Privacy and Data Policy | Lider Construction

DATA POLICY

LİDER CONSTRUCTION

LİDER PAŞAOĞLU İNŞAAT TAAHHÜT EMLAK GIDA TURİZM TİCARET LTD. ŞTİ. DATA POLICY

LİDER PAŞAOĞLU İNŞAAT TAAHHÜT EMLAK GIDA TURİZM TİCARET LTD. ŞTİ. DATA POLICY

1. PURPOSE
Leader Paşaoğlu İnş. Tah. Real Estate Food Turz. Trade Ltd. Sti. As our customers, including our visitors, suppliers and employees. The Constitution of the Republic of Turkey, human rights International Conventions to which our country is a party and Personal Law No. 6698 In compliance with the relevant legislation, especially the Data Protection Law (“KVKK”) to effectively enforce the rights of the persons whose data are processed. Ensuring its use is our priority.

Therefore, but not limited to those listed; our employees, our suppliers, our customers, our visitors, our website our users who visit, in short, what we acquire during our activities processing, storage, transfer of all personal data transactions related to Lider Paşaoğlu İnş. Tah. Real Estate Food Turz. Trade Ltd. Sti. According to the Personal Data Protection and Processing Policy (“Policy”) we are realizing.

Protection of personal data and the basic principles of natural persons whose personal data are collected. observance of the rights and freedoms regarding the processing of personal data is the basic principle of our policy. Therefore, all personal data are processed. our activities, protecting the privacy of private life, personal information privacy, confidentiality of communication, freedom of thought and belief, effective law We continue by observing the right to use the roads.

For the purpose of protecting personal data, the nature of the data required all administrative and technical protection measures in accordance with the legislation and current technology. way we get it. This Policy does not apply to commercial, promotional-marketing or social personal data shared during our responsibility and similar activities Processing, storing, transferring and transferring within the framework of the principles mentioned in KVKK The methods we follow for deletion or anonymization explains.

2. SCOPE
Our visitors, business contacts, business partners, employees, processed by the Company, including our suppliers, third parties All personal data are covered by this Policy.
Our policy applies to all Company-owned or Company-managed, It is applied in activities for the processing of personal data, and KVKK and other relevant legislation regarding personal data and international It has been handled and prepared by considering the standards.

3. DEFINITIONS AND ABBREVIATIONS
In this section, special terms and phrases, concepts, abbreviations etc. in the Policy. briefly explained.

Lider Paşaoğlu : Lider Paşaoğlu İnş. Tah. Real Estate Food Turz. Trade Ltd. Sti.
Explicit Consent: To be informed and free will on a particular subject. based on a clear and unequivocal basis, limited to that transaction only. given consent.
Anonymization: Even by matching personal data with other data under any circumstances, to an identified or identifiable natural person. making it unrelated.
Employee: Company Personnel.
Personal Data Owner (Relevant Person): The natural person whose personal data is processed.
Personal Data: Any information relating to an identified or identifiable natural person. kinds of information.
Special Quality Personal Data: The race, ethnic origin, political opinion of the persons, philosophical belief, religion, sect or other
beliefs, health information, fingerprints, attire, association, foundation or union membership, health, sex life, criminal conviction and security biometric and genetic data as well as data on the measures taken.
Processing of Personal Data: Fully or partially automated personal data with or any data record
obtained by non-automatic means, provided that it is part of the system, recording, storing, preserving, changing, rearranging, disclose, transfer, take over, make available, on data such as classification or prevention of use any operation performed.
Data Processor: On behalf of the data controller, based on the authority given by the data controller. natural or legal person processing personal data.
Data Controller: Determining the purposes and means of processing personal data, natural or legal person responsible for the establishment and management of the data recording system person.
KVK Board: Personal Data Protection Board.
KVK Authority: Personal Data Protection Authority.
KVKK : Personal Data published in the Official Gazette dated 7 April 2016 and numbered 29677 Data Protection Law.
Policy : Lider Paşaoğlu İnş. Tah. Real Estate Food Turz. Trade Ltd. Sti. Personal Data Protection and Processing

