KVKK Clarification Text

Personal Data Protection Law Clarification Text

1. Identity of the Data Controller

As Yayla Agro Gıda San. ve Tic. A.Ş – MERSIS: 0320003905300001 (“Yayla Agro Gıda”), we attach great importance to the security and privacy of your personal data. In this regard, we present the following matters to your attention within the scope of the Law on the Protection of Personal Data No. 6698 (“Law”) regarding all kinds of personal data belonging to our employees, suppliers, and customers, in order to fulfill our disclosure obligation.

The protection of personal data is among the fundamental policies of Yayla Bakliyat. Our enterprise has prioritized data security throughout its existence and adopted it as a working principle. Yayla Bakliyat accepts and undertakes to comply with all responsibilities brought by the Personal Data Protection Law (KVKK). With full awareness of this responsibility and in our capacity as the Data Controller, we process, record, transfer, share, and store your personal data in the manner explained below and within the boundaries defined by official legislation.

2. Collection, Processing, and Purposes of Processing Personal Data

Personal Data That May Be Processed

The categories of your personal data that may be subject to processing by us are outlined below.

Detailed and up-to-date information can be accessed through the Personal Data Protection Authority Registry Inquiry System (VERBİS), where you can review Data Categories, Purposes, Recipients, Retention Periods, Data Subject Groups, Foreign Countries, and Security Measures.

While your personal data may vary depending on the product sold by Yayla Bakliyat or the nature of our commercial relationship, it is processed under the highest level of protection by our Company.

Our institution retains identity, contact, religion/belief, health, financial, educational, and other sensitive personal data belonging to data subject groups such as Employee Candidates, Employees, Shareholders/Partners, Potential Product or Service Buyers, Interns, Supplier Employees, Supplier Officials, Product or Service Buyers, Parents / Guardians / Representatives, and Visitors.

Purposes of Processing Personal Data

Your personal data, obtained either in accordance with the legal compliance reasons stated in the laws of the Republic of Turkey or via the explicit consent of the data subjects, is processed by Yayla Bakliyat for the following purposes:

• Fulfilling our legal obligations specified in the Constitution, Laws, Decree-Laws, Regulations, and Bylaws,

• Carrying out product supply and after-sales service processes, executing repair operations, ensuring customer satisfaction, and meeting demands,

• Managing accounting and financial processes during the sale or procurement of products and services,

• Managing the logistics processes of products and services purchased from our business,

• Ensuring the legal and commercial security of individuals who are in a business relationship with our enterprise (administrative operations regarding communication carried out by our business, ensuring the physical security and inspection of our locations, evaluation processes of business partners/customers/suppliers/officials/employees, legal compliance processes, financial affairs, etc.),

• Managing safety operations, accidents, or similar incidents for medical/insurance purposes,

• Ensuring the security of those present in our facilities by utilizing video camera (CCTV) footage, preventing, detecting, and assisting in the prosecution of criminal offenses, as well as establishing, exercising, or defending our legal rights,

• Informing you about the information, products, and services you request from our enterprise,

• Determining and implementing the commercial and business strategies of our enterprise,

• Ensuring the execution of our enterprise’s human resources policies,

• Fulfilling a legal obligation determined by legislation when explicitly stated or required,

• Conducting analysis and loyalty studies regarding the products and services you purchase; planning and implementing promotions, surveys, advertisements, market research, marketing, and campaigns; and presenting general and specific offers,

• Recording and reviewing notifications such as requests, suggestions, satisfaction, complaints, and objections conveyed through our switchboard, call center, or customer relations phone numbers, and responding when necessary; planning and executing business activities and operational processes; fulfilling legal rights and obligations; maintaining customer service processes and communication activities; confirming calls; improving service quality and ensuring continuity through feedback, as well as maintaining transaction security and utilizing these records as evidence in potential disputes.

Furthermore, your personal data is processed within the framework of our legal obligations arising from the relevant legislation, particularly Law No. 5651 on Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications, Law No. 6563 on the Regulation of Electronic Commerce, Labor Law No. 4857, Turkish Commercial Code No. 6102, Turkish Penal Code No. 5237, and Personal Data Protection Law No. 6698, to ensure compliance with these purposes and legal mandates.

Your personal data may be stored in both digital and physical environments by being recorded in the physical archives and information systems belonging to Yayla Bakliyat.

Your personal data processed for the purposes specified in this Clarification Text will be anonymized or deleted by us when the purpose requiring its processing ceases to exist and the periods determined by the laws expire. You always retain the right to withdraw your explicit consent, if any, regarding the processing and use of your personal data.

3. Transfer of Personal Data

Your personal data may be transferred to domestic service providers from whom we receive information technology, software, archiving, printing, and logistics/distribution services, as well as other third parties we cooperate with, our board of directors, business/solution partners, judicial authorities, law enforcement forces, and legally authorized public and private institutions/organizations.

Such transfers are strictly limited to the reasons requiring translation under the Law and related regulations, for the sole purpose of providing these services to you and resolving legal disputes.

4. Method and Legal Basis of Personal Data Collection

Your personal data is collected through automatic or non-automatic methods in verbal, written, or electronic forms. Collection is conducted based on the legal grounds stipulated in Article 5, Paragraph 2 of Law No. 6698, which includes: being explicitly provided for in the laws, the establishment and/or performance of a contract, the fulfillment of legal obligations, and the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the data subject.

5. Your Rights Regarding the Protection of Personal Data

Within the framework of the Law, you hold the right to:

• Learn whether your personal data is being processed, and request information if it has been processed;

• Learn the purpose of the processing and whether the data is being used in accordance with these purposes;

• Know the third parties to whom your personal data is transferred domestically or abroad;

• Request rectification if your personal data is processed incompletely or inaccurately;

• Request the erasure, destruction, or anonymization of your personal data if the reasons requiring its processing no longer exist;

• Request that notification of these corrections, erasures, or destructions be made to the third parties to whom the data was transferred;

• Object to any outcome detrimental to you arising exclusively from the analysis of your processed data through automated systems.

To submit a request regarding your personal data within the scope of the Law, you can fill out the relevant fields in the Yayla Bakliyat Personal Data Owner Application Form and apply using one of the methods specified below:

Our Company will finalize application requests free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request, in accordance with Article 13 of the Law. If the transaction requires an additional cost, the tariff determined by the Personal Data Protection Board will be applied. If the request is rejected, the reason(s) for rejection will be justified, and if accepted, the action taken will be communicated in writing or electronically.

Yayla Bakliyat reserves the right to update this “Clarification Text on the Protection of Personal Data” in line with potential changes in official legislation in force or in data protection processes.