Contracts

INFORMATION TEXT ON THE PROCUREMENT, PROCESSING, AND PROTECTION OF PERSONAL DATA


1. GENERAL EXPLANATION AND DEFINITIONS
This information text has been prepared by Yilmazlar Makina Ve Otom Ulaş. Tar. Sanve Tic. Ltd. Şti. (referred to as YILMAZLAR MAKINA) in the capacity of "data controller" within the scope of the obligation to inform under Article 10 of the Personal Data Protection Law No. 6698 (the Law).
The meanings of the terms in this information text are defined by the Law No. 6698, the Regulations, and the Communiqués issued concerning this Law, as follows:

Personal Data: Any information relating to an identified or identifiable natural person,
Processing of Personal Data: Any operation performed on personal data, wholly or partly by automated means, or by non-automated means, provided that it is part of any data recording system, such as obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying, or preventing the use of personal data,
Data Subject: The natural person whose personal data is processed,
Explicit Consent: Consent that is related to a specific subject, based on information, and expressed with free will,
Anonymization: Making personal data impossible to link with an identified or identifiable person, even when matching them with other data,
Data Controller: The natural or legal person who determines the purposes and means of processing personal data, and is responsible for establishing and managing the data recording system,
Data Processor: The natural or legal person who processes personal data on behalf of the data controller based on the authority given by the data controller,
Data Recording System: The recording system in which personal data is processed by structuring according to specific criteria,
Contact Person: The natural person designated by the data controller for communication with the Institution regarding the obligations under the Law and secondary regulations to be issued based on this Law,
Personal Data Retention and Destruction Policy: The policy used by data controllers as the basis for determining the maximum retention period required for the purposes for which personal data are processed, and for deletion, destruction, or anonymization processes.
2. INFORMATION ABOUT THE DATA CONTROLLER
For legal entities, the data controller is the legal entity itself. The obligations of data controllers under the Law are fulfilled through the organs/persons authorized to represent and bind the legal entity. The organ authorized to represent the legal entity can appoint one or more persons to fulfill the obligations related to the application of the Law. This appointment does not eliminate the liability of the legal entity under the Law.
YILMAZLAR MAKINA operates as a capital company established in Turkey. The details about YILMAZLAR MAKINA as the data controller are as follows:

Data Controller:
Yılmazlar Makina Ve Otom Ulaş. Tar. Sanve Tic. Ltd. Şti.
Organize Sanayi Bölgesi / Odunpazarı 24. Caddesi No:2, 26100 Eskişehir – Turkey
Phone: +90 222 236 13 86 Fax: +90 222 236 13 87
Email: yilmazlar@yilmazlarmaksan.com
3. OBLIGATIONS OF THE DATA CONTROLLER
Under the obligation to inform, YILMAZLAR MAKINA is responsible for informing data subjects about:

The identity of the data controller and its representative, if any,
The purposes for which personal data will be processed,
To whom and for what purposes the processed personal data may be transferred,
The method and legal basis of personal data collection,
The rights of data subjects regarding their personal data.
YILMAZLAR MAKINA also takes necessary security measures to:
Prevent unlawful processing of personal data,
Prevent unlawful access to personal data,
Ensure the protection of personal data.
YILMAZLAR MAKINA does not disclose the personal data it obtains to anyone in violation of the Law and does not use it for purposes other than those specified.
4. PERSONAL DATA TO BE PROCESSED
The personal data to be processed by YILMAZLAR MAKINA are listed below, and new data may be added or changes may be made within the framework of the applicable legal regulations and/or as needed:

Identity information such as name, surname, TCK number, date of birth, etc.,
Contact information such as address, phone, fax, email, etc.,
Information on tax office and tax number,
Information on employees' wages, social security, bank account numbers, and family members,
Information on profession and education status.
5. METHODS OF OBTAINING PERSONAL DATA
Personal data can be obtained directly from the data subject or indirectly through dealers, partner institutions, and organizations, and for purposes in line with the purpose of obtaining the data.

