As Trakya Döküm San. ve Tic. A.S. (hereinaHer “TRAKYA DÖKÜM”), collected personal data has been kept private until today due to the sensitivity of the works we have been dealing with and it has never been shared with third parties out of its purpose. Protection of personal data is the essential policy of our company. Before any legal regulation, our company athached great importance to the privacy of personal data, and adopted that as a working principle. As TRAKYA DÖKÜM, we undertake to comply with all the liabilities stipulated by the Law on Personal Data Protection.

This Policy issued by our Company has been prepared in accordance with the Law on the Protection of Personal Data (LPPD), No. 6698. The law has entered into force with all its provisions as of today.

The data obtained from you with your consent or in accordance with other legal compliance conditions listed in the Law, will be used in order to increase the quality of the services we offer and to improve our quality policy. Also, some of the data that we have, are depersonalized and anonymized. These data are the ones that are used for statistical purposes and are not subject to the implementation of the Law and our Policy.

TRAKYA DÖKÜM's Policy on Protection of Personal Data and Privacy aims to protect the data obtained automatically from our customers, prospective customers, employees, and customers and employees of companies working in partnership with us, or other persons, and includes the relevant regulations.

Our company reserves the right to amend our policy and our Regulation / Directive provided that the amendment be in compliance with the Law and for beXer protection of personal data.

a) Compliance with the law and honesty rules: TRAKYA DÖKÜM questions the source of the data that it collects or that comes from other companies and aXaches importance to obtaining them in accordance with the law and honesty.

b) Being true and up-to-date when necessary: TRAKYA DÖKÜM aXaches importance to the fact that all data within the organization are correct, that they do not contain false information, and finally, in case there is a change in personal data, that it is updated when it is transmiXed to itself.

c) Processing for specific, clear and legimate purposes: TRAKYA DÖKÜM processes data in a limited way only for the purposes which it received approval of individuals and during the service it provides. Other than business purpose, it does not process the data, use, or have it used.

d) Being connected to, limited to and in proportion with the purpose of processing: TRAKYA DÖKÜM uses the data only for the purposes for which it is processed and to the extent required by the service.

Being stored for the period stipulated in the relevant legislation or required for the purpose for which it is processed:TRAKYA DÖKÜM stores the data arising from the contracts within itself as much as the durations stipulated in the Law for conflicts, the requirements of the commercial and tax law. However, when these purposes are disappeared, it erases or anonymizes the data. It deletes or destroys them according to the Personal Data Deletion Directive.

It is crucial to state that whether TRAKYA DÖKÜM collects or process the data either based on consent or in accordance with the law, these principles that we have listed above, are still in force.

According to article 11 of LPPD, you have the following rights. In order to facilitate these rights, a separate application form has also been prepared by TRAKYA DÖKÜM and presented to you on our website.

The persons whose personal data are processed by TRAKYA DÖKÜM, have following rights by contacting the relevant person of our company who is announced at our web page;

a) To learn whether your personal data is processed or not,

b) To request the relevant information if his personal data has been processed;

c) To learn the purpose of the data processing and whether it is used for intended purposes or not,

d) To know the third parties within the country or abroad to whom personal data has been transferred

e) To request correction of personal data in case that it is processed incomplete or incorrect,

f) To request the deletion or destruction of personal data within the framework of the conditions stipulated in the law,

g) To request notification of the operations carried out in compliance with subparagraphs (e) and (f), to third parties to whom his personal data has been transferred,

h) To object to the occurrence of a result against the person himself by analyzing the processed data exclusively through automated systems,

i) To request the compensation of the damage in case of being exposed to damage due to unlawful processing of personal data.

As TRAKYA DÖKÜM, we respect these rights.

According to our principle named as the principle of maximum saving or parsimony, the data received by TRAKYA DÖKÜM is processed into the system only up to the required extent. Therefore, the issue that which data we will collect, is determined according to the purpose. Non-required data is not collected. Other data transferred to our company are transmiXed to company's information systems likewise. Redundant information is not stored at the system but it is either erased or anonymized. These data may be used for statistical purposes.

In case of expiration of the legally required periods, completion of judicial processes or when other requirements are eliminated, these data are deleted, destroyed or anonymized by our company automatically or upon the request of the relevant person.

