personal data are defined and implemented. These measures are based on recent developments, the risks of the transaction and the need to protect the data, determined by the information classification process. Technical and organizational measures for the protection of personal data are part of company information security management and are constantly adapted to technical developments and organizational changes.

X. Control and Audits

Compliance with the Personal Data Protection and Processing Policy and KVKK is ensured through regular data protection audits and other controls.

• XI.         Data Breaches Management

15. Recsan Technology Industry Trade Inc. will immediately take the necessary security measures to protect personal data obtained in violation of this Policy and KVKK provisions and will notify the relevant person and the Board of this situation as soon as possible. For this purpose, it is the responsibility of RECSAN TEKNOLOJİ SANAYİ TİCARET A.Ş. to create systems and application methods that enable personal data owners to convey their requests and complaints regarding their personal data in the most effective and short time.  If deemed necessary by the Board, this situation may be announced on the Board's website or by another method.

XII.      Obligation to Register in the Data Controllers Registry

• XIII.         . Recsan Technology Industry Trade Inc.. is obliged to register in the Data Controllers Registry specified in Article 16 of the KVKK, and will register in the Data Controllers Registry by submitting the application information and documents listed in the KVKK within the period determined and announced by the Board. Accordingly, the information and documents to be submitted to the Board for registration in the registry are as follows:

Recsan Technology Industry Trade Inc. as the data controller. Identity and address information of Ş and its representative, if any,

• For what purpose personal data will be processed,

• Explanations about the data subject person group and groups and the data categories belonging to these people,

• Recipient or recipient groups to which personal data can be transferred,

• Personal data intended to be transferred to foreign countries,

• Measures taken regarding personal data security,

• Maximum period required for the purpose for which personal data are processed.

CONDITIONS FOR DELETION, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA

• If the purpose for processing personal data disappears, explicit consent is withdrawn, or all of the conditions for processing personal data in Articles 5 and 6 of the Law disappear, or if there is a situation where none of the exceptions in the mentioned articles are applicable, the personal data whose processing conditions are no longer valid will be deleted by the relevant business unit, taking into account business needs, within the scope of Articles 7, 8, 9 or 10 of the Regulation, by explaining the justification of the method applied, is destroyed or made anonymous. However, in case of a final court decision, the destruction method ordered by the court decision must be applied.

16. When a natural person who is the owner of a personal data requests the deletion, destruction or anonymization of his or her personal data by applying to Recsan Technology Industry Trade Inc.  pursuant to Article 13 of the Law, the relevant data owner business unit examines whether all the conditions for processing personal data have been eliminated. If all processing conditions are eliminated; deletes, destroys or anonymizes the personal data subject to the request. Again, as regulated in Article 138 of the Turkish Penal Code, Article 7 of the KVK Law and Article 7 of the Regulation on Deletion, Destruction or Anonymization of Personal Data, personal data is deleted, destroyed or anonymized based on our Company's own decision or upon the request of the personal data owner, in case the reasons requiring processing are eliminated, even though it has been processed in accordance with the provisions of the relevant law.

• In this context, our Company takes the necessary technical and administrative measures within the Company in order to fulfill its relevant obligations; It has developed the necessary operating mechanisms in this regard; It trains, assigns and raises awareness of the relevant business units in order to comply with these obligations. While the names and surnames of people who come to our Company's buildings as guests are obtained, or through texts posted in the Company or made accessible to guests in other ways, the personal data owners in question are clarified in this context. The data obtained for the purpose of tracking guest entry and exit is processed solely for this purpose, or the relevant personal data is recorded in the data recording system in the physical environment. To ensure security by our company and for the purposes specified in this policy; Our Company can provide internet access to our Visitors upon request during their stay in our Buildings and Facilities. In this case, log records regarding your internet access are recorded in accordance with Law No. 5651 and the mandatory provisions of the legislation issued in accordance with this Law; These records are processed only upon request by authorized public institutions and organizations or to fulfill our relevant legal obligations during audit processes to be carried out within the Company. Only a limited number of Company employees have access to the log records obtained in this context. Company employees who have access to the aforementioned records access these records only for use in requests or audit processes from authorized public institutions and organizations and share them with legally authorized persons. A limited number of people who have access to the records declare with a confidentiality agreement that they will protect the confidentiality of the data they access. On the websites owned by our company; visit these sites To ensure that visitors visit the sites in accordance with their visiting purposes; Internet movements within the site are recorded through technical means (e.g. cookies) in order to show them customized content and engage in online advertising activities. Detailed explanations regarding the protection and processing of personal data regarding these activities carried out by our company are included in the "Data Privacy and Security Policy" texts of the relevant websites.