1. Identity of the Data Controller

Under the Personal Data Protection Law No. 6698 (“KVKK”), our company, Betumar Endüstriyel Deniz Ürünleri Danışmanlık İthalat Ve İhracat Anonim Şirketi (“BTMavrasya”, “Company”), acts as the data controller. Our company’s details are as follows;

MERSIS Number :

Website Address :

Telephone Number :

Email Address :

Address:

2. What Personal Data Do We Process?

3. Purpose for Which Personal Data Will Be Processed

In accordance with the fundamental principles stipulated by law and within the scope of the personal data processing conditions specified in Articles 5 and 6, by us:

• Security and our company’s legitimate interests
• Execution of contractual processes
• Creation of visitor records
• Conducting management activities
• Management of requests and complaints
• Providing information to authorised institutions and organisations upon request
• Monitoring and execution of legal matters

Your personal data is processed for these purposes.

4. To whom and for what purposes your processed personal data may be transferred

The personal data we process may be transferred to the following parties within the scope of the purposes listed above and in accordance with the conditions set out in Articles 8 and 9 of the Personal Data Protection Law:

• Group companies, subsidiaries, and affiliates
• To legally authorised and relevant public institutions and organisations, administrative authorities, in accordance with the requests of the relevant public institutions and organisations and as required by legal regulations,
• Companies providing visitor registration and building security services,
• Companies providing payment, technology, and archiving services to the Company
• To the Company’s audit firms and financial advisors.

5. Method and Legal Basis for Collecting Personal Data

We collect your personal data through face-to-face or other communication channels, visitor registration systems, camera systems, and verbal, written, or electronic channels, including but not limited to those listed here, through automated and non-automated means.

The legal grounds for processing your personal data are as follows:

• The necessity of data processing for the establishment, exercise, or defence of a legal claim
• The necessity of data processing for the legitimate interests of the data controller, provided that this does not harm the fundamental rights and freedoms of the data subject
• It is necessary for the data controller to fulfil its legal obligations
• The processing of personal data belonging to the parties to a contract is necessary for the establishment or performance of the contract

6. Rights of Data Subjects as Specified in Article 11

Natural persons whose personal data is processed have the following rights under Article 11 of the KVKK:

• To learn whether their personal data is being processed,
• To request information regarding the processing of their personal data,
• To learn the purpose of the processing of personal data and whether they are being used in accordance with that purpose,
• To know the third parties to whom their personal data has been transferred within or outside the country,
• To request the correction of their personal data if it has been processed incompletely or incorrectly, and to request that this action be communicated to third parties to whom their personal data has been transferred,
• Despite having been processed in accordance with the provisions of the KVKK and other relevant laws, the right to request the deletion or destruction of personal data when the reasons for processing no longer exist, and to request that this action be communicated to third parties to whom the personal data has been transferred,
• To object to the analysis of processed data exclusively by automated systems resulting in a decision against the individual,
• To request compensation for any damage suffered as a result of the unlawful processing of personal data.

The data subject may submit requests regarding these rights to our Company’s address above by sending a letter of notification via a notary public, by applying in person to our Company headquarters upon presentation of identification, in writing, or by using the Data Controller Application Form available on our website. In this case, the data subject’s requests will be evaluated and decided upon free of charge as soon as possible and ultimately within a maximum of thirty (30) days. If the evaluation and decision-making process requires an additional cost, the fee determined by the Personal Data Protection Board will be applied.