6. PURPOSES OF PROCESSING PERSONAL DATA
YILMAZLAR MAKINA processes personal data for the following purposes:

Fulfilling obligations regarding taxes and other public receivables under tax laws, Turkish Commercial Code No. 6102, and other legal regulations,
Taking measures to protect consumer rights under the Consumer Protection Law No. 6502,
Receiving orders for products from YILMAZLAR MAKINA, selling products, delivering products to related persons, collecting their prices, providing after-sales services, measuring customer satisfaction, and collecting and evaluating complaints and suggestions, if any,
Arranging sales contracts for purchases made, verifying the identity of the related person,
Improving service quality,
Conducting campaigns, promotions, advertising, and marketing activities for products and services, and providing information on these subjects,
Ensuring internal security and increasing efficiency.
7. TRANSFER AND PROTECTION OF PERSONAL DATA
YILMAZLAR MAKINA does not transfer personal data obtained for data processing purposes to third parties/institutions without the explicit consent of the data subject.
YILMAZLAR MAKINA may transfer personal data to public legal entities authorized to receive personal data such as the Revenue Administration, Employment Agency, Social Security Institution, Financial Crimes Investigation Board, Interbank Card Center, Credit Registration Bureau, YILMAZLAR MAKINA's domestic/foreign affiliates, companies operating with dealership status, program partner/solution partner institutions and organizations, PTT branches, companies providing logistics support services, consulting and independent auditing services, and to third parties and institutions to provide better service, provided that the rights of the data subject under the Law No. 6698 are reserved.

8. OBTAINING THE CONSENT OF THE DATA SUBJECT FOR PROCESSING PERSONAL DATA
The personal data processed by YILMAZLAR MAKINA are processed with the explicit consent of the data subject within the scope of Law No. 6698. Explicit consent refers to consent that is based on information and expressed freely by the data subject concerning a specific subject.
Under Article 5/2 of Law No. 6698, personal data may be processed without the explicit consent of the data subject if one of the following conditions exists:

Explicitly provided for by the law,
Mandatory for the protection of life or physical integrity of the person who is unable to express his consent due to actual impossibility or whose consent is not legally valid,
Directly related to the establishment or performance of a contract, provided that it is necessary for the processing of personal data of the parties to the contract,
Mandatory for the data controller to fulfill its legal obligation,
Made public by the data subject,
Mandatory for the establishment, exercise, or protection of a right,
Mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
9. RETENTION PERIOD OF PERSONAL DATA
YILMAZLAR MAKINA destroys personal data (deletes, destroys, or anonymizes) when the purpose of processing personal data is no longer valid and the mandatory retention periods specified by laws and other regulations have expired.

10. RIGHTS OF THE DATA SUBJECT
Data subjects have the right to apply to the data controller and request the following concerning themselves:

To learn whether their personal data is processed or not,
To request information if their personal data has been processed,
To learn the purpose of processing their personal data and whether they are used in accordance with their purpose,
To know the third parties to whom personal data are transferred within the country or abroad,
To request the correction of incomplete or incorrect personal data,
To request the deletion or destruction of personal data within the framework of the conditions stipulated in the law,
To request notification of the transactions made as a result of the correction, deletion, or destruction of personal data to third parties to whom personal data have been transferred,
To object to the occurrence of a result against the person himself by analyzing the processed data exclusively through automated systems,
To request the compensation of the damage in case of damage due to the unlawful processing of personal data.
11. APPLICATION TO THE DATA CONTROLLER
Natural persons whose personal data are processed may apply to YILMAZLAR MAKINA regarding their rights under Article 11 of the Law No. 6698. Data subjects can benefit from this right by applying in Turkish. They can submit their requests to YILMAZLAR MAKINA through one of the following communication channels. Accordingly, data subjects can submit their requests:

In writing,
Through the registered electronic mail (KEP) address,
By secure electronic signature or mobile signature,
Using the email address previously notified to YILMAZLAR MAKINA by the data subject and registered in YILMAZLAR MAKINA's system,
Through a software or application

