سياسة معالجة البيانات الشخصية وحمايتها

POLICY ON THE PROCESSING AND PROTECTION OF PERSONAL DATA (Kişisel Verilerin İşlenmesi ve Korunması Politikası)

TABLE OF CONTENTS

• Purpose
• Scope and Application
• Definitions
• Processing of Personal Data
  • Principles Observed in the Processing of Personal Data
  • Purposes of Processing Personal Data
  • Legal Grounds for the Processing of Personal Data
  • Legal Grounds for the Processing of Special Categories of Personal Data
• Duty to Inform
• Data Security
  • Technical Measures
  • Administrative Measures
• Transfer of Personal Data
  • Domestic Transfer
  • Transfer Abroad
• Personal Data Inventory
• Roles and Responsibilities
• Erasure, Destruction and Rendering Anonymous of Personal Data
• Rights of the Data Subject and Exercise of Rights
  • Rights of the Data Subject
  • Exercise of Rights
  • Assessment of the Application
  • Our Right to Reject an Application
  • Right to Complain
• Publication of the Policy, Entry into Force
• Updating of the Policy

Purpose

The principal purpose of this Policy on the Protection and Processing of Personal Data (“Policy”) is, by providing explanations concerning the personal data processing activity carried out lawfully by Er-El Makina Yedek Parça İml. San. ve Tic. Limited Şirketi (“Company”) and the systems adopted for the protection of personal data, to determine the procedures and principles to be complied with by the persons who process data by virtue of their relationship with the Company and to ensure transparency towards the persons whose data is processed.

The Company carries out its activities in accordance with the Turkish Personal Data Protection Law No. 6698 (“PDPL”) and the relevant legislation, and primarily with the Constitution of the Republic of Türkiye and the provisions of the international conventions to which we are a party, regarding the protection and confidentiality of personal data. The Company approaches the protection of personal data and of fundamental rights and freedoms with sensitivity; in all of its activities it keeps fundamental human rights such as the privacy of private life and freedom of thought at its focal point.

Scope and Application

This Policy has been prepared with due regard to the regulations in force and to international standards. The Company shall primarily apply this Policy in all data processing activities such as processing, transferring and altering data.

The Company also has different policies addressing the protection of personal data and the provision of information security in relation to certain business activities and processes. Unless it contains additional conditions or requires a higher standard for the protection of personal data, this Policy does not invalidate the data protection conditions in the Company’s said different policies. This Policy is applied, to the extent appropriate, together with the said other policies and procedures.

In the event of a conflict between the provisions of the relevant legislation in force on the protection and processing of personal data and the provisions of this Policy, the provisions of the current legislation shall prevail.

Definitions

PDPL: Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu)

GDPR: European Union General Data Protection Regulation

Data Processor: The natural and legal person who processes personal data on behalf of the data controller on the basis of the authority granted by the data controller

Data Controller: The person who determines the purposes and means of processing personal data and who manages the place where the data is kept systematically (data recording system)

Data Owner/Data Subject: The employees, customers, business partners, shareholders, officers, potential customers, candidate employees, interns, visitors and suppliers with whom the Company and the Company’s affiliated subsidiaries have a commercial relationship, the employees of the institutions with which it works in cooperation, third parties and, without being limited to those listed herein, the natural persons whose personal data is processed

Explicit Consent: Consent relating to a specific subject, based on information and declared with free will

Personal Data: Any information relating to an identified or identifiable natural person

Special Categories of Personal Data: data relating to persons’ race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, together with their biometric and genetic data

Processing of Personal Data: Any operation carried out on data, such as obtaining, recording, storing, retaining, altering, rearranging, disclosing, transferring, taking over, making obtainable, classifying or preventing the use of personal data by wholly or partly automated means or by non-automated means provided that it forms part of any data recording system

Rendering Personal Data Anonymous: Rendering personal data incapable of being associated in any way whatsoever with an identified or identifiable natural person, even by matching it with other data

