ANKA TOPRAK ÜRÜNLERİ SANAYİ VE TİCARET ANONİM ŞİRKETİ

PERSONAL DATA PROTECTION POLICY

Anka Toprak Ürünleri Sanayi ve Ticaret Anonim Şirketi, a company operating in the flooring and wall covering industry, places great importance on the personal data of the individuals it interacts with, particularly including its employees, customers, suppliers, and business partners. This Policy has been issued to ensure that ANKA TOPRAK’s personal data processing activities are carried out in compliance with all applicable local legislation, including the Personal Data Protection Law in force in the Republic of Türkiye. In this context, all processes related to the processing and protection of personal data are configured in accordance with a lawful, fair, and transparent approach.

1. DEFINITIONS and ABBREVIATIONS

Within the scope of this Policy, the following terms shall have the meanings set forth below:

• Company / ANKA TOPRAK: Anka Toprak Ürünleri Sanayi ve Ticaret Anonim Şirketi
• Law/PDPL: The Personal Data Protection Law (Law No. 6698),
• Institution: The Personal Data Protection Authority.
• Policy: This Personal Data Protection Policy,
• Personal Data: All information about an identified or identifiable natural person.
• Sensitive Personal Data/SPD: Data about race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance, clothing, and association, foundation or union membership, health status, sexual life, criminal conviction, and safety measures of the data subject, and his or her biometric and genetic data,
• Data Subject: The natural person whose personal data are processed
• Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.
• Processing of Personal Data: It implies any kind of activity for gathering, recording, storing, preserving, changing, re-organizing, sharing, transferring, taking over personal data, making derivable personal data and preventing classification or use of personal data that are processed completely or partially by automated means as well as non-automated processing as a part of a recording system.
• Data Protection Committee/Officer: The committee established within ANKA TOPRAK by a decision of the Board of Directors, or the person appointed by the Board of Directors; the committee is responsible for internal processes regarding the protection and processing of personal data
• Disposal/Destruction of Personal Data: The deletion, destruction/disposal, or anonymization of personal data
• Anonymization of Personal Data: Converting the personal data to make such data impossible to be related with an identified or identifiable natural person, even if such data is matched with other data.
• Deletion of Personal Data: Rendering personal data inaccessible and unusable for the relevant users in any manner,
• Disposal/Destruction of Personal Data: Making personal data inaccessible, irretrievable, and unusable by anyone under any circumstances
• Recording Environment: Any environment, where the personal data is stored that is processed with entirely or partially automatic means or with non-automatic means, provided the latter is a part of any data recording system,
• Personal Data Inventory/Inventory: The inventory detailing the personal data processing activities carried out by the data controller depending on the business processes,
• Relevant User: Persons who process personal data within the organization of the data controller or in line with the authorization and instructions received from the data controller, excluding those responsible for technical storage, protection, and backup of data
• VERBIS: Data Controllers Registry Information System

1. PURPOSE

This Policy is the foundation of ANKA TOPRAK’s approach to the protection of personal data and reflects the Company’s commitments and vision in this field.

The purpose of this policy addresses following elements:

1. Data Protection Culture: ANKA TOPRAK aims to create a high level of awareness regarding the protection of personal data. In this context, it is intended to increase awareness and responsibility in all departments of the company and to integrate data protection into the corporate culture.
2. Ensuring Legal Compliance: Ensuring full compliance with all legal and regulatory requirements regarding personal data protection, particularly the PDPL (the Personal Data Protection Law), is a primary priority. This Policy provides a framework that complies with all current and future regulations.
3. Personal Data Security: The secure processing, storage, and transfer of personal data are among primary responsibilities of ANKA TOPRAK. For this purpose, data security is ensured using up-to-date security technologies and best practices.
4. Transparency and Accountability: It is the fundamental principle that data processing activities are carried out in a transparent, clear, and accountable manner. The rights of data subjects are respected, and clear and understandable information about data processing activities is provided.
5. Continuous Development and Improvement: Processes and practices related to protection of personal data are continuously reviewed and improved.