INFORMATION TEXT ON OBTAINING, PROCESSING, AND PROTECTING PERSONAL DATA

1- GENERAL EXPLANATION AND DEFINITIONS
This information text has been prepared by Yilmazlar Machine and Automotive Transportation Agriculture Industry and Trade Limited Company (referred to as YILMAZLAR MAKINA) in the capacity of "data controller" within the scope of Article 10 of the Law on the Protection of Personal Data No. 6698 (the Law) to fulfill the "obligation to inform".
The meanings of the terms included in this information text are as follows, as defined in Law No. 6698, the regulations and communiqués issued pursuant to this Law:
• Personal data: Any kind of information related to an identified or identifiable natural person,
• Processing of personal data: Any operation performed on personal data, whether by automated means or non-automated means, such as collection, recording, storage, preservation, alteration, reorganization, disclosure, transfer, takeover, making available, classification, or prevention of the use of data,
• Data subject: The natural person whose personal data is processed,
• Explicit consent: Consent based on information regarding a specific subject and given with free will,
• Anonymization: Rendering personal data impossible to relate to an identified or identifiable natural person, even if matched with other data,
• Data controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system,
• Data processor: The natural or legal person who processes personal data on behalf of the data controller based on the authorization given by them,
• Data recording system: The system where personal data is processed according to certain criteria,
• Contact person: The natural person declared by the data controller during registration with the Registry for the purpose of establishing communication with the Authority regarding the obligations of legal entities established in Turkey and legal entity data controllers' representatives not resident in Turkey within the scope of the Law and secondary regulations to be issued based on this Law,
• Personal data retention and destruction policy: The policy adopted by data controllers as the basis for determining the maximum period necessary for processing personal data for the purposes they are processed for and for the deletion, destruction, or anonymization of data.
2- INFORMATION ABOUT THE DATA CONTROLLER
In legal entities, the data controller is the legal entity itself. The obligations of legal entities established in Turkey as data controllers under the Law are fulfilled by the authorized organ/person or persons to represent and bind the legal entity. The authorized organ for representation may appoint one or more persons regarding the obligations to be fulfilled for the implementation of the Law. This appointment does not relieve the legal entity of its responsibilities under the Law.
YILMAZLAR MAKINA operates as a capital company with legal personality established in Turkey. Information about YILMAZLAR MAKINA as the data controller is as follows:
Data Controller:
Yilmazlar Machine and Automotive Transportation Agriculture Industry and Trade Limited Company
Organized Industrial Zone / Odunpazarı 24th Street No:2, 26100 Eskişehir – Turkey
Phone: +90 222 236 13 86 Fax: +90 222 236 13 87
Email: yilmazlar@yilmazlarmaksan.com
3- OBLIGATIONS OF THE DATA CONTROLLER
YILMAZLAR MAKINA is obliged to inform the data subjects within the scope of the obligation to inform, regarding:
• The identity of the data controller and, if any, its representative,
• The purposes of processing personal data,
• To whom and for what purposes the processed personal data may be transferred,
• The method and legal basis of personal data collection,
• The rights of individuals whose personal data is processed.
YILMAZLAR MAKINA also takes necessary security measures to:
• Prevent the unlawful processing of personal data,
• Prevent unauthorized access to personal data,
• Ensure the preservation of personal data.
YILMAZLAR MAKINA, by conducting necessary audits in its own institution or organization to ensure the implementation of the provisions of Law No. 6698, does not disclose the personal data it obtains and does not use it for purposes other than processing, in accordance with the provisions of Law No. 6698.
4- PERSONAL DATA TO BE PROCESSED
The personal data to be processed by YILMAZLAR MAKINA are as specified below, and new ones may be added and/or changes may be made to this information within the scope of legal requirements and/or needs:
The personal data subject to processing include:
• Name, Surname, Turkish Republic Identity Number, Date of Birth, etc., identity information,
• Address, phone, fax, e-mail, etc., contact information,
• Tax Office and Tax Number information,
• Information about employees' wages, social security, bank account numbers, and family members,
• Information about profession and education status,
5- METHODS OF OBTAINING PERSONAL DATA
Personal data can be obtained directly from the data subject themselves or indirectly through dealers, solution partner institutions and organizations, and other means depending on the purpose of obtaining the data.
6- PURPOSE OF PROCESSING PERSONAL DATA
YILMAZLAR MAKINA processes personal data for the following purposes:
These purposes include:
• Fulfillment of obligations regarding taxes, etc., public receivables within the scope of tax laws, Law No. 6102 Turkish Commercial Code, and other legal regulations,
• Taking measures to protect consumer rights within the scope of Law No. 6502 on the Protection of the Consumer,
• Receiving orders for products that individuals want to purchase from YILMAZLAR MAKINA, selling products, delivering products to the relevant individuals, collecting payments, providing after-sales services for sold products, measuring customer satisfaction, collecting and evaluating complaints and suggestions regarding sold products or services,
• Preparation of sales contracts in shopping, verification of the identity of the relevant person,
• Improving service quality,
• Conducting campaigns, promotions, advertisements, and promotional activities related to products and services, providing information on these topics,
• Ensuring internal security and increasing efficiency,
7- TRANSFER AND PROTECTION OF PERSONAL DATA
YILMAZLAR MAKINA does not transfer personal data obtained for processing purposes to third parties/institutions without the explicit consent of the data subject.
YILMAZLAR MAKINA may transfer personal data to third parties and institutions authorized to receive personal data, such as Revenue Administration, İş-Kur, Social Security Institution, Financial Crimes Investigation Board, Interbank Card Center, Credit Registry Office, its domestic/foreign subsidiaries, firms operated as dealerships, institutions and organizations of collaboration/partnership programs, PTT branches, companies providing logistic support, consultancy and independent audit services, in compliance with legal obligations or for the purpose of better serving within the scope of Article 6, even if there is no legal obligation, provided that the rights of the data subject under Law No. 6698 are preserved.
8- OBTAINING THE CONSENT OF THE DATA SUBJECT FOR PROCESSING PERSONAL DATA
Personal data to be processed by YILMAZLAR MAKİNA are processed with the explicit consent of the data subject within the scope of Law No. 6698. Explicit consent refers to the consent of the data subject based on being informed about a specific subject and expressed with free will.