4. ROLE AND RESPONSIBILITIES
4.1. Identity of Data Controller and Representative
Data controller in subparagraph (i) of paragraph 1 of Article 3 of the KVKK, “data register, which determines the purposes and means of processing personal data, establishment and management of the systemresponsible natural and legal defined as “persons”. In this context, the data controller Lider Paşaoğlu İnş. Tah. Real Estate Food Turz. Trade Ltd. Şti. Board of Directors, Policy, rule and notification, review and sanction in case of non-compliance with regulations It is responsible for the oversight of the identification and operation of the mechanisms. Personal Data Protection and Processing Policy is determined by the Board of Directors. has been approved. policy formulation, implementation and, where necessary, It is the authorized approval mechanism for updating.

4.2 Control Unit
Compliance with the Policy of the companies that receive external services together with the employees by taking the necessary measures for
Examination of the subjects in order to examine the matters contrary to the policy. The Audit Unit is responsible
4.3 Information Systems Commission
From the preparation, development, execution and updating of this Policy, The Information Systems Commission is responsible. Keep this Policy up to date when necessary and evaluated in terms of development needs. The institution of the prepared document to be published on the portal of Information Systems Commission Manager responsibility.

5. LEGAL OBLIGATIONS
Protection and processing of personal data as a data controller in accordance with KVKK Legal obligations are listed below:

5.1. Our obligation to inform
While collecting personal data as a data controller;
• For what purpose your personal data will be processed
• Information on our identity, if any, on the identity of our representative
• To whom and for what purpose your processed personal data can be transferred
• The way we collect the data and the legal reason
• Our obligation to inform the Related Person about the rights arising from the law
This Policy, which is open to the public as a company, is clear, understandable and easy. We take care to ensure that it is accessible.
5.2. Our obligation to ensure data security
To ensure the security of personal data in our responsibility as the data controller We take the administrative and technical measures foreseen in the legislation for to data security Obligations and measures taken regarding this policy are covered in Articles 9 and 10 of this Policy. are detailed in the following sections.

6. CLASSIFICATION OF PERSONAL DATA

6.1. Personal data
Personal data; relating to an identified or identifiable natural person. kinds of information.
The protection of personal data is only related to natural persons and legal entities. personal data that does not contain information about a real person excluded from protection. Therefore, this Policy belongs to legal entities. does not apply to data.

6.2. Special categories of personal data
People's race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs and disguise, association, foundation or union membership, health, sexual life, criminal convictions and security measures. personal data, biometric and genetic data data.

7.PROCESSING OF PERSONAL DATA

7.1. Our personal data processing principles
We process personal data in accordance with the principles below.

7.1.1. Processing in accordance with the law and honesty

Personal data are transparent and enlightening We operate within the framework of our obligation.

7.1.2. Ensuring that personal data is accurate and up-to-date
Data processing to ensure that the processed data is accurate and up-to-date We take the necessary precautions in our procedures. Also available to Personal Data Owner updating its data and correcting any errors in its processed data, if any We offer you the opportunity to apply to us.

7.1.3. Processing for specific, explicit and legitimate purposes
Personal data as a company; scope and content of which are clearly defined, legislation and to continue our activities within the framework of the ordinary course of commercial life. We process it for our designated legitimate purposes.

7.1.4. In connection with the purpose for which personal data are processed, limited and measured be
The personal data is linked to the purpose we have clearly and precisely determined, We operate on a limited and measured basis. Not relevant or needing to be processed We avoid the processing of unheard personal data. Therefore, legal does not process personal data of a special nature unless necessary or When we need to process, we obtain explicit consent on the subject.

7.1.5. legal and commercial law envisaged by legal regulations. retention of personal data for the duration of our interests
Many regulations in the legislation prevent personal data to be stored for a certain period of time. makes it mandatory. For this reason, the personal data we process is subject to the relevant legislation. for the period foreseen or necessary for the purposes of processing personal data we are hiding. The expiration of the storage period stipulated in the legislation or the processing lose your purposein the event of deletion, destruction or destruction of personal data We make it anonymous. Our policies and procedures regarding retention periods 9.1 of this Policy. It is detailed in the article.

