KVKK Policy

PROCESSING OF PERSONAL DATA INFORMATION TEXT

1. INTRODUCTION

The security and/or protection of your personal data is among the priorities of Erkal Haddecilik Iron & Steel TRADE INDUSTRY Co. Ltd. With this awareness, we attach great importance to processing and preserving all kinds of personal data belonging to individuals associated with the Company in accordance with the Personal Data Protection Law numbered 6698, ensuring compliance. In this regard, as defined in the Law on the Protection of Personal Data (“KVKK”), acting as the “Data Controller,” and in accordance with the “Communiqué on the Principles and Procedures to be Followed in Fulfilling the Obligation of Disclosure” published in the Official Gazette dated 10 March 2018 by the Personal Data Protection Board with the principles set forth, we present this information to inform the data subjects about the identity of our Company during the collection of their personal data, the purposes for which their personal data will be processed, to whom and for what purposes the processed personal data may be transferred, the method of collecting personal data and its legal basis, and the rights of the data subject within the scope of Article 11 of the KVKK.

The expressions “we” and “our” mentioned in this Information Text, unless explicitly stated otherwise, are used to refer to Erkal Haddecilik Iron & Steel TRADE INDUSTRY Co. Ltd.

2. PERSONAL DATA

2.1. Definition of Personal Data

In the framework of Article 3/I(d) of the KVKK, “personal data” refers to any kind of information relating to identified or identifiable real persons. Accordingly, personal data encompasses any information related to an identified or identifiable real person. For example; your name, surname, Turkish Republic ID number, address, phone number, email address, date of birth, IP address, information about the transactions you perform, etc., are your personal data. Additionally, according to the KVKK; data concerning individuals’ race, ethnicity, political opinions, philosophical beliefs, religion, sect, or other beliefs, appearance, clothing, membership to associations, foundations, unions, etc., health, sexual life, criminal convictions and security measures, genetic data, etc., are classified as special categories of personal data. Within this scope, anonymous information, information anonymized in a way that it cannot be associated with a specific person, and other data not attributable to an individual are not considered personal data in accordance with our Company’s Policy on this matter.

2.2. Concept of Processing Personal Data

In the context of Article 3/I(e) of the KVKK, the processing of personal data refers to any kind of operation performed on the data such as obtaining, recording, storing, preserving, altering, reorganizing, disclosing, transferring, taking over, making obtainable, classifying, or preventing the use of the data, either fully or partially, by automatic means or non-automatic means, provided that they are part of any data recording system.

3. SCOPE OF DISCLOSURE

3.1. Identity of Data Controllers

Under the KVKK, the “Data Controller” refers to the real or legal person responsible for determining the purposes and means of processing personal data and establishing and managing the data recording system. Accordingly, in accordance with the KVKK, the entities subject to the “Data Controller” regarding Erkal Haddecilik Iron & Steel TRADE INDUSTRY Co. Ltd. belong to Legal Persons.

3.2. Collection, Processing, and Purposes of Processing Personal Data

Your Personal Data are processed within the framework of activities related to the services, products, or commercial activities provided by our Company, and can vary depending on the service and product; they are processed by our business units to ensure the security of the work and workplace, to establish commercial relations in compliance with the law and securely, either by automatic or non-automatic methods, collected verbally, in writing, or electronically through offices, branches, website, social media platforms, mobile applications, and similar means.

In accordance with Articles 5.2 and 6.3 of the KVKK, your Personal Data may be processed without your explicit consent for the fulfillment of legal obligations under the scope of the mentioned law, the establishment or performance of a contract, fulfillment of legal obligations, establishment, use, or protection of a right, and for legitimate interests without causing harm to your fundamental rights and freedoms. Additionally, subject to obtaining your explicit consent as required by Article 5.1 and Article 6.2 of the KVKK, your Personal Data may be processed for the purposes stated in this Information Text. Therefore, except for exceptional cases, you give explicit consent for the processing of your Personal Data.

The collected personal data are processed / will be processed in accordance with the conditions of processing personal data and the purposes specified in Articles 5 and 6 of the KVKK and other relevant legislation in order to carry out necessary work by our business units to benefit you from the products and services offered by our Company, to customize the products and services provided by our Company according to your preferences, usage habits, and needs, to ensure the legal and commercial security of persons in relation to our Company, such as administrative operations related to communication conducted by our Company, physical security and control of Company locations, evaluation processes for business partners/customers/suppliers (authorized or employees), legal compliance processes, financial matters, etc., to determine and implement the commercial and business strategies of our Company and to execute the human resources policies of our Company.

3.3. To Whom and For What Purposes Processed Personal Data Can be Transferred Domestically and/or Abroad

The processed Personal Data can be transferred / may be transferred by our Company to carry out necessary work by our business units to benefit you from the products and services offered by our Company, to customize the products and services provided by our Company according to your preferences and needs, to ensure the legal and commercial security of persons in relation to our Company, such as administrative operations related to communication conducted by our Company, physical security and control of Company locations, evaluation processes for business partners/customers/suppliers (authorized or employees), legal compliance processes, financial matters, etc., to determine and implement the commercial and business strategies of our Company and to execute the human resources policies of our Company.

The collected Personal Data can be transferred / may be transferred within the scope of legal requirements to administrative and official authorities, individuals and institutions as required by legislation and for fulfilling legal obligations, to independent audit firms within the framework of legal obligations and within legal limitations, to tax consultants and other external professional consultants, lawyers, insurance companies, banks operating in Turkey, partners, business partners, suppliers, legally authorized public institutions and private individuals, both within the framework of personal data processing conditions and purposes specified in Articles 8 and 9 of the KVKK, and within the framework of other legal legislation.

The collected Personal Data can be transferred / may be transferred to foreign countries announced by the Personal Data Protection Board as having adequate protection or to foreign countries where the data controllers in Turkey and the relevant foreign countries have committed in writing to provide adequate protection and where the permission of the Personal Data Protection Board exists, or if adequate protection is not available. Our Company acts / will act in accordance with the regulations foreseen in Article 9 of the KVKK and other relevant legislation in this regard.