This Policy is a document that establishes and guides data protection and privacy standards of ANKA TOPRAK. This policy aims to ensure integration of data protection and privacy into all business processes and activities of the company.

1. SCOPE

This Policy covers all personal data of data subjects – addressed by or has any relationship with ANKA TOPRAK - processed, stored, or otherwise managed by ANKA TOPRAK. Moreover, it applies to all recording environments – managed by ANKA TOPRAK- in which personal data is processed and to all activities related to personal data processing.

1. DATA PROCESSING PRINCIPLES

This section includes the fundamental principles adopted by ANKA TOPRAK regarding the collection and processing of personal data. These principles are based on the fundamental principles set forth under data protection legislation.

1. 4.1.Compliance with Law and Good Faith

ANKA TOPRAK acts in compliance with the applicable legislation, general principles of law, and the principles of good faith in the collection and processing of personal data. This implies that all data processing activities must be carried out in accordance with the law.

1. 4.2.Accuracy and Being Up to Date When Necessary

ANKA TOPRAK takes all necessary measures to ensure that the personal data it processes is accurate and kept up to date, where necessary. Data subjects have the right to request the correction of their data if it is inaccurate or incomplete. ANKA TOPRAK processes such requests immediately.

1. 4.3.Processing for Certain, Explicit and Legitimate Purposes

Personal data is processed for certain, explicit, and legitimate purposes determined within the scope of the field of activity of ANKA TOPRAK and the data processing activity is limited to such purposes. ANKA TOPRAK does not process personal data for purposes other than the purpose of collecting the personal data. When the purpose of processing is met or it is not required for this purpose anymore, the data is disposed/destructed.

1. 4.4.Being Relevant, Limited and Proportionate to the Purpose of Processing

ANKA TOPRAK ensures that the collected data is limited to the minimum level necessary for the purpose of processing. Data are collected and processed at minimal level required for the purpose of processing. This principle necessitates collecting and processing only required amount of data.  Furthermore, ANKA TOPRAK acts in the most proportionate manner for the data that will be required within the scope of its activities in order to fulfill the purpose of processing.

1. 4.5.Storing for the Period Stipulated in the Relevant Legislation or Required for the Purpose of Processing

Personal data is retained for the period stipulated in the relevant legislation or required for the purpose of data processing. ANKA TOPRAK takes the necessary administrative and technical measures to ensure the security of the data during this period. When the purpose ceases or there is no legal requirement to retain, data are disposed/destructed/deleted.

1. 4.6.Integrity and Confidentiality

Personal data is protected, through the administrative and technical measures to be taken by ANKA TOPRAK, against destruction, damage, alteration, or disclosure resulting from unauthorized access or negligent actions of authorized persons. Thus, the integrity and confidentiality of the data set held by the data controller are ensured. ANKA TOPRAK continuously improves its data security and follows the most up-to-date security standards.

1. 4.7.Accountability

ANKA TOPRAK establishes the mechanisms that demonstrate compliance with the aforementioned principles. The Company regularly reviews its data protection policies and procedures and makes necessary updates. In addition, it evaluates and improves the effectiveness of these policies and procedures continuously.

1. 4.8.Data Protection by Design and by Default

Accordingly, while establishing the data recording system in ANKA TOPRAK,

• The types of data to be processed and required to be processed are determined.
• The technical and administrative measures that will be taken to protect them are evaluated.
• Considering the personal data that is processed, the probabilities and risks are taken into consideration in terms of potential violations of the rights and freedoms of the data subjects.

1. CONDITIONS FOR PROCESSING PERSONAL DATA

This section explains the conditions for the processing of personal data within ANKA TOPRAK stipulated under the PDPL. ANKA TOPRAK acts not only in compliance with legal obligations but also based on ethical principles and best practices in its data processing activities.

1. 5.1.Being Clearly Predicted in Laws (the PDPL Article 5/2-a)

When personal data is processed at conditions that are clearly predicted by laws, actions are taken in accordance with meaning and purpose of these regulations.