7.2. Our purposes for processing personal data
We process personal data for the purposes listed below:
• To carry out our commercial activities
• Support service within the scope of the contract and within the framework of service standards provide
• to identify the preferences and needs of our visitors and to shaping and updating services in this context
• As required or mandated by legal regulations, legal to ensure that our obligations are fulfilled
• Liaising with people who have a business relationship with the company
• Marketing
• Compliance management
• Vendor / supplier management
• Legal reporting
• Billing
• Lider Paşaoğlu to ensure communication between employee candidates and employers
• Managing call center processes
• Ensuring corporate communication
• Lider Paşaoğlu İnş. Tah. Real Estate Food Turz. Trade Ltd. Sti.
between the company and the transportation or technical service after the purchase of the product in particular liaise
• Sending newsletters by SMS, e-mail, doing marketing activities or as well as notifications. No matter which channel it is obtained from, it is open In the absence of consent, your personal data will not be processed. However, KVKK As stated in Article 5;
• In cases expressly stipulated in the laws
• Being unable to express their consent due to actual impossibility, or whose consent is not given legal validity
protecting the vital or bodily integrity of oneself or another mandatory for
• Being publicized by the person concerned
• Data processing is mandatory for the establishment, exercise or protection of a right. be
In such cases, it is possible to process personal data without consent. Leader Pasaoglu Ins. Tah. Real Estate Food Turz. Trade Ltd. Şti. in the processing of personal data, data prioritizes the consent of the owner. Pursuant to Article 6 of KVKK Sensitive personal data can only be processed with the consent of the data owner

7.3. Processing of special categories of personal data
Special quality personal data is stipulated in the laws and is subject to the KVK Board. by taking the administrative and technical measures foreseen and if there is express consent, or It is processed by us when required by the legislation.
Special categories of personal data related to health and sexual life protection, preventive medicine, medical diagnosis, treatment and care services planning and management of health services and financing for the purpose of keeping secrets, persons or authorized institutions and Since it can be processed by organizations, our employees data is not processed. Such data belonging to our employees are legal. It can be processed within the bounds of necessity and by the persons stipulated by the law.

7.4. Processing of personal data collected through cookies
Cookies are sent to the computer via the browser by the web server. are small data files placed. Connection between browser and server provided, the site recognizes the user through cookies. your cookies The purpose of use is to provide convenience to the user visiting the website. Cookies, how our web pages or mobile applications work and to improve its use and digital to make your time on our platforms more productive and enjoyable. we are working In addition, our websites and mobile from some cookies to remember the choices you make in our applications. benefits, thereby providing you with an enhanced and personalized experience. we provide. Personal information through cookies on our digital platforms collect your data, process the data we collect, transfer it and we can hide it.

7.5. Processing of personal data collected within the scope of Purchase Transactions
When a purchase is made, the financial information of the CUSTOMER debit or credit card for realization
transferred to individuals and institutions such as companies. Transferred data;
• Credit card number
• Expiry date
• CVV2
Or data related to payment purposes, such as bank account information. Buy invoice and payment information of the customer (name, surname, T.R. No, phone number, billing address), invoices sent and received from members samples of payment receipts, payment number, invoice amount, invoice number, data such as invoice issue date are received. These data are; the billing process managing, accounting, after-sales services, communication, marketing, auditing, control is processed within the scope of processes carried out with payment service providers. When the purchase is made, the financial information of the customer is processed.realization of It is transferred to individuals such as banks or credit card companies. Credit card information, Lider Paşaoğlu İnş. Tah. Real Estate Food Turz. Trade Ltd. Sti. data not kept at their base. The above-mentioned data is subject to article 8 of this Policy. transferred accordingly and shared with 3rd parties.
Deletion, destruction or anonymity of personal data within the scope of this platform It is within the scope of article 9 of this Policy.