In principle, the data within TRAKYA DÖKÜM is processed upon the declaration of the relevant persons and compliant with the way they declared. Neither TRAKYA DÖKÜM is liable to investigate the accuracy of the data declared by customers or by persons gejng in contact with TRAKYA DÖKÜM, nor is it done due to the law and our working principles. The declared data is considered as accurate. The principle of accuracy and up-to-datedness of personal data has been adopted also by TRAKYA DÖKÜM. Our company updates the personal data that it process, upon the official documents it receives or upon the request of the relevant person. It takes necessary measures for that.

Personal data are private and TRAKYA DÖKÜM abides by this privacy. Personal data can only be accessed by authorized persons within the company. All necessary technical and administrative measures are taken by TRAKYA DÖKÜM in order to protect the personal data collected, to prevent unauthorized persons from obtaining them, and to prevent customers from being victimized. Within this framework, it is ensured that the soHware complies with the standards, and the third parties are selected carefully, and the data protection policy within the company is being obeyed within the company. Data protection is also requested from companies with whom we share personal data in accordance with the law.

The collection and processing of personal data of TRAKYA DÖKÜM will be carried out for the purposes specified in the clarification text.

a. Collec-on And Processing Of Data For Contractual Rela-onship

If a contractual relationship is established with our customers and prospective customers, collected personal data may be used without obtaining the customer's consent. However, this utilization realizes in line with the purpose of the contract. The data is used for beXer performance of the contract and to the extent of the service requirements, and it is updated by contacting customers when necessary.

b. Data of Business and Solu-on Partners

TRAKYA DÖKÜM adopts the principle of acting in accordance with the law while sharing data both with its business partners and its solution partners. Data is shared with business and solution partners only receiving a commitment to data privacy and only as much as the service requires, and these parties are requested to take precautions to ensure data security.

In accordance with the Law on the Regulation of E-Commerce and the Regulation on Commercial Communication and Commercial Electronic Messages, electronic messages for advertising purposes can only be sent to those who gave approval beforehand. Explicit existence of the consent of the person to whom the advertisement will be sent is necessary.

TRAKYA DÖKÜM also abides by the details of the "approval" determined in accordance with the same legislation. The approval to be obtained should cover all commercial electronic messages sent to the electronic contact addresses of the buyers in order to promote and market our company's goods and services, to promote its enterprise or to increase its recognition or with contents such as celebrations and wishes. This approval can be obtained in writing in a physical form or through any means of electronic communication. The important thing is the existence of positive declaration of will about that the buyer agrees to accept the receival of commercial electronic messages and his name, surname and electronic contact address.

Personal data may be processed without further consent due to the processing is stipulated clearly in the relevant legislation or in order to fulfill a legal obligation determined by the legislation. The type and scope of data processing must be required for legally permiXed data processing activity and it must comply with the relevant legal provisions.

Personal data can be processed in accordance with the service that the company offers, and in line with legitimate purposes of the company. However, the data cannot be used for illegal services in any way.

According to the Law, Individuals data related to their race, ethnic origin, political thought, philosophical belief, religious, sect or other beliefs, costume and ajre, association, foundation or union membership, health, sexual life, criminal conviction and safety measures and biometric and genetic data are sensitive personal data.

TRAKYA DÖKÜM takes all adequate measures separately determined by the Board in the processing of sensitive personal data.

TRAKYA DÖKÜM can only process sensitive personal data with the approval of the individuals only for the purpose for which they are collected in order to provide beXer services.

TRAKYA DÖKÜM acts in accordance with the Law on the data processed through automated systems. Information obtained from these data cannot be used against the person himself without his/her explicit consent. However, TRAKYA DÖKÜM can take decisions about the people whom it will do operation, by using the data in its system.

In the event that personal data is collected, processed and used in the websites of TRAKYA DÖKÜM and other systems or applications, the relevant persons are informed with a privacy statement and, if necessary, about cookies.