Erasure of Personal Data: Rendering personal data in no way accessible and no longer reusable for the relevant users

Destruction of Personal Data: The operation of rendering personal data in no way accessible, retrievable and reusable by anyone

PDP Board/the Board: The Personal Data Protection Board

PDP Authority/the Authority: The Personal Data Protection Authority

Processing of Personal Data

Principles Observed in the Processing of Personal Data

The Company’s policies and procedures are applied in parallel with the processing principles set out in the PDPL and the relevant legislation. We know that these principles are of vital importance for data subjects’ exercise of their rights and for their control over their data, and we show the utmost sensitivity in making these principles our focal point in all of our processing activities. Our principles in our personal data processing activities are as follows;

• Personal data is processed lawfully, fairly and transparently.

  The Company relies on the legal processing grounds set out in the PDPL in its data processing activities. Furthermore, as required by the principle of fairness, it observes the reasonable expectations of data subjects. The Company uses clear and comprehensible language in its communication with the data subject and is always in an easily accessible position.

• Personal data is processed only for specific, explicit and legitimate purposes.

  The Company determines the purpose of the processing activity before carrying out data processing activities. Data is processed only for additional purposes that are compatible with the initial purpose of processing. For each additional purpose, compatibility with the initial purpose is determined according to internationally accepted criteria. Our Company informs data subjects about the purposes of data processing with due regard to the principle of transparency.

• Personal data is relevant, limited and proportionate to the purposes for which it is processed.

  Our Company processes the amount of data that is necessary for the purpose of processing. Data is obtained by the method that is most appropriate in terms of data confidentiality and security. In our processing activities, disproportionate interference with the rights, interests and freedoms of data subjects is avoided.

• Personal data is accurate and, where necessary, up to date.

  The Company ensures that data is up to date in all of its processing activities. Incomplete, erroneous or incorrect data is destroyed or corrected as soon as possible. The Company checks the currency of the data at regular intervals.

• Personal data is retained for the period stipulated in the relevant legislation or required for the purpose for which it is processed.

  Upon the disappearance of the purposes of data processing, the data is erased, destroyed or rendered anonymous as soon as possible.

• Personal data is processed in a manner directed at ensuring appropriate security.

  Our Company applies data security as a main principle. It takes the necessary administrative and technical measures by following best practices in this direction.

• The Company demonstrates that it ensures compliance with the other principles of the PDPL and/or the GDPR.

  Our Company observes the principle of accountability in all of its processing activities.

The Company’s Purposes of Processing Personal Data

The purposes of processing the personal data processed by the Company are as follows:

• Carrying Out Employee Candidate / Intern / Student Selection and Placement Processes
• Carrying Out the Application Processes of Employee Candidates
• Carrying Out Employee Satisfaction and Commitment Processes
• Fulfilment of Obligations Arising from the Employment Contract and from the Legislation for Employees
• Carrying Out Fringe Benefits and Interests Processes for Employees
• Carrying Out Audit / Ethics Activities
• Carrying Out Activities in Compliance with the Legislation
• Carrying Out Training Activities
• Carrying Out Finance and Accounting Affairs
• Ensuring the Security of Physical Premises
• Carrying Out Assignment Processes
• Follow-up and Carrying Out of Legal Affairs
• Carrying Out Internal Audit / Investigation / Intelligence Activities
• Carrying Out Communication Activities
• Planning of Human Resources Processes
• Carrying Out / Auditing Business Activities
• Receiving and Assessing Suggestions for the Improvement of Business Processes
• Carrying Out Activities for Ensuring Business Continuity
• Carrying Out Occupational Health / Safety Activities
• Carrying Out Goods / Services Sales Processes
• Carrying Out After-Sales Support Services for Goods / Services
• Carrying Out Goods/Services Procurement Processes
• Carrying Out Goods / Services Production and Operation Processes
• Carrying Out Marketing Processes for Products / Services
• Carrying Out Marketing Analysis Studies
• Carrying Out Customer Relationship Management Processes
• Carrying Out Activities Directed at Customer Satisfaction
• Carrying Out Risk Management Processes
• Organisation and Event Management
• Carrying Out Storage and Archiving Activities
• Carrying Out Contract Processes
• Carrying Out Access Authorisations
• Carrying Out the Wage Policy
• Ensuring the Security of Data Controller Operations
• Follow-up of Requests / Complaints, Carrying Out Communication Processes
• Providing Information to Authorised Persons, Institutions and Organisations