7.6. Exceptional consent is not required for the processing of personal data. situations
In exceptional cases listed below and arising from the law, without express consent we may process personal data:
• Clearly stipulated in laws
• Being directly related to the establishment or performance of a contract personal
it is necessary to process the data
• Data processing is mandatory for the establishment, exercise or protection of a right. be
• Legitimate as data controller, provided that it does not harm fundamental rights and freedoms. your data for our interests
our processing is mandatory.
Without the explicit consent of the Relevant Person of sensitive personal data Exceptional situations that can be processed are specified in article 7.3 of this Policy

8. TRANSFERRING PERSONAL DATA
8.1. Domestic transfer of personal data
As a company, regarding the transfer of personal data, as stipulated in the KVKK and We act in accordance with the decisions and regulations taken by the Board. Without prejudice to the exceptional circumstances in the legislation, personal data and sensitive data to other natural persons without the explicit consent of the Relevant Person. or legal persons by us. KVKK and other legislation stipulated In exceptional cases, the data may be included in the legislation without the explicit consent of the Related Person administrative or judicial authority authorized in the prescribed manner and within limits. can be transferred to an institution or organization.
In addition, with the exceptional cases stipulated by the legislation;
• In cases described in the Policy
• In the cases listed in the Policy regarding personal data of special nature
With the measures stipulated by the KVK Board and the relevant legislation, Personal data of a personal nature and health of the Relevant Person can only be health protection, preventive medicine, medical diagnosis, treatment and care health services, planning and financing of health services and persons or authorized persons under the obligation of confidentiality for the purpose of managing It can be transferred to institutions and organizations without seeking explicit consent

8.2. Transfer of personal data abroad
As a rule, personal data cannot be transferred abroad without the explicit consent of the Relevant Person. not exported. However, this Policy's exceptional
third parties abroad in cases where one of the but:
• Located in countries where there is sufficient protection declared by the KVK Board
• In Turkey, if it is located in countries where there is no adequate protection, and data in foreign country
responsible persons undertake in writing to an adequate protection and KVK In cases where the permission of the Board of Directors is available, personal data cannot be transferred without express consent. can be transferred outside.

8.3. Institutions and organizations to which personal data is transferred
Personal data;
• To our suppliers
• To our business partners and business contacts
• To technical services
• To transport companies
• To cargo companies
• Legally authorized public institutions and organizations
• Legally authorized private legal persons
• Independent audit firms
• To our partners,
It can be transferred according to the principles and rules described above.

8.4. We have received regarding the transfer of personal data in accordance with the law. measures
8.4.1. Technical measures
To protect personal data, including but not limited to those listed;
• For the processing and storage of personal data in accordance with the legislation, the company to organize the internal technical organization
• To ensure the security of the databases where your personal data will be stored. creating the technical infrastructure
• Follows the processes of the technical infrastructure created and performs its audits. doing
• Regarding the reporting of the technical measures and audit processes we have taken establishes procedures
• Periodically updates and renews technical measures
• Risky situations are re-examined and necessary technological solutions are produced
• Virus protection systems, firewall and similar software or hardware uses security products and provides security in accordance with technological developments. in installing systems
• We employ employees who are experts in technical matters.

8.4.2. Administrative measures
To protect your personal data, including but not limited to those listed;
• Including company and subsidiary employees within our company personal data access policies and procedures
creating
• Legal protection of personal data of our employees and processingIt informs about and
in training
• In the contracts we make with our employees and/or In the policies, the company is by our Employees
to be taken in case of unlawful processing of personal data records the measures
• Data processors we work with or partners of data processors personal data processing activities
we are auditing.

9. STORAGE OF PERSONAL DATA
9.1. For the purpose for which personal data is processed or stipulated in the relevant legislation to be stored for as long as necessary
Without prejudice to the storage periods stipulated in the legislation for personal data, We store personal data for as long as required by the purpose of processing. In cases where we process personal data for more than one purpose, the processing of the data the purpose of the data disappears or upon the request of the Relevant Person. If there is no obstacle to the deletion of the data, the data is deleted and destroyed. or anonymized. Destruction, deletion or anonymization The provisions of the legislation and the decisions of the KVK Board are complied with.

