GDPR

PERSONAL DATA PROCESSING AND PROTECTION POLICY

CONTENTS

PREFACE

1. Purpose and Scope

2. Definitions

3. Identity of the Data Controller

4. Purposes of Data Processing

5. Organizational Structure of the Data Controller

5.1. Company Bodies

5.2. Board Structure

6. Organization Structure for Personal Data Protection

6.1. Personal Data Protection Unit

6.2. Contact Person

7. General Principles for Processing Personal Data

8. Conditions for Processing Personal Data

9. Conditions for Processing Special Categories of Personal Data

10. Legal Exceptions and Explicit Consent Declaration for Processing Personal and Special Categories of Data

10.1. Processing Personal Data Without Explicit Consent

10.2. Processing Special Categories of Data Without Explicit Consent

10.3. Full Exceptions to the Application of the Data Protection Law

10.4. Partial Exceptions

11. General Information on Processing Personal Data

11.1. Channels Through Which Personal Data is Obtained

11.2. Categorization of Personal Data

11.3. Categorization of Data Subjects

12. Storage and Destruction of Personal Data

13. Sharing of Personal Data with Third Parties

14. Obligation to Inform

15. Rights of the Data Subject

16. Measures for Personal Data Security

17. Storage of Records Related to Internet Access Provided to Visitors

18. Processing of Personal Data Collected Through Cookies

19. Other Provisions

PREFACE

The right to the protection of personal data has been recognized as a fundamental human right in Article 8 of the European Union's Charter of Fundamental Rights and Article 16 of the Treaty on the Functioning of the European Union. Additionally, personal data is regulated under Article 20 of the Constitution of the Republic of Turkey titled "Privacy of Private Life," thereby including it among fundamental rights.

Due to its importance, the Personal Data Protection Law No. 6698 ("KVKK") was published in the Official Gazette dated April 7, 2016, to protect primarily the privacy of private life along with the fundamental rights and freedoms of individuals during the processing of personal data belonging to natural persons, and to regulate the obligations of natural and legal persons processing personal data, and the procedures and principles to be followed.

1. PURPOSE AND SCOPE

Grazhan International Foreign Trade Ltd. Co. ("COMPANY") Personal Data Processing and Protection Policy ("Policy") has been prepared within the framework of the legislation on personal data, aiming to discipline the processing of personal data and to protect fundamental rights and freedoms, primarily the privacy of private life, as foreseen by the Constitution.

In preparing the "Policy," the primary principle has been to determine which data the COMPANY's working units collect, why they collect this data, and why there is a need to transfer this data to third parties, and to understand the COMPANY's personal data processing method. While transferring the requirements of the relevant legislation into the "Policy," it is also principled to explain, in a simple and understandable language, which data the COMPANY obtains and why it processes this data, while adhering to the necessity of protecting personal data. Additionally, it is aimed to take necessary administrative and technical measures to protect data privacy within and outside the COMPANY's organization and to inform and enlighten individuals whose data is processed.

The "Policy" covers all natural persons whose data is processed by the COMPANY.

Within the scope of this "Policy," an attempt has been made to provide specialized information about the data processed within the framework of operations and activities within the COMPANY's organization, data categorization, groups of data recipients, legal reasons and methods for data collection, groups of third parties to whom data is transferred, data processing periods, and data destruction periods. However, if data processing activities are to be carried out by the COMPANY beyond the current processing activities, it is possible to carry out processing activities and provide information within the scope of a separate enlightenment text, adhering to the basic principles and premises stated in this policy. In this case, the enlightenment provided will constitute an inseparable part of this "Policy," and it cannot be claimed that it is not included in this "Policy." Indeed, as per Article 5 of the Communiqué on the Procedures and Principles for the Fulfillment of the Obligation to Inform, enlightenment can be provided through physical or electronic means such as verbal, written, voice recording, or call center.

2. DEFINITIONS