The Company’s Legal Grounds for Processing Personal Data:

When processing personal data, the Company relies on one of the legal processing conditions set out in Article 5 of the PDPL. The conditions for the processing of personal data, that is, the situations of lawfulness, are listed in a limited number in the Law and these conditions cannot be extended. When processing personal data, the Company relies on the following legal grounds:

• The existence of the data subject’s explicit consent,
• It being expressly stipulated in the laws,
• It being necessary to process the personal data belonging to the parties to a contract, provided that it is directly related to the establishment or performance of that contract,
• It being mandatory for the data controller to be able to fulfil its legal obligation,
• It being mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Our Company does not rely on the legal ground of explicit consent where another legal ground exists.

Legal Grounds for the Processing of Special Categories of Personal Data

Special categories of personal data are data such as a person’s religion, race, belief, health and sexual life which, if disclosed, would expose the person to discrimination. Special categories of personal data cannot be processed without the existence of the limited legal grounds listed in Article 6 of the PDPL.

In this context, the Company processes special categories of personal data other than health or sexual life;

• on the basis of the legal grounds of the data subject’s explicit consent. Data relating to health and sexual life, on the other hand;

• the data subject’s explicit consent,
• it processes on the basis of the legal grounds of the existence of the purposes of protection of public health, preventive medicine, medical diagnosis, the carrying out of treatment and care services, and the planning and management of health services and their financing, by persons under the obligation of confidentiality.

Duty to Inform

The Company is obliged to inform data subjects pursuant to the PDPL and to the Communiqué on the Procedures and Principles to Be Followed in Fulfilling the Duty to Inform (Aydınlatma Yükümlülüğünün Yerine Getirilmesinde Uyulacak Usul ve Esaslar Hakkında Tebliğ). If personal data is obtained from the data subject, the Company informs the data subjects at the moment the data is obtained, either itself or through the persons it has authorised. If the personal data is not obtained from the data subject, the duty to inform is fulfilled within a reasonable period; if the data is to be used for the purpose of communicating with the data subject, at the moment of the first communication; and if the data is to be transferred, at the latest at the time the first transfer is to be made.

The Company informs data subjects, as a minimum, about the Company’s legal entity and address information, for what purpose the personal data will be processed, to whom and for what purposes the processed data may be transferred, the method of collecting personal data and the legal ground therefor, and the rights listed in Article 11 of the PDPL.

When the purpose of processing personal data changes, the duty to inform is fulfilled separately for that purpose before the data processing activity.

Data Security

As the data controller in the processing of personal data, we, the Company, are obliged to prevent the unlawful processing of and access to personal data and to ensure its preservation. For this reason, the Company has taken all technical and administrative measures relating to data security, including the additional measures required for the protection of special categories of personal data. The measures taken by our Company in this context are listed below.