9.2. Measures we take regarding the storage of personal data
9.2.1. Technical Measures
• Technique for deletion, destruction and anonymization of personal data infrastructures and their control
forming mechanisms
• It takes the necessary measures for the safe storage of personal data
• Employs employees with technical expertise
• Creating business continuity and emergency plans against the risks that may occur and systems for their implementation
developing
In accordance with technological developments regarding the storage areas of personal data We install security systems.

9.2.2. Administrative Measures
• About the technical and administrative risks associated with the storage of personal data awareness by informing our employees
creating
• Cooperating with third parties for the storage of personal data contracts with companies to which personal data is transferred; Protection of the persons to whom personal data is transferred, personal data transferred regarding taking the necessary security measures for safe storage and We include the provisions.

10. SECURITY OF PERSONAL DATA
10.1. Our obligations regarding the security of personal data
Personal data;
• To prevent illegal processing,
• To prevent illegal access,
• To ensure that it is kept in accordance with the law,
According to technological possibilities and implementation costs, administrative and technical We are taking precautions.

10.2. In order to prevent the unlawful processing of personal data, measures
• We carry out and have the necessary inspections made within our company,
• About the legal processing of personal data of our employees educates and informs,
• The activities carried out by our company are detailed in all business units. being evaluated, the said
commercial activities carried out by the relevant units as a result of the evaluation processes personal data in particular,
• Cooperation with third parties for the processing of personal data In contracts made with companies that process personal data; personal on taking the necessary security measures by the persons who process the data. includes provisions,
• Unlawful disclosure or data leakage of personal data in case of a situation, by notifying the KVK Board
In this regard, it carries out the examinations stipulated by the legislation and takes the measures.

10.2.1. taken to prevent unlawful access to personal data. technical and administrative measures
To prevent unlawful access to personal data;
• Employs employees with technical expertise,
• Periodically updates and renews the technical measures,
• Establishes access authorization procedures within our company,
• Regarding the reporting of the technical measures and audit processes we have taken sets the procedures,
• Complying with the legislation the data recording systems used within our company. properly and periodically
performs its audits,
• Establishing emergency aid plans against the risks that may arise develops systems for its implementation,
• We train our employees on accessing and authorizing personal data. and informing,
• Third parties for activities such as processing and storage of personal data. providing access to personal data in cases where cooperation is made with individuals in contracts with companies; persons who have access to personal data It includes provisions on taking the necessary security measures,
• To prevent unlawful access to personal data, technological security systems in progress
we are establishing.

10.2.2. in personl we receive in case of unlawful disclosure of data measures
Administrative and takes technical measures and implements them in accordance with our relevant procedures. we are updating. Detection of unauthorized disclosure of personal data If we do this, the system is used to notify the Related Person and the KVK Board. and building infrastructure. Despite all the administrative and technical measures taken In case of an unlawful disclosure, it is required by the KVK Board. If it is seen, this situation can be reported on the website of the KVK Board or in another

11. RIGHTS OF PERSONAL DATA OWNER
Informing the Personal Data Owner within the scope of our disclosure obligation and we are establishing systems and infrastructures for this information. Personal Data Necessary for the Owner to exercise his rights regarding his personal data. We make technical and administrative arrangements. Personal Data Owner personal data on;
• Learning whether personal data is processed
• Requesting information if personal data has been processed
• The purpose of processing personal data and whether they are used in accordance with their purpose. learning not used
• Third parties to whom personal data is transferred at home or abroad don't know
• In case of incomplete or incorrect processing of personal data, their don't ask for correction
• In case the reasons requiring the processing of personal data disappear request deletion or destruction of personal data
• The above-mentioned correction, deletion or destruction processes, personal requesting the notification of the third parties to whom the data is transferred
• Analysis of processed data exclusively through automated systems Objecting to an adverse outcome by means of
• Damage due to unlawful processing of personal data has the right to demand the compensation of the damage in case of damage.