Persons are informed about our applications on web pages. Personal data shall be processed in accordance with the law.

a. Processing Data for Business Relationship

The personal data of our employees can be processed without approval as much as they are necessary for business relations and health insurance. However, TRAKYA DÖKÜM ensures the privacy and protection of data belonging to its employees.

b. Processing Due To Legal Obligations

TRAKYA DÖKÜM can process the personal data of its employees without obtaining a further consent due to the processing is clearly stated in the relevant legislation or in order to fulfill a legal obligation specified in the legislation. This issue is limited to the obligations arising from the law.

c. Processing In Favor Of The Employees

TRAKYA DÖKÜM can process personal data without approval for transactions in the interests of company employees, such as private health insurance. TRAKYA DÖKÜM can also process the data belonging to the employees for disputes arising from business relationships.

d. Processing of Sensitive Personal Data

According to the Law, Individuals data related to their race, ethnic origin, political thought, philosophical belief, religious, sect or other beliefs, costume and ajre, association, foundation or union membership, health, sexual life, criminal conviction and safety measures and biometric and genetic data are sensitive personal data.

TRAKYA DÖKÜM takes adequate measures determined by the Board in addition to the approval of the relevant person in the processing of sensitive personal data. Sensitive Personal data can be processed without the consent of the person only in relation to and limited to the cases permiXed by the Law

e. Data Processed by Automated Systems

Employees' data processed in relation to automated systems can be used in intra-unit promotions and performance evaluations. Our employees have the right to object to the result emerging against them and they carry out this by following the internal procedures. Employees' objections are also evaluated within the company.

f. Telecommunica-ons and Internet

The computer, telephone, e-mail, and other applications which are allocated to employees within the Company have been allocated to the employee only for business purposes. Employee cannot use any of these means allocated by the company for his/her specific purposes and communication. The company can check and audit all data on these means. The employee undertakes not to keep any data or information other than the business on the computer, the phones or other means allocated to him/her from the moment he/she starts the job.

Personal data can be shared with the controlling shareholder, as well as business and solution partners, in order to provide the service by TRAKYA DÖKÜM.

TRAKYA DÖKÜM will be able to transfer personal data to suppliers of TRAKYA DÖKÜM to a limited extent in order to provide the services which are required by our company to fulfill the commercial activities of our company and which are outsourced from the supplier.

TRAKYA DÖKÜM is entitled to transfer personal data in accordance with the other conditions in the Law and in accordance with the approval of the person within the country and abroad within the conditions determined by the Board.

TRAKYA DÖKÜM recognizes that within the scope of the Law, the relevant person has the right that his/her consent be obtained before the data is processed, and that he/she has the right to determine the fate of the data after the data is processed.

By applying to our contact personal announced by TRAKYA DÖKÜM on our website, the relevant person has right;

a) To learn whether your personal data is processed or not,

b) To request the relevant information if his personal data has been processed;

c) To learn the purpose of the data processing and whether this data is used for intended purposes or not,

d) To know the third parties within the country or abroad to whom personal data has been transferred,

e) To request correction of personal data in case that it is processed incomplete or incorrect,

f) To request his personal data be erased or destroyed under the conditions stipulated in article 7 of the Law,

g) To request notification of the operations carried out in compliance with subparagraphs (e) and (f), to third parties to whom his personal data has been transferred,

h) To object to the occurrence of a result against the person himself by analyzing the processed data exclusively through automated systems,

i) To request the compensation of the damage in case of being exposed to damage due to unlawful processing of personal data.

Nonetheless,

Individuals do not have a right regarding anonymized data within the company. TRAKYA DÖKÜM can share personal data with the relevant institutions and organizations for the purpose of related with exercising a judicial duty or the statutory powers of the state authority, in accordance with the business and contractual relationship.

Personal data owners will be able to send their requests regarding the above-mentioned rights to the company address by fully filling out the application form, which you can obtain from the official website of the Company and by signing with a wet signature, through a registered leXer with return receipt and copies of their identity cards (only the front page for the identity card). Your applications shall be concluded as soon as possible according to the nature of your application, or within 30 days at the latest aHer it reaches our company. You must submit your applications by registered leXer with return receipt. In addition, the part of your application only related with yourself will be answered, and an application made about your spouse, relative or friend will not be accepted.

TRAKYA DÖKÜM can request other relevant information and documents from the applicants.

Either employees or other persons, their data at TRAKYA DÖKÜM is private. No one can use these data, or copy, reproduce, transfer to others, or use for any purposes other than business purposes, without the contract or compliance with laws.