Technical Measures

• Yönetim paneline erişim rol bazlıdır; her modül ayrı yetkiyle açılır ve yetkisiz kullanıcıya hiç görünmez.
• Yönetici ve üye şifreleri özetlenerek (hash) saklanır; şifreler hiçbir yerde açık metin olarak tutulmaz.
• Hatalı giriş denemeleri IP ve hesap bazında sayılır; belirli eşiklerde kademeli olarak geçici erişim kilidi uygulanır.
• Form gönderimi, dosya yükleme, giriş, doğrulama kodu ve veri indirme uç noktalarında istek sayısı sınırlandırılmıştır.
• Oturum çerezi şifrelidir ve tarayıcı betiklerinden okunamaz; her formda sahtecilik önleyici (CSRF) belirteç doğrulanır.
• Veritabanı sorguları parametreli çalışır; kullanıcıdan gelen değer hiçbir sorguya doğrudan yerleştirilmez.
• Form kayıtlarında ziyaretçinin IP adresi ham olarak değil tek yönlü özeti alınarak saklanır.
• Üyelere sunulan teknik veri dosyaları web kök dizininin dışında, ayrı bir alanda tutulur ve yalnızca onaylı üyeye kayıt altında iletilir.
• KVKK onayları, onay anında gösterilen metnin tam hâli, dili ve zamanıyla birlikte ayrı bir kayıt tablosunda saklanır.
• İletişim kayıtlarına otomatik imha tarihi atanır; süresi dolan kayıtlar silinir.
• Yönetim panelindeki veri indirme ve şifre belirleme gibi işlemler kayda geçirilir.

Administrative Measures

• Kişisel veri işleme envanteri hazırlanır; işleme faaliyetlerinde değişiklik olduğunda güncellenir ve Veri Sorumluları Sicili’ne (VERBİS) bildirilir.
• Kişisel Verilerin İşlenmesi ve Korunması Politikası ile Saklama ve İmha Politikası hazırlanır, güncel tutulur ve ilgili kişilerin erişimine açık tutulur.
• Aydınlatma yükümlülüğü, kişisel veri ilgili kişiden elde edildiği anda yerine getirilir; veri başka bir kaynaktan elde edilmişse en geç ilk iletişim ya da ilk aktarım anında yerine getirilir.
• Çalışanların kişisel veriye erişim yetkileri görev tanımlarıyla sınırlıdır; yetkiler işe giriş, görev değişikliği ve işten ayrılma durumlarında gözden geçirilir.
• Kişisel veri işleyen çalışanlarla gizlilik taahhüdü imzalanır; taahhüt iş sözleşmesinin ayrılmaz parçasıdır.
• Çalışanlara kişisel verilerin korunması konusunda farkındalık eğitimi verilir ve eğitim düzenli aralıklarla tekrarlanır.
• Şirket adına kişisel veri işleyen tedarikçi ve hizmet sağlayıcılarla, kişisel verilerin korunmasına ilişkin hükümler içeren yazılı sözleşmeler yapılır; bu taraflarda düzenli kontroller yürütülür.
• Kişisel veri ihlalinde izlenecek müdahale adımları belirlenmiştir. İhlal, öğrenilmesinden itibaren en kısa sürede ve en geç 72 saat içinde Kişisel Verileri Koruma Kurulu’na, ilgili kişiye ise en kısa sürede bildirilir.
• Kişisel veri içeren belge ve fiziksel ortamların güvenliği sağlanır; bu ortamlara erişim yetkili personelle sınırlıdır.
• İlgili kişi başvuruları kayda alınır ve en geç 30 gün içinde yanıtlanır.
• Bu Politika’ya aykırı davranışlarda uygulanacak yaptırımlar belirlenir ve disiplin süreci işletilir.
• Alınan teknik ve idari tedbirler ile veri işleme faaliyetleri düzenli aralıklarla denetlenir; tespit edilen eksiklikler giderilir.

Transfer of Personal Data

Domestic Transfer

Our Company transfers personal data to third parties on the basis of the data processing conditions set out in Articles 5 And 6 of the PDPL. The Company takes all necessary security measures in its data transfer activities.

Transfer Abroad

Pursuant to Article 9 of the PDPL, the Company transfers data abroad by satisfying one of the following conditions.