11.1. Exercise of rights regarding personal data
Personal Data Owner's request regarding his personal data is clear and understandable. in a written and wet signed way, with a photocopy of identity card, driver's license or Cumhuriyet Mah. provided that only the front of the passport is included. Find Keykubat. . Alanyum AVM No:219 Alanya – ANTALYA address. Except that Applications can be submitted by mail (in plain written form and with wet signature, the front of the identity card). photocopy attached), registered letter with return receipt and notary public notice. Applications made in this way will be taken into account, and in accordance with the KVKK, e-mail applications are not legally valid and Lider Paşaoğlu İnş. Tah. Real Estate Food Turz. Trade Ltd. Sti. Email applications on this subject under no obligation to act. submitted at the time of application. ID front side copy, Lider Paşaoğlu İnş. Tah. Real Estate Food Turz. Trade Ltd. Sti.
within the period determined by the legislation, in the annex of the reply letter given by stored and destroyed at the end of the period. In the application;
a) Name, surname and signature if the application is written,
b) For citizens of the Republic of Turkey, T.R. identification number for foreigners nationality, passport number or identification number, if any,
c) ID front side copy
ç) Domicile or workplace address for notification,
d) If available, the e-mail address, telephone and fax number for notification,
e) Subject of the request,
It is mandatory to be present. Those who do not want to present the front of the identity card in their written applications. persons, in order to prove that they are the data owner, Lider Paşaoğlu İnş. Tah. Estate Food Tur. Trade Ltd. Şti. with a personal application to the head office. must present their petitions. Information and documents on the subject attached to the application. In written applications, the date of notification, application is historical. In applications made by other methods; your application to us The deadline is the application date. These requests will be made on an individual basis. requests made by unauthorized third parties regarding personal data. will not be considered.

11.2. Evaluation of the application
11.2.1. Application response time
Requests for personal data can be made as soon as possible and at any time, depending on their nature. In any case, within 30 (thirty) days at the latest, free of charge or by the KVK Board. In the event that the conditions in the tariff to be published regarding the fee are met, finalized against a fee. At the time of application or It may be possible to request additional information and documents while evaluating.

11.2.2. Our right to refuse the application
Applications regarding personal data;
• By anonymizing personal data with official statistics such as research, marketing, planning and statistics
processing purposes
• Violation of personal data privacy or personality rights Art,
provided that it does not constitute a crime or a crime for historical, literary or scientific purposes or for expressivewithin the scope of processing
• Processing of personal data made public by the Personal Data Owner
• The application is not based on a just cause,
• The application contains a request contrary to the relevant legislation,
• Failure to comply with the application procedure
They are rejected with justification in their circumstances.

11.3. Evaluation procedure of the application
In order for the response period specified in this Policy to begin, the methods in Article 11.1 of the requests made and the identity of the applicant You must send it with supporting information and documents. ID, driver's license and/or copy of the front of the passport, Lider Paşaoğlu İnş. Tah. Real Estate Food Turz. Trade Ltd. Sti. It is accepted by If the request is accepted, the relevant process is applied and notification is made in writing or electronically. Your request In case of refusal, the application is made in writing or electronically by explaining the reason. reported to the owner. Unless otherwise stated by the data owner, the name of the notification discretion in making written or electronic media Lider Paşaoğlu Ins. Tah. Real Estate Food Turz. Trade Ltd. Şti.e.

11.4. The right to complain to the Personal Data Protection Board
Rejection of the application, insufficient response or in case of no response; from the date the applicant learned the answer 30 (thirty) days from the date of application and in any case 60 (sixty) days from the date of application has the right to file a complaint with the KVK Board.

12. PUBLICATION AND STORAGE OF THE DOCUMENT
This Policy is available both on paper and electronically. http://www.liderconstruction.com.tr and http://www.liderpasaoglu.com internet It is stored in two different environments, one on the website.

________________________________________