In accordance with Article 5/2 of Law No. 6698, personal data may be processed without the explicit consent of the data subject if one of the following conditions exists:

Clearly prescribed by laws.
Necessary for the protection of the life or bodily integrity of the data subject or another person where the data subject is unable to express consent due to physical impossibility or where consent is not legally valid.
Necessary for the establishment or performance of a contract, provided that it is directly related to the parties of the contract.
Necessary for the data controller to fulfill its legal obligation.
Made public by the data subject themselves.
Necessary for the establishment, exercise, or protection of a right.
Necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
9- STORAGE PERIOD OF PERSONAL DATA
YILMAZLAR MAKİNA destroys personal data (deletes, destroys, or anonymizes personal data) when the purpose of processing personal data ceases to exist, along with the expiration of mandatory retention periods specified in laws and other regulations.

10- RIGHTS OF THE DATA SUBJECT
Data subjects can apply to the data controller regarding their personal data and:

Learn whether personal data is being processed,
Request information if personal data has been processed,
Learn the purpose of processing personal data and whether they are used in accordance with their purpose,
Know the third parties to whom personal data is transferred domestically or abroad,
Request the correction of personal data if it is incomplete or incorrectly processed,
Request the deletion or destruction of personal data within the framework of conditions stipulated by law,
Request that the changes regarding personal data be notified to third parties to whom the personal data has been transferred,
Object to the occurrence of a result against oneself through the analysis of processed data exclusively by automated systems,
Demand compensation for damages in case of suffering damage due to the unlawful processing of personal data.
11- APPLICATION TO THE DATA CONTROLLER
Natural persons whose personal data are processed may apply to YILMAZLAR MAKİNA regarding their requests within the scope of the rights specified in Article 11 of Law No. 6698. Data subjects can benefit from this right by making their applications in Turkish. Data subjects can submit their requests to YILMAZLAR MAKİNA through one of the following communication channels:

In writing,
Via registered electronic mail (KEP) address,
Through secure electronic signature or mobile signature,
By using the electronic mail address previously notified by the data subject to YILMAZLAR MAKİNA and registered in YILMAZLAR MAKİNA's system,
By sending data to YILMAZLAR MAKİNA through software or application developed for the purpose of the application.
The following information must be included in the applications:
Name, surname, and signature if the application is written,
Republic of Turkey ID number