• The existence of the data subject’s explicit consent,
• The country to which the personal data is to be transferred having the status of a “safe country” and providing adequate protection,
• Adequate protection being undertaken in writing by regulating the rights and obligations of the Company and of the receiving party in relation to the data transfer, and the permission of the Board being obtained.

Personal Data Inventory

The Company has created a data inventory, with the details stipulated by the Law, in respect of the personal data processed within the scope of the PDPL. The Company’s data inventory contains the following details:

• The business processes in which the personal data is used,
• The category of the personal data,
• The personal data processed,
• The special categories of personal data processed,
• The purpose and legal ground of the processing activity,
• The domestic recipients of the personal data,
• Whether or not the personal data is transferred abroad,
• The retention periods of the personal data

In the event of a change in the Company’s processing activities, the Personal Data Inventory (Kişisel Veri Envanteri) is updated. The Company notifies the information contained in the Personal Data Inventory, and any updates thereto, to the Data Controllers’ Registry (Veri Sorumluları Kayıt Sicili). The information that the Company will provide to the data subject within the framework of the duty to inform referred to in Article 5 of this Policy is consistent with the information disclosed to the Registry.

Roles and Responsibilities

The roles and responsibilities of our Company relating to the processing of personal data are as follows:

• İnsan Kaynakları The relevant unit is responsible for notifying this Policy to data subjects such as customers, subcontractors and suppliers whose data is processed.
• İnsan Kaynakları The relevant unit is responsible for informing the parties that process data on behalf of the Company, such as employees and suppliers, about this Policy, and, through regular checks, for the application of the Policy by the said data processors.
• Bilgi Teknolojileri The relevant unit is responsible for updating this Policy. The unit makes the necessary improvements with due regard to the needs of the Company’s information technology systems and, where necessary, carries out the process of updating the Policy.
• Genel Müdürlük The relevant unit is authorised to approve the updates relating to this Policy.
• İnsan Kaynakları The relevant unit is responsible for determining and applying the sanctions in the event of violations relating to the application of the Policy.

Erasure, Destruction and Anonymisation of Personal Data

• Pursuant to Article 7 of the PDPL and the provisions of the other relevant legislation, in the event that the grounds for processing personal data cease to exist, the personal data is erased, destroyed or rendered anonymous upon the decision of the Company, its periodic check and/or the request of the data subject.
• The Company shall not retain personal data for longer than necessary in connection with the reason for which the personal data was obtained. Upon the disappearance of the processing grounds, the Company erases, destroys or renders anonymous the personal data in the first periodic destruction operation following the date on which the obligation to erase, destroy or render anonymous the personal data arises.
• The Company has prepared a Retention and Destruction Policy (Saklama ve İmha Politikası) in order to determine the procedures and principles in this direction. The retention period for each category of personal data, and the criteria used for the retention and destruction periods, including the legal obligations under which the Company is obliged to retain the data, are set out in this Retention and Destruction Policy. This Retention and Destruction Policy has been drawn up in accordance with the Personal Data Inventory referred to in Article 8 of this Policy.
• In the erasure, destruction or rendering anonymous of personal data, the Company acts in accordance with the principles set out in part 4/a of this Policy, the technical and administrative measures set out in Article 6 thereof, the Retention and Destruction Policy, the provisions of the relevant legislation and the decisions of the Board.
• Personal data shall be destroyed securely and by the most appropriate method, in line with the provisions of the PDPL, the relevant legislation and the Company’s Retention and Destruction Policy. Upon the request of the data subject, the Company selects the appropriate method by explaining its reasoning.

