Data Protection Notice

ALP TEKSTİL İNŞAAT VE TURİZM SANAYİ TİCARET LİMİTED ŞİRKETİ
Information Notice on the Protection of Personal Data

Identity of the Data Controller

This Information Notice has been prepared by Alp Tekstil Ins. ve Turizm San. Tic. Ltd. Sti. (“Alp Tekstil” or the “Company”), acting as the data controller, in accordance with Article 10 of Law No. 6698 on the Protection of Personal Data (“KVKK”), titled “Obligation of the Data Controller to Inform”, and the Communique on the Procedures and Principles to be Followed in Fulfilment of the Obligation to Inform.

Through this Information Notice, prepared in our capacity as data controller, we would like to inform you about the purposes for which your personal data may be processed, to whom and for what purposes your processed personal data may be transferred, the method and legal basis for collecting your personal data, and your other rights listed under Article 11 of the KVKK.

As the data controller, we process, record, transfer, share, and store your personal data as explained below and within the limits of applicable legislation.

Our Company reserves the right to update this Information Notice on the Protection of Personal Data at any time in line with amendments that may be made to applicable legislation.

Alp Tekstil Ins. ve Turizm San. Tic. Ltd. Sti.

Address: Mehmet Nesih Ozmen Mah. Simsir Sok. Masalaci Han No: 11 Inner Door No: 1 - 34173 Merter Gungoren/Istanbul

Telephone: +90 212 652 9393

Email: alptextil@hotmail.com

Registered electronic notification address: alptekstil@hs01.kep.tr

Purpose of the Personal Data Protection and Processing Policy

Our Company, which operates in the fields detailed in its Articles of Association, collects and processes your personal data verbally, in writing, or electronically due to the regulations of relevant institutions and the agreements we have entered into.

Your personal data will be used in order to provide services related to our Company’s fields of activity, improve the quality of these services, carry out our Company’s sales, marketing, and other activities, and comply with obligations relating to information storage, reporting, and notification.

Your personal data will not be used for purposes other than those stated above without your explicit consent, and will not be shared with or transferred to third parties except where required by legal obligations and official institutions or organizations.

Our Company may share your personal data only on the basis of customers’ explicit consent or in other cases permitted under the legislation to which we are subject, particularly Article 5/2 of the KVKK. This may be done for the purpose of providing added-value services, opportunities, and benefits to our customers and improving service quality.

In this context, your personal data may be shared with our domestic or international affiliates, directly or indirectly affiliated companies, joint ventures, public institutions or organizations legally authorized to request such data, and, provided that adequate measures are taken, domestic or international institutions, suppliers, authorized sellers/dealers, and business partners with whom we cooperate as part of our activities.

In addition to the purposes mentioned above, your personal data may be processed in proportion to the purposes listed below, within the personal data processing conditions set out in Articles 4, 5, and 6 of the Law:

Planning and execution of emergency management processes
Planning, auditing, and execution of information security processes
Carrying out employee candidate/intern/student selection and placement processes
Carrying out application processes for employee candidates
Fulfilment of obligations arising from employment contracts and legislation for employees
Carrying out fringe benefit and benefits processes for employees
Carrying out employee satisfaction and loyalty processes
Carrying out audit/ethics activities Carrying out activities in compliance with legislation
Carrying out finance and accounting affairs Ensuring physical location monitoring and security
Carrying out assignment processes Monitoring and carrying out legal affairs
Carrying out communication activities Planning human resources processes
Carrying out occupational health and safety activities
Carrying out and auditing business activities
Planning and/or execution of activities to ensure business continuity Marketing/analysis activities**
Planning and execution of relevant processes to obtain maximum benefit from the products or services offered by the Company Managing supply chain management processes
Carrying out purchasing processes for products and services
Carrying out after-sales support services for products and services Planning and execution of market research activities for the sales and marketing of products and services
Planning and execution of sales processes for products and/or services
Carrying out production and operation processes for products and services
Creating and/or monitoring allocation and/or evaluation processes for products and/or services
Execution of marketing, promotion, modification, and maintenance services related to products and/or services**
Ensuring that data is accurate and up to date
Providing information to authorized persons, institutions, and organizations
Carrying out management activities
Creating and tracking visitor records** ile işaretli amaçlar, müşterilerin açık rızaları kapsamında yerine getirilecek olan işleme amaçlarını ifade eder.

The purposes marked with ** refer to processing purposes carried out within the scope of customers’ explicit consent.

Methods of Collecting Personal Data and Legal Basis

Alp Tekstil Ins. ve Turizm San. Tic. Ltd. Sti. collects personal data directly from customers through electronic and digital channels such as the Company's website, mobile applications, social media accounts, and email addresses. Personal data may also be obtained through the services used by customers, prospective customers, our business and solution partners, fax communications, notifications from administrative and judicial authorities, and other written, electronic, or verbal communication channels.

