This information and consent notice has been prepared by Siltaş Yapı İnşaat Sanayi ve Ticaret Anonim Şirketi (the “Company”), acting as the data controller, for the purpose of obtaining the explicit consent of the Company’s customers regarding the processing of their personal data by the Company within the scope of the Law No. 6698 on the Protection of Personal Data (the “Law”) and to inform data subjects, at the time their personal data are obtained, about the matters specified in Article 10 of the Law and the rights of the data subject set out in Article 11 of the Law.

1. METHODS AND LEGAL GROUNDS FOR OBTAINING PERSONAL DATA

Your personal data are collected in electronic or physical environments. The personal data collected on the legal grounds specified in this Information Notice may be processed and shared within the scope of the personal data processing conditions set out in Articles 5 and 6 of the Law.

2. PURPOSES OF PROCESSING PERSONAL DATA

Within the scope of the personal data processing conditions specified in Articles 5 and 6 of the Law, your personal data are processed by the Company for the purposes of planning and execution of activities necessary for customizing the products and services offered by the Company according to the preferences, usage habits and needs of the relevant persons and recommending and promoting them to such persons; carrying out the necessary work by business units to enable relevant persons to benefit from the products and services offered by the Company and conducting the related business processes; carrying out the necessary work by business units for the realization of the commercial activities conducted by the Company and conducting the related business processes; planning and execution of the Company’s commercial and/or business strategies; and ensuring the legal, technical and commercial/occupational security of the Company and the relevant persons who have a business relationship with the Company.

3. PARTIES TO WHOM PERSONAL DATA MAY BE TRANSFERRED AND MEANS OF TRANSFER

Within the scope of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law, your personal data may be shared for the purposes of planning and execution of activities necessary for customizing the products and services offered by the Company according to the preferences, usage habits and needs of the relevant persons and recommending and promoting them to such persons; carrying out the necessary work by business units to enable relevant persons to benefit from the products and services offered by the Company and conducting the related business processes; carrying out the necessary work by business units for the realization of the commercial activities conducted by the Company and conducting the related business processes; planning and execution of the Company’s commercial and/or business strategies; and ensuring the legal, technical and commercial/occupational security of the Company and the relevant persons who have a business relationship with the Company, with the Company’s business partners and suppliers, legally authorized public institutions and organizations, and legally authorized private legal entities.

4. PERSONAL DATA PROCESSED BY THE COMPANY

Our Company collects the following personal data:

• Identity Data: Name, surname, Turkish ID number, date of birth, copy of identity card,
• Contact Data: Phone number, e-mail address, workplace address,
• Customer Transaction Data: Call center records, invoices, promissory notes, cheque information, order and request information,
• Financial Data: Bank account information, credit card information, for risk management in commercial transactions: balance sheet, financial performance, credit and risk information, asset information,
• Marketing Data: Purchase history information,
• Legal Transaction Data: In case of a legal matter or lawsuit, information in correspondence with judicial authorities and in the case file,
• Employment Data: The company you work for, department, mode of work, profession, title, specimen signature circulars,
• Visual and Audio Data: Photographs and audio recordings pertaining to the person,
• Website/Application Usage Data: User’s activities on the site and mouse movements.

These personal data are collected physically or electronically through the information and contact forms on our website, social media messages, our call center, our dealers/stores, and events organized or attended by our Company.

5. RIGHTS OF THE DATA SUBJECT

By applying to the Company acting as the data controller, data subjects have the right to obtain information on whether their personal data are processed, to request documentation if personal data have been processed, to examine whether their personal data have been processed lawfully and in compliance with the procedure, to learn the third parties to whom personal data are transferred, to request the correction of personal data in case they are incomplete or incorrectly processed, to request the deletion of their personal data under the conditions specified in Article 7 of the Law, to request that the transactions carried out pursuant to subparagraphs (d) and (e) of Article 11 of the Law be notified to the third parties to whom the personal data have been transferred, to object to any result to the detriment of the person arising from the analysis of the processed data exclusively through automated systems, and to demand compensation in case of damage due to unlawful processing of personal data.

6. EXERCISING RIGHTS BY THE DATA SUBJECT

Pursuant to the Law, applications regarding Personal Data may be submitted:

• In person, by verifying identity, to the address: Yenişehir Mahallesi Akkaya Sokak No:2F/20 Pendik/İSTANBUL; or
• By e-mail to our Company at info@siltasyapi.com, with identity verification ensured; or
• By registered electronic mail (KEP) to 25959-92269-65715, or through other methods specified in the Law and secondary legislation.

Within the limits stipulated in the Law, the Company responds to data subjects who wish to exercise their rights within a maximum of thirty (30) days as set forth in the Law. In case a request is rejected, the reason(s) for rejection shall be provided in writing or electronically with justification.