The Data Subject’s Rights and the Exercise of His/Her Rights

Rights of the Data Subject

Pursuant to Article 11 of the PDPL, data subjects have the following rights in relation to their processed personal data:

• To learn whether or not their personal data is being processed,
• If their personal data has been processed, to request information regarding the nature of this information and to learn to whom it has been disclosed,
• To learn the purpose of the processing of the personal data and whether it is used in accordance with its purpose,
• To know the third parties to whom the personal data is transferred domestically or abroad and to request that the transaction carried out in this respect be notified to third parties,
• In the event that the personal data has been processed incompletely or inaccurately, to request its correction and to request that this be notified to third parties,
• To request the erasure or destruction of the personal data in the event that the grounds requiring its processing cease to exist, notwithstanding that it has been processed in accordance with the provisions of the relevant law,
• To object to the arising of a result to the detriment of the person himself/herself,
• To claim compensation for the damage in the event of suffering damage owing to the unlawful processing of the personal data.

Exercise of Rights

Applications and requests relating to personal data, via Human Resources,

• by sending them, together with your wet signature and a photocopy of your identity document, to the address Çerkeşli OSB Mah. İmes 3 Blv. No:1 Dilovası/Kocaeli, or,
• by signing them with a secure electronic signature or mobile signature and sending them to the e-mail address ik@er-el.com.tr, or,
• by signing them with a secure electronic signature or mobile signature and sending them, by means of registered electronic mail (KEP), to the address er-elmakina@hs01.kep.tr, or,
• by applying in person to Er-El Makina Yedek Parça İml. San. ve Tic. Limited Şirketi with a valid identity document

may be conveyed.

Within the scope of the legal requirements concerning the procedures and principles of application to the data controller, data subjects must include in their application their name, surname, their signature if the application is in writing, their Turkish Republic identity number if they are a citizen of the Republic of Türkiye, their nationality if they are a foreigner, their passport (or identity, if any) number, their place of residence or business address for the purposes of notification, their e-mail address and fax number, if any, for us to take as the basis for notification, and finally the subject of the request. In addition, documents verifying identity, together with information and documents relating to the subject of the request, must be attached to the application.

In order for the process to be conducted in the most effective manner, which right is intended to be exercised in the subject of the request and the details relating to the requested action must be stated clearly and comprehensibly.

The subject of the request must relate to the data subject himself/herself. If the application is made on behalf of another person, the person making the request must rely on an authority specifically documented for the requested action (power of attorney). Applications made without authority shall not be taken into assessment.

Assessment of the Application

• Applications are assessed and, as soon as possible and at the latest as from the date on which the application reaches us,
• a response is provided within 30 days.
• During the assessment process, additional information and documents may be requested if necessary, and in the cases appropriate under the relevant legislation a fee may be requested for the fulfilment of the request.
• The Company takes all necessary administrative and technical measures in order to conclude the applications to be made by the data subject effectively and in accordance with the law and the principle of fairness.

Rejection of the Application

• The application;
  • where the application is not made in accordance with the procedure set out above,
  • where the application contains a request contrary to the legislation in force,
  • where the application is not based on a justified reason or is in the nature of an abuse of right,
  • the processing of the personal data that is the subject of the application for purposes such as research, planning and statistics by rendering it anonymous with official statistics,
  • the processing of personal data made public by the data subject himself/herself.
  • is rejected in the event of the existence of one of the other situations falling within the scope of Article 28 of the PDPL. In the event that the application is rejected, the Company notifies the data subject of the rejection response by explaining its reasoning.

Right to Complain

• In the applications made to the Company, the data subject has the right to complain to the Board where his/her application is rejected, or where he/she finds the response given by the Company insufficient, or where no response is given by the Company within 30 days.

The data subject may exercise the right to complain within 30 days from the date on which he/she learns of the Company’s response and in any event within 60 days from the date of the application.

Publication of the Policy and Entry into Force

This Policy enters into force on 14.08.2026.

The current version of this Policy is published on 14.08.2026.

Updating of the Policy

This Policy is updated for a period of 1 year.

The repealed old copies of this Policy are cancelled with the approval of human resources and retained by human resources for 1 year. Policies whose retention period has expired are destroyed by human resources by drawing up a minute.