Personal data is collected and processed in accordance with Articles 5 and 6 of the Law based on the following legal grounds:

Your explicit consent where required (for example, contacting you regarding marketing, promotional activities, or changes relating to products and/or services).
Where the processing of personal data is expressly required by law (for example, information contained on invoices for products and/or services).
Where processing is necessary for the establishment or performance of a contract with you.
Where processing is necessary to fulfil our legal obligations.
Where you voluntarily provide your personal data to us (for example, when submitting requests or complaints).
Where processing is necessary for our legitimate interests, provided it does not adversely affect your fundamental rights and freedoms (for example, retaining personal data for statutory limitation periods in the event of potential legal disputes).

Processing of Special Categories of Personal Data

Under the Personal Data Protection Law, data relating to an individual's race, ethnic origin, political opinions, philosophical beliefs, religion, denomination or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions, security measures, biometric data, and genetic data are classified as special categories of personal data.

When processing such data, our Company implements all security measures required by the Personal Data Protection Board.

Special categories of personal data will only be processed with the explicit consent of the relevant individual and solely for the purposes for which they have been collected.

Transfer of Processed Personal Data

The personal data collected by Alp Tekstil Ins. ve Turizm San. Tic. Ltd. Sti. may be transferred and processed domestically and/or internationally, only to the extent necessary for the purposes specified in Section II of this Information Notice.

Your personal data may be shared with:

Our business and solution partners;
Company officers and authorized personnel;
Suppliers;
Public authorities legally authorized to receive such information;
Private institutions, organizations, and third parties,

in accordance with Articles 8 and 9 of the Personal Data Protection Law.

Rights of the Data Subject under Article 11 of the Personal Data Protection Law

Under the Personal Data Protection Law, you have the right to:

Learn whether your personal data is being processed.
Request information regarding the processing of your personal data.
Learn the purpose of processing and whether your data is being used in accordance with that purpose.
Know the third parties to whom your personal data has been transferred, either domestically or internationally.
Request correction of incomplete or inaccurate personal data.
Request the deletion or destruction of your personal data under the conditions set out in Article 7 of the Law.
Request that any corrections, deletions, or destruction of personal data be notified to third parties to whom your data has been transferred.
Object to decisions made solely by automated systems that produce legal consequences affecting you.
Request compensation if you suffer damage due to unlawful processing of your personal data.

Retention Period of Personal Data

Your personal data will be processed only for as long as necessary to fulfil the purposes stated in this Information Notice.

When the purpose requiring the processing of your personal data no longer exists, or when the statutory retention periods required by applicable legislation expire, your personal data will be deleted, destroyed, or anonymized in accordance with Article 7 of the Personal Data Protection Law.

Circumstances in Which Personal Data May Be Processed Without Explicit Consent

Pursuant to Article 5 of the Personal Data Protection Law, our Company may process your personal data without your explicit consent in the following circumstances:

Where expressly permitted by law.
Where processing is necessary to protect the life or physical integrity of yourself or another person and you are unable to provide consent.
Where processing is necessary for the establishment or performance of a contract between you and our Company or its affiliated entities.
Where processing is necessary to fulfil our legal obligations.
Where your personal data has been made public by you.
Where processing is necessary for the establishment, exercise, or protection of a legal right.
Where processing is necessary for our legitimate interests, provided that it does not infringe upon your fundamental rights and freedoms.

How to Exercise Your Rights Under the Personal Data Protection Law

Pursuant to Article 13 of the Personal Data Protection Law, you may submit your requests regarding the rights listed above in writing or through any other method designated by the Personal Data Protection Board.

Written applications may be submitted by completing the Application Form for Data Subjects and using one of the following methods:

Personal delivery by the applicant.
Through a public notary.
By sending an application signed with a secure electronic signature as defined under Law No. 5070 on Electronic Signatures from the applicant's registered email address to our registered electronic mail (KEP) address (alptekstil@hs01.kep.tr) or to alptextil@hotmail.com.

For matters relating to your personal data, only the following email addresses should be used:

alptekstil@hs01.kep.tr
alptextil@hotmail.com

Requests submitted through any other communication channels will not be evaluated.

Rights relating to personal data may only be exercised by the individual to whom the data belongs. Requests relating to another person's personal data will not be processed. Applications submitted without official identification documents confirming the applicant's identity will not be considered.

Please note that even if your request for deletion of personal data is fulfilled, we may remain legally obliged to disclose certain information to competent public authorities where required by law.

Upon receipt of your request using one of the methods described above, the Company will respond as soon as possible and no later than thirty (30) days, free of charge. However, if responding to the request incurs additional costs, a fee may be charged in accordance with the tariff determined by the Personal Data Protection Board.

VAGANZA