1. 5.2.Inability to Obtain Explicit Consent Due to De Facto Impossibility (the PDPL Article 5/2-b)

In cases of de facto impossibility, such as medical emergencies, personal data may be processed without the explicit consent of the data subject. In such cases, it is necessary to pay attention that the processed data is used only for necessary and specific purposes.

1. 5.3.Being Related to the Establishment or Performance of a Contract (the PDPL Article 5/2-c)

Personal data may be processed when it is directly related to the establishment or performance of a contract in ANKA TOPRAK. This covers the mandatory processing of personal data of the parties to the contract for the purposes of establishing, performing, or terminating the contract.

1. 5.4.Necessity for Compliance with a Legal Obligation of the Data Controller (the PDPL Article 5/2-ç)

When the legal obligations, particularly within the scope of labor law, social security law, and tax legislation, are fulfilled by ANKA TOPRAK, data processing activities are carried out in a manner that ensures transparency and accountability.

1. 5.5.Personal Data Made Public by the Data Subject (the PDPL Article 5/2-d)

In the processing of personal data that has been made public, actions should respect the privacy rights of the data subject. Such data is processed only in line with the purpose for which the data was made public by the data subject.

1. 5.6.Necessity for the Establishment, Exercise or Protection of a Right (the PDPL Article 5/2-e)

In legal processes that also involve ANKA TOPRAK or in situations where rights need to be protected, personal data is processed in accordance with the legal framework. Particular attention is paid to ensuring that the processing is necessary and proportionate.

1. 5.7.Necessity for the Legitimate Interests of the Data Controller (the PDPL Article 5/2-f)

When the data processing activities are carried out in line with the legitimate interests of ANKA TOPRAK, the rights and freedoms of data subjects are prioritized. A balanced approach between the legitimate interests of ANKA TOPRAK and the rights of the data subjects is adopted in the data processing activities.

1. 5.8.Explicit Consent of the Data Subject (the PDPL Article 5/1)

When explicit consent is obtained from data subjects, it is verified that such consent is based on information process and is given freely. Within the scope of the explicit consent process, clear and understandable information is provided regarding the purpose, scope, and consequences of data processing. If any of the aforementioned legal grounds for processing exists, explicit consent is not required.

ANKA TOPRAK carefully reviews each of these conditions and takes the necessary steps to ensure that the legal grounds stipulated under the PDPL are met in the processing of personal data.

1. SENSITIVE PERSONAL DATA

Considering sensitive personal data of data subjects, a “Sensitive Personal Data Processing Policy” is present that has been established taking into account the sensitive nature of such data.

1. CATEGORIES OF PERSONAL DATA PROCESSED AND PURPOSES OF PROCESSING

ANKA TOPRAK processes the following categories of personal data within the scope of the activities detailed in the Personal Data Processing Inventory, in compliance with the general principles set forth in the Article 4 of the Law and the data processing conditions mentioned in Articles 5 and 6:

• Identity and Contact Data: Carrying out the contract processes, conducting communication activities, and fulfilling legal obligations
• Personnel and Professional Experience Data: Executing the human resources processes, fulfillment of obligations arising out of employment contracts and applicable legislation, and carrying out the candidate evaluation processes.
• Financial and Customer/Supplier Transaction Data: Performing financial and accounting operations, invoicing processes, management of goods and services procurement and sales processes, and logistics operations.
• Physical Environment Security Data: Ensuring physical security in company premises and construction sites.
• Transaction Security Data: Carrying out information security processes, management of access authorizations, and maintenance of log records.
• Legal Transaction Data: For providing information to authorized persons, institutions, and organizations, and monitoring the legal dispute processes.
• Health Information: Performing occupational health and safety (OHS) activities, fulfillment of statutory health examination obligations, and meeting other personnel and safety requirements arising from legislation.

All department-based and process-based details regarding the categories of personal data processed, matched processing purposes, legal grounds, and retention periods, are recorded in the up-to-date Personal Data Processing Inventory that is kept in the Company.