All necessary technical and administrative measures are taken in order to protect the personal data collected by TRAKYA DÖKÜM, and to prevent unauthorized persons from obtaining them, and to prevent our customers and prospects from suffering. In this context, it is ensured that the soHware complies with the standards, and the third parties are selected carefully, and the data protection policy within the company is being observed within the company. Safety measures are constantly being renewed and improved.

TRAKYA DÖKÜM has the necessary internal and external inspections done for the protection of personal data.

When TRAKYA DÖKÜM is notified of any breach of personal data, it takes immediate action to remedy the aforesaid violation. It minimizes the damage of the relevant person and compensates the damage. When personal data is accessed from outside by unauthorized persons, it immediately notifies the Personal Data Protection Board.

You can apply related with the notification of violations at the address http://www.trakyadokum.com.tr/ in line with the stated methods. For LPPD Application and Information Request Form

The purpose of this Policy for the Protection and Processing of Special Qualified Personal Data is to fulfill the legal obligations arising from the decision on Adequate Precautions to Be Taken by Data Controllers in Processing of sensitive personal data of the Personal Data Protection Board dated 31/01/2018 and numbered 2018/10 and to show technical and administrative measures taken in the processing of sensitive personal data.

ABBREVIATION	DESCRIPTION
Explicit Consent	Consent about a specific subject based on information and expressed in free will.
Destruction	Deletion, destruction or anonymization of personal data.
The law	Law on Protection of Personal Data No. 6698
Personal Data	Any information related to real person who is identified or identifiable.
Anonymization of Personal Data	Making personal data not to be associated with any identified or identifiable real person in any way, even when paired with other data.
The processing of personal data	All kinds of processes performed on personal data including obtaining, recording, storing, keeping, changing, re-arranging, disclosure, transmission, acquisition, making available, classification or prevention of use in whole or in part, automatically or in nonautomatic ways, being part of any data recording system.
Deletion of Personal Data	The process of making personal data inaccessible and unavailable in any way for relevant users.
Destruction of Personal Data	The process of rendering personal data inaccessible, unrecoverable and unusable by anyone in no way.
Board	Personal Data Protection Board
Policy	Policy of Protection and Processing of sensitive personal data
Company	Trakya Döküm San. ve Tic. A.S.
Data subject	Real person whose personal data is processed.
Data Controller	Real or legal person responsible for identifying the purposes and means of personal data processing, and installing and managing data recording system.

Personal data relating to the race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other belief, appearance, membership to associations, foundations or trade-unions, data concerning health, sexual life, criminal convictions and security measures, and the biometric and genetic data are deemed to be sensitive personal data.

The Company complies with provisions of the Law and other legislation on the processing of sensitive personal data. Accordingly, sensitive personal data are processed in compliance with the following principles:

• Complying with the law and rules of good faith
• Being accurate and up-to-date when necessary
• Being connected, limited and measured with the purpose of processing
• Being processed for specific, clear and legitimate purposes
• Retaining up to the period stipulated in the legislation or required for the purpose for which they are processed

Sensitive personal data other than health and sexual life are processed by the Company in cases where the explicit consent of the data subject is obtained or in cases where stipulated by law.

Data on health and sexual life are processed in cases where the explicit consent of the data subject is obtained or for the purpose of protecting public health, carrying out medical diagnosis, treatment and care services, preventive medicine, planning, management and financing of health services.

It is also complied with the provisions of the Regulation on the Processing of Personal Health Data and Ensuring Privacy, which entered into force after being published in the Official Gazette dated October 20, 2016 and numbered 29863, in the processing of health data.

The company takes all kinds of measures to process sensitive personal data in compliance with the Law and the relevant legislation and to ensure the security of sensitive personal data. The measures taken within this scope are listed below:

• The company provides regular training on the protection and processing of sensitive personal data for employees who are involved in the processes of processing special personal data.
• The company concludes confidentiality agreements with its employees in order that the data security is ensured.
• Users who have access to data, the scope and duration of their authorization are clearly defined, and periodic authorization controls are performed.
• Personal data access authorization of the employees whose position change or who leave their job, is immediately abolished. The company immediately takes back the inventories that are allocated to employees within this scope

a. Technical Measures Taken In Terms of Sensitive Personal Data Stored and/or Accessed in Electronic Environment

