SECTION 1: INTRODUCTION

I. IMPORTANCE OF THE PROTECTION OF PERSONAL DATA

The protection of personal data is a constitutional right and constitutes one of the priorities of AYSAN PLASTIC INDUSTRY AND TRADE INC. Accordingly, with this objective, AYSAN PLASTIC INDUSTRY AND TRADE INC. aims to establish a continuously updated system and has created this Policy. Within the scope of the Personal Data Protection Law No. 6698, acting as the Data Controller, the Company shall hereinafter be referred to as Aysan Boru.

This Policy has been prepared to fulfill the general obligation of disclosure and information towards business partners, shareholders, customers, and real or legal persons with whom it maintains legal relations and communication. Within this scope, it sets forth the fundamental principles regarding the protection of personal data of our customers, potential customers, employees, employee candidates, company shareholders, company officials, visitors, employees, shareholders and officials of institutions with which we cooperate, and third parties.

In order to implement the matters specified in this Policy, necessary procedures are established within the Company, special disclosure texts are prepared, confidentiality agreements are executed, job descriptions are revised, and required administrative and technical measures are taken by Aysan Boru to protect personal data. Necessary audits are conducted or commissioned accordingly. The protection of personal data is also embraced by senior management, and personal data protection processes are managed through the establishment of a dedicated committee (Company PDP Committee).

II. PURPOSE OF THE POLICY

The main purpose of this Policy is to set forth the principles regarding personal data processing activities carried out lawfully by Aysan Boru and the protection of personal data, and to ensure transparency by informing and enlightening individuals whose personal data are processed by Aysan Boru, primarily including customers, potential customers, employee candidates, company shareholders, company officials, visitors, employees, shareholders and officials of collaborating institutions, and third parties.

III. SCOPE

This Policy applies to all personal data processed automatically or non-automatically provided that they form part of a data recording system, belonging to customers, potential customers, employees, employee candidates, company shareholders, company officials, visitors, employees, shareholders and officials of cooperating institutions, and third parties.

IV. IMPLEMENTATION OF THE POLICY AND RELEVANT LEGISLATION

In matters relating to the processing and protection of personal data, applicable legal regulations in force shall primarily apply. In case of any inconsistency between current legislation and this Policy, Aysan Boru acknowledges that the provisions of the legislation shall prevail.

V. ACCESS AND UPDATES

This Policy is published on Aysan Boru’s website (https://www.aysanplastik.com), made available to personal data subjects upon request, and updated when necessary.

SECTION 2: PROCESSING OF PERSONAL DATA

Aysan Boru processes personal data in accordance with Article 20 of the Constitution and Article 4 of the Personal Data Protection Law, in compliance with the principles of lawfulness and fairness; accuracy and being up to date when necessary; processing for specific, explicit, and legitimate purposes; being relevant, limited, and proportionate to the purpose; and retention for the period stipulated by law or required by the purpose of processing.

Pursuant to Articles 20 of the Constitution and 5 of the Personal Data Protection Law, Aysan Boru processes personal data based on one or more of the conditions specified in Article 5 of the Law.

In accordance with Article 419 of the Turkish Code of Obligations, without prejudice to Law No. 6698, Aysan Boru processes the personal data of employees and employee candidates based on job suitability and performance of employment contracts.

Aysan Boru informs personal data subjects in accordance with Articles 20 of the Constitution and 10 of the Law, and responds to information requests and applications for exercising legal rights within the statutory period.

Aysan Boru acts in compliance with Article 6 of the Law regarding the processing of special categories of personal data.

Aysan Boru complies with Articles 8 and 9 of the Law in the transfer of personal data and takes into account decisions of the Personal Data Protection Board and published communiqués, including lists of safe countries.

I. PROCESSING OF PERSONAL DATA IN ACCORDANCE WITH LEGAL PRINCIPLES

1. Principles of Personal Data Processing

Lawfulness and Fairness:
Aysan Boru acts in accordance with legal regulations and the principles of honesty and good faith, and does not process personal data beyond what is required for the intended purpose.

Accuracy and Currency:
Aysan Boru ensures that processed personal data are accurate and up to date, taking into account the fundamental rights of data subjects and its legitimate interests.

Specific, Explicit, and Legitimate Purposes:
Personal data are processed only for clearly defined, legitimate, and lawful purposes and only to the extent necessary for the services provided.

Relevance, Limitation, and Proportionality:
Data processing is limited to what is necessary to achieve the specified purposes.

Retention for Required Periods:
Personal data are retained for the period stipulated by relevant legislation or required by the processing purpose, considering statutes of limitation. Upon expiration or cessation of purpose, data are deleted or destroyed.

II. TRANSFER OF PERSONAL DATA

Aysan Boru may transfer personal data and special categories of personal data to third parties by taking necessary security measures and acting in accordance with Article 8 of the Law.

Transfers may occur based on:

Explicit consent of the data subject, or

Legal obligation, contractual necessity, protection of life or physical integrity, public disclosure by the data subject, establishment or protection of legal rights, or legitimate interests of Aysan Boru without harming fundamental rights.

The same principles apply to the transfer of special categories of personal data, with additional safeguards as required by law.