1. DATA RETENTION AND DISPOSAL/DESTRUCTION

ANKA TOPRAK implements THE Data Retention and Disposal / Destruction Policy for the storage and disposal of personal data. This policy has been established in compliance with the PDPL and other relevant regulations and details the processes for storing and securely destroying data when necessary. ANKA TOPRAK undertakes to ensure data confidentiality by securely and appropriately destroying / destructing /disposing personal data when the retention period required by legislation expires or when the purpose of processing does not exist anymore.

1. DATA TRANSFER

ANKA TOPRAK manages the processes related to the transfer of personal data within the framework of a detailed Data Transfer Procedure.

1. 9.1.Domestic Data Transfer

ANKA TOPRAK carries out domestic data transfer processes in compliance with the Article 8 of the Law No. 6698 and other relevant legislation. Transfer activities are conducted based on the processing conditions set forth in Articles 5 and 6 of the Law and in accordance with the principle of data minimization.

1. 9.2.International Data Transfer

As a rule, personal data is not transferred abroad within the scope of the current activities carried out in ANKA TOPRAK.

However, when it becomes necessary in the future to transfer the personal data abroad due to company activities, such transfers shall be carried out in strict compliance with the procedures and principles set forth in the Article 9 of the Law. In this context, international data transfer shall only be possible after one of the following legal mechanisms is established:

• The existence of a Competency decision issued by the Board regarding the country, industry within the country, or international organization to which the data will be transferred.
• In the absence of a competency decision, provided that the data subject has the ability to exercise his or her rights and access effective legal remedies in the country, the presence of one of the appropriate safeguards stipulated under the Law (such as Standard Contract published by the Board, Binding Corporate Rules, or Board approval, etc.).
• In exceptional cases where neither a competence decision nor appropriate safeguards can be ensured, the presence of one of the occasional (exceptional) conditions exhaustively listed under the Article 9/6 of the Law.

In case of a potential international transfer, data subjects shall be informed in advance and in detail, through Information Notices, regarding the purpose of transfer, recipient groups, legal basis, and the transfer mechanism used, in accordance with the Article 10 of the Law and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.

1. PERSONAL DATA INVENTORY

A personal data inventory is maintained on a process-based basis with respect to personal data processed in ANKA TOPRAK. This inventory contains information regarding the types of personal data processed, processing purposes and legal grounds, department-based access authorizations, retention periods, and data transfer activities.

Maximum attention is paid to keep the inventory up to date, and its accuracy is inspected by the Data Protection Committee/Officer every January and July.

Changes in the inventory are also recorded in VERBIS.

1. TECHNICAL AND ADMINISTRATIVE MEASURES

ANKA TOPRAK takes the necessary steps to implement technical and administrative measures required for the protection of personal data it processes, in line with up-to-date security standards, Board decisions, and industry-based requirements.

In this context, the measures that are taken in ANKA TOPRAK can be broadly summarized as follows:

1. 11.1.Technical measures

1. Access Control:

• Access to personal data is restricted only to authorized personnel.
• Strong password policies are implemented.

1. Firewalls and Antivirus Software:

• Network systems are monitored and protected by up-to-date firewalls, effective security applications, and antivirus software.
• Devices to be included in the network systems are integrated into the system upon approval of the system administrator after necessary security checks.
• Security software and system patches are regularly updated.
• Up-to-date software is used for detecting data leaks and data violations.

1. Data Backup:

• Backup processes are carried out regularly, securely, and in encrypted form.

1. Secure Data Transfer:

• The transfer of personal data is carried out by encrypting the data package and transmitting the password via a separate communication channel.

1. Penetration Test:

• Penetration tests are conducted at regular intervals to identify vulnerabilities in systems of ANKA TOPRAK.

1. 5.2.Administrative Measures

1. Policies and Procedures:

• Written policies and procedures have been established for the processing and protection of personal data.
• Policies and procedures are regularly reviewed and updated.
• The disciplinary regulations include provisions regarding the personal data security.