• Sensitive personal data are stored by using cryptographic methods.
• Cryptographic keys are kept in secure and different environments.
• Transaction records of all actions performed on sensitive personal data are securely logged.
• Security updates of the environments with sensitive personal data are constantly monitored, necessary security tests are regularly performed, and test results are recorded.
• User authorizations belonging to the software where it is accessed to the sensitive personal data are made, security tests of these softwares are regularly performed, and test results are recorded.
• In cases where sensitive personal data is accessed remotely, at least a two-step verification system is used

b. Technical Measures Taken In Terms of Sensitive Personal Data Stored and / or Accessed in Physical Environment

• Adequate security measures are taken depending on the nature of the environment where sensitive personal data is available.
• Physical security of these environments is provided and unauthorized entries and exits are prevented

The Company transfers sensitive personal data within the framework of the data processing conditions set forth in Articles 8 and 9 of the Law. In order to ensure data security, the following rules are applied by the Company in the data transfer and periodic audits are carried out within this scope.

Transfer Through E-Mail

In cases where sensitive personal data are transferred through e-mail, transfer is made cryptically by using a corporate e-mail address or a Registered Electronic Mail (REP) account.

Transfer Through Media Such As Removable Memory, CD, DVD

In cases where sensitive personal data are transferred through media such as removable memory, CD, DVD, encryption is performed with cryptographic methods, and the cryptographic key is kept in a different environment.

Transfer Between Servers in Different Physical Environments

In the transfer of sensitive personal data between servers in different physical environments, data transfer is performed by setting up a VPN between servers or using the sFTP method

Transferring through written paper

If it is necessary to transfer sensitive personal data through written paper, necessary precautions are taken against risks such as theft, loss or being seen by unauthorized persons and the document is sent in the "classified documents" format.

Sensitive personal data are stored by the Company in compliance with the Law and other legislation and the decision of Adequate Precautions to be Taken by Data Controllers in the Processing of sensitive personal data published by the Board in the following cases:

• The fact that the explicit consent of the data subject has been obtained
• The fact that storage of sensitive personal data other than health and sexual life has been stipulated by laws
• The fact that the data related to health and sexual life is stored for the purpose of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and managing and financing of health services

Sensitive personal data stored by the Company in compliance with the Law and other legislation are deleted, destroyed, or anonymized, either ex officio or upon the request of the data subject, in the event that the following reasons appear:

• The fact that explicit consent has been withdrawn in cases where the special quality personal data storage activity is based on the explicit consent of the data subject
• The fact that the storage purpose of sensitive personal data has been realized, has become impossible, or has disappeared in any other way
• The fact that the provisions of the legislation which constitute the basis for the storage of sensitive personal data are changed, or abolished
• The fact that all the processing conditions set forth in article 6 of the Law have disappeared
• The fact that the request of the data subject for the destruction of sensitive personal data duly transmitted to the Company is justified by the Company, and that it is concluded positively
• In the events that the company rejects the application made by the data subject on the request for the destruction of sensitive personal data, that the given answer is found insufficient, or that the company does not respond within the period stipulated in the Law; the fact that complaint is made to the Board and this request is approved by the Board.

Other issues regarding the storage and disposal of sensitive personal data are regulated in the Personal Data Storage and Destruction Policy of the Company.

The amendments made to this Policy are shown in the table below.

Policy Update Date	Amendments
-	-
-	-

As TRAKYA DÖKÜM, we have adopted as a principle:

• To operate in accordance with the law and good faith,
• To strive to provide correct and up-to-date
• To be processed for specific, clear and legi>mate purposes,
• To be connected, limited and measured for the purpose of processing,
• To be kept for the period s>pulated in the relevant legisla>on or required for the purpose.

Article 10 of the Law on the Protection of Personal Data (“Law” or “LPPD”) numbered 6698 asks that the persons whose data is processed, is enlightened while obtaining their consent. Title of the article is "Obligation of Data Controller to Inform". According to the provisions of Law, TRAKYA DÖKÜM is the "data controller". Within this framework, the obligation to inform has brought the obligation to inform "data subjects" about their rights enumerated in article 11 of the LAW such as the identity of the data controller, personal data processing purposes, persons to whom personal data are transferred and transfer purposes, legal reasons for collecting personal data, to whom can be transferred and methods, update, deletion or anonymization by the personal data subject to the data controller.

