Protection and Processing of Personal Data Policy

---

PERSONAL DATA PROTECTION LAW
INFORMATION TEXT

We attach great importance to the security of your personal data at Gemciler Güven Metal San. ve Tic. A.Ş. With this awareness, as a Company, we place great importance on processing and preserving all kinds of personal data belonging to individuals related to the Company in accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK”). As the “Data Controller” defined within the scope of KVKK, we process your personal data within the limits prescribed by the legislation and as explained below.

In this information text;

Personal Data: Any kind of information related to a real person whose identity is determined or can be determined,

Law on Protection of Personal Data (“KVKK”): The Law No. 6698 on the Protection of Personal Data published in the Official Gazette on 07.04.2016 and entered into force,

Data Controller: The real or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system,

Data Processor: The real or legal person who processes personal data on behalf of the Data Controller based on the authority given by the Data Controller.

DATA CONTROLLER

The personal data you share as a recipient, member, donor, scholarship recipient, intern, supplier, visitor, grant recipient, award recipient, supported, program partner, and/or employee/manager within the scope determined below will be evaluated by Gemciler Güven Metal San. ve Tic. A.Ş, determined as the data controller within the scope of the Law on the Protection of Personal Data (KVKK).

1. 1COLLECTION, PROCESSING, AND PROCESSING PURPOSES OF PERSONAL DATA
2. 1. • Gemciler Güven Metal San. ve Tic. A.Ş aims to process your personal data in accordance with the Law on the Protection of Personal Data No. 6698 (“KVKK”) and other related legislation. Your personal data may vary depending on the relationship between you and our company and may be collected verbally, in writing, or electronically through our company units, website, social media channels, mobile applications, and similar means by automatic or non-automatic methods. Your personal data will be created and processed as long as your relationship with our company continues. Your personal data will be processed when you visit our company or our website, or when you attend training, seminars, or events organized by our company. Your personal data obtained or to be obtained by us in any way will be processed by our company as the Data Controller;
   2. • Within the framework of the purpose requiring the processing of personal data, and in a limited, proportional, and measured manner,
   3. • By maintaining the accuracy and most up-to-date status of personal data as you have informed us or as it has been informed,
   4. • We inform you that your personal data will be recorded, stored, maintained, rearranged, shared with competent authorities authorized to request such personal data by law, shared with domestic or foreign third parties in accordance with the conditions specified in the KVKK, transferred, classified, and processed in other ways specified in the KVKK, and subjected to other processes specified in the KVKK.

Your collected personal data will be processed by the relevant business units of our company in accordance with the conditions and purposes of processing personal data specified in Articles 5 and 6 of the KVKK, for the following purposes:

1. - In compliance with the law and honesty rules,
2. - Correct and up-to-date when necessary,
3. - For specific, clear, and legitimate purposes,
4. - Relevant, limited, and proportionate to the purpose for which they are processed,
5. - Maintained for the period prescribed by the relevant legislation or for the period necessary for the purpose of processing,

in accordance with the rules.

1. 1THE RECIPIENTS AND PURPOSE OF PROCESSING PERSONAL DATA

Your collected personal data; will be transferred to our business partners, suppliers, authorized employees, legally authorized public institutions and legally authorized private persons, necessary third parties, and foreign companies with which we cooperate, within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the KVKK for the purposes of conducting necessary activities by the relevant business units of our company for you to benefit from our company's services, ensuring the legal and commercial security of our company and persons having a business relationship with our company, determining and implementing the commercial and business strategies of our company, and ensuring the implementation of our company's human resources policies.

1. 2THE METHOD OF COLLECTING PERSONAL DATA AND THE LEGAL BASIS

Your personal data is collected through all kinds of verbal, written, or electronic means for the purpose of providing our services in line with the mentioned purposes and fulfilling our company's contractual and legal obligations completely and accurately. Within the scope of this legal basis, your personal data collected may be processed and transferred for the purposes specified in items (1) and (2) of this article within the framework of the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVKK.

1. 3RIGHTS OF THE DATA SUBJECT AS PER ARTICLE 11 OF THE KVKK

As data subjects, you can submit your requests regarding your rights to our company by the methods specified below, and our company will conclude your requests free of charge within a maximum of 30 days, depending on the nature of the request. However, if a fee is determined by the Personal Data Protection Board, the fee specified by our company will be charged. In this context, data subjects;

What Are Your Rights as the Data Subject?

According to Article 11 of the KVKK, data subjects have the following rights:

1. A. To learn whether personal data is processed or not,
2. B. If personal data has been processed, to request information regarding this,
3. C. To learn the purpose of processing personal data and whether they are used for their purpose,
4. D. To know the third parties to whom personal data is transferred domestically or internationally,
5. E. If personal data is incomplete or incorrectly processed, to request their correction,
6. F. To request the deletion or destruction of personal data within the scope of the conditions stipulated in Article 7 of the KVKK,
7. G. To request that the transactions carried out in accordance with paragraphs (e) and (f) be notified to third parties to whom personal data is transferred,
8. H. To object to the occurrence of a result against the person himself/herself by analyzing the processed data solely through automated systems,
9. I. To demand compensation for damages in case of suffering damage due to the unlawful processing of personal data.

According to the first paragraph of Article 13 of the KVKK, you can submit your request to use the above-mentioned rights to our company in writing or through other methods determined by the Personal Data Protection Board. Since the Personal Data Protection Board has not determined any method at this stage, your application must be submitted to our company in writing in accordance with the KVKK. In this context, the channels and methods through which you will submit your applications to our company within the scope of Article 11 of the KVKK are explained below.

1. • Personally by the applicant,
2. • Through a notary public,
3. • By the applicant, signed with the "secure electronic signature" defined in Law No. 5070 on Electronic Signature and sent to our company's registered postal address or our company's KVKK contact address

Below, information is provided on how written applications will be delivered to us in terms of written application channels.

Application Management	Address for Application	Information to be Provided in Application Sending
In-Person Application (By personally coming with a wet-signed request of the applicant and identifying document)	Karacasu Karaziyaret Mah. Fatih Sultan Mehmet Cad. No. 53/A Kahramanmaraş / TÜRKİYE	"Request for Information under the Personal Data Protection Law" will be written on the envelope.
Notification via Notary Public	Karacasu Karaziyaret Mah. Fatih Sultan Mehmet Cad. No. 53/A Kahramanmaraş / TÜRKİYE	"Request for Information under the Personal Data Protection Law" will be written on the notification envelope.
Sent through Registered Electronic Mail (KEP) with the "Secure Electronic Signature" of the Relevant Company	[email protected]	"Request for Information under the Personal Data Protection Law" will be written in the subject line of the email.
Sent to our company's KVKK contact address	[email protected]	"Request for Information under the Personal Data Protection Law" will be written in the subject line of the email.

Your applications submitted to us will be responded to within thirty days from the date your request reaches us, in accordance with the second paragraph of Article 13 of the KVKK, depending on the nature of the request. Our responses will be delivered to you in writing or electronically in accordance with Article 13 of the KVKK. You can use the above-mentioned rights and send your requests containing explanations regarding the right you wish to exercise under Article 11 of the KVKK, along with the necessary information to identify yourself, clearly and comprehensively through the methods explained above to our company.

With Regards
GEMCILER GUVEN METAL SAN. AND TIC A.S.