1. Training and Awareness:

• Employees are regularly provided with training on data protection and security.
• Internal communication and awareness activities are carried out to increase data security awareness.
• Third parties to whom data is transferred are informed to raise awareness regarding the data security.

1. Monitoring and Audit:

• Personal data processing activities are regularly monitored and audited.
• Regular and random internal audits are conducted.
• Incident response procedures are implemented in case of security breaches.
• Third parties that are transferred data are audited in terms of data security.

1. Incident Management

• Incident management procedures have been established for detecting, reporting, and management of data security breaches.

1. Risk Assessment:

• Risk assessment is regularly performed for personal data processing activities.
• Appropriate measures are taken for identified risks.

1. Appointment of Officer in Company:

• A person responsible for the protection of personal data has been appointed and equipped with the necessary authority.

1. Committeemen’s:

• Following awareness activities, commitment letters regarding the protection of personal data are obtained from employees.
• Commitment letters regarding personal data protection are obtained from third parties to whom personal data is transferred.

1. Personal Data:

• Personal data processing is kept at a minimum level.
• Personal data in physical environments is stored and transferred with confidentiality classification.
• Environments, where personal data is present, are protected against external risks such as fire, flood, etc.

Technical and administrative measures implemented in ANKA TOPRAK are not limited to the above mentioned ones, and additional measures specified in other policies and procedures are also applied.

1. RIGHTS OF THE DATA SUBJECT

ANKA TOPRAK protects the rights of data subjects regarding personal data with great care. Pursuant to the Article 11 of the Law, data subjects have the following rights:

1. Learn whether personal data is processed or not, Data subjects have the right to learn whether their personal data is processed.
2. Request Information Regarding Processed Data: If personal data has been processed, the data subject has the right to request information about such data.
3. Learn the intent of processing personal data and whether they are used in line with the intent: Data subjects have the right to learn the purpose of processing their personal data and whether it is used in accordance with such purposes.
4. Know Third Parties to Whom Data are Transferred Domestically or Abroad: Data subjects have the right to obtain information about third parties to whom their personal data is transferred domestically or abroad.
5. Request Correction of Incomplete or Incorrect Data: Data subjects may request the correction of personal data that has been processed incompletely or inaccurately.
6. Request Deletion or Destruction of Data Processes in compliance with the PDPL and Provisions of Other Relevant Laws Data subjects may request the deletion or destruction of personal data when the reasons that require data processes are not valid anymore.
7. Request Notification of Correction, Deletion, or Destruction to Third Parties to Whom Data is Transferred Data subjects may request that correction, deletion, or destruction processes are notified to third parties to whom personal data has been transferred.
8. Raising an objection to a negative outcome arising out of analyzing the data exclusively with automated systems, Data subjects may object to the emergence of a result against them through the processing of personal data exclusively by automated systems.
9. Request compensation of losses and damages that arise out of illegal processing of personal data. In case of damage and/or loss due to unlawful processing of personal data, data subjects have the right to claim compensation of the damage.

ANKA TOPRAK provides all necessary mechanisms to facilitate and support the exercise of these rights.

The data subject can notify a request to ANKA TOPRAK in terms of the exercise of the rights:

1. Physically visiting our company at Güvenevler Mah Farabi Sok No 43 Çankaya/ANKARA or sending a letter with certified mail service,
2. Submitting your requests through notary offices in order to identify you, and not to give incorrect information or not to inform an unauthorized person,
3. Sending an e-mail to kvkk@ankatoprak.com.tr using e-mail address of the Data Subject that was previously notified to our Company or that is also saved in our system,
4. Sending a KEP post to the KEP (registered e-mail) address, ankatoprak@hs06.kep.tr, of our company using your KEP (registered e-mail),
5. Using other procedures that are mentioned in relevant legislation by verifying your identity details.