As our valued customers and visitors who are data subject, you are informed and enlightened as per the provisions of Article 10 of the Law with the Clarification Text briefly written below to all our visitors by TRAKYA DÖKÜM.

The data controller is defined as "Real or legal persons who determine the purposes and means of processing personal data and are responsible for the establishment and management of the data recording system" in subparagraph (ı) of paragraph 1 of Article 3 of the Law. The data controller is TRAKYA DÖKÜM within this framework, whose website you visited.

Trakya Döküm San. ve Tic. A.S.
Buyukdere Cad. Soyak Binası No: 38 Mecidiyekoy 34387 Istanbul
Telephone: +90 212 315 52 40
info@trakyadokum.com.tr

Data processor (article 3 of the Law): Refers to the natural or legal person who processes personal data on behalf of the data controller based on the authority given by him.

Your data is kept and processed in TRAKYA DÖKÜM only in cases where your consent or one of the cases of compliance with the law is existing.

• The fact that it is clearly stipulated in laws
• Necessity - actual impossibility - life-threatening
• Operations directly related to the establishment or performance of a contract
• The fact that it is obligatory for the data controller in order to fulfill its legal obligation
• The fact that it has been made public by the relevant person himself
• The fact that data processing is mandatory for the establishment, use or protection of a right
• The fact that data processing is mandatory for the legitimate interests of the data controller provided that it does not harm the fundamental rights and freedoms of the relevant person

Your personal data is processed for the purpose of;

• Making you better use of products and services offered by TRAKYA DÖKÜM;
• Presenta>on and sugges>on of products / services offered by TRAKYA DÖKÜM by customizing them according to the needs, likes and usage habits of our customers;
• Ensuring data security,
• Determining the strategies of the company, in line with the principles in Law.

Your personal data that is collected and processed in compliance with the KVKK in our company, will be able to transfer to the solution partners of TRAKYA DÖKÜM and the companies which are in the position of its performance assistant, only in order to carry out the work and in accompaniment of confidentiality agreements.

Your personal data is collected by TRAKYA DÖKÜM through different means and for legal reasons in order to carry out our commercial activities. Your personal data may be processed and transferred within the scope of the personal data processing conditions and purposes which are specified in Articles 5 and 6 of the Law, and for the purposes specified in hereby Clarification Text.

You have the following rights as per Article 11 of the Law. An application form has also been prepared by TRAKYA DÖKÜM in order to facilitate use of these rights.

You have rights;

• To learn whether your personal data is processed or not,
• To request the relevant information if personal data has been processed;
• To learn the purpose of the data processing and whether it is used for intended purposes or not,
• To know the third parties within the country or abroad to whom personal data has been transferred,
• To request correction of personal data in case that it has been processed incomplete or incorrect,
• To request deletion or destruction of personal data under the conditions stipulated in the Article 7.
• To request notification of the operations carried out in compliance with subparagraphs (e) and (f) to third parties to whom personal data has been transferred,
• To object to the occurrence of a result against the person himself by analyzing the processed data exclusively through automated systems,
• To request the compensation of the damage in case of being exposed to damage due to unlawful processing of personal data,

by applying to our contact person announced by TRAKYA DÖKÜM on our website.

We process your data in order to inform you about our services and, when necessary, to enlighten you and to provide better products and services. Within this framework, your information in TRAKYA DÖKÜM is used with your will and approval in the line with the purpose of processing.

All necessary technical and administrative measures are taken by TRAKYA DÖKÜM in order to protect the personal data collected, to prevent unauthorized persons from obtaining them, and to prevent customers from being victimized. Within this framework, it is ensured that the sorware complies with the standards, and the third parties are selected carefully, and the data protection policy within the company is being obeyed within the company.

Please contact with the Data Supervisor of TRAKYA DÖKÜM whose address and contact details are shown on our website if you have any doubts about your personal data. An applicattion form has also been prepared for you to make your applicattions easier below. Your applications will be responded as soon as possible depending on the nature of the requests, or within 30 days at the latest arer it reaches our company. You must submit your applications by registered letter with return receipt. In addition, only the relevant part of your application will be responded, and an application made about your spouse, relative or friend will not be accepted.

You can use the document at link for your applications.