1. COMPLAINT AND BREACH NOTIFICATION

ANKA TOPRAK handles data subject applications for personal data and data breaches with great diligence and adopts a transparent approach in this regard. Procedures titled “Personal Data Emergency and Data Breach Notification Procedure” for breaches in personal data processing activities and “Data Subject Application Procedure” for data subject applications have been established in Company, and these procedures are applied in case of breaches and applications.

These procedures cover both application management and data breach management processes and are designed in compliance with the PDPL and other relevant legislation.

Data subjects may apply to ANKA TOPRAK in case of any complaint or breach regarding their personal data. The Company evaluates such applications promptly and effectively, takes necessary actions, and makes required notifications to data subjects and competent authorities.

These processes are carried out meticulously to protect the rights of data subjects and ensure data security and they are continuously reviewed.

1. OBLIGATION TO INFORM

Pursuant to Article 10 of the Law, ANKA TOPRAK is obliged to inform data subjects about the personal data processed. In this context, data subjects are properly informed at the Company’s data entry points in accordance with the relevant procedures and principles at the stage of data collection at the latest.

1. EXPLICIT CONSENT PROCESSES

When the data processing requires explicit consent, the data processing process shall not commence without obtaining the explicit consent of the data subject.

If the processing conditions set forth in the Article 5/2 of the Law are not present, explicit consent shall be obtained from the data subjects. If other processing conditions set forth in the Article 5/2 of the Law exist, explicit consent is not obtained from the data subjects.

Explicit consent is obtained for only one data processing purpose. Within the scope of the consent, the data subject is informed in detail about the purpose of processing.

The data subject is not obliged to give explicit consent. The essential principle is that the consent is given on free will, and the data subject is provided with the option to refuse.

Any service to be provided to the data subject cannot be related with the condition of obtaining explicit consent. Furthermore, the data processing activity, which can be carried out after obtaining explicit consent, cannot be designed to create a negative outcome for the data subject, if the data subject does not give explicit consent.

1. TRAINING AND AWARENESS

ANKA TOPRAK aims to increase and strengthen awareness of all its employees and business partners regarding the protection of personal data. For this purpose, the Company regularly conducts training programs and awareness activities.

1. Continuous Training

Regular training programs are provided to employees, including detailed information on the PDPL and data protection practices. Within the scope of orientation processes for recently recruited employees, fundamental information on data protection and confidentiality principles is provided.

1. Awareness Activities

Awareness seminars, workshops, and information sessions on data protection and privacy are organized. Data protection updates and tips are regularly shared through internal communication channels.

1. Continuous Update and Improvement

Training materials and awareness activities are continuously updated in line with the industrial developments and amendments in laws. Employee feedback and participation are taken into account in improving contents and methods of these trainings.

These training and awareness programs support ANKA TOPRAK’s commitment to the protection of personal data and contribute to increasing employees’ competencies in this field. These processes also contribute to the dissemination of the data protection culture throughout the Company.

1. REVIEW AND UPDATE

The process of updating this Policy is carried out by the Data Protection Committee/Officer. Legal changes, industrial developments, and technological innovations are regularly monitored.

When any amendment in relevant laws or a business need is determined, the relevant sections of the Policy are reviewed and necessary updates are made. The Policy is reviewed at least annually. However, in the case of significant legal changes or business needs, more frequent updates may be performed.

All updates are recorded and these records ensure that the process is transparent and auditable.

Updates are communicated internally to all relevant departments and employees, and training and information sessions are organized where necessary.

1. ENFORCEMENT

This Personal Data Protection Policy is executed by manager or the Board of Directors of ANKA TOPRAK.

The Data Protection Committee/Officer appointed in ANKA TOPRAK is responsible for the implementation of this Policy.

1. VALIDITY

This Policy enters into force on the date it is approved by the Board of Directors of ANKA TOPRAK.

The Policy has been approved on [approval date] and has been implemented across all departments and activities of ANKA TOPRAK as of that date.

Any revision or update of the Policy shall enter into force after it is approved by the Board of Directors of ANKA TOPRAK, and relevant changes shall be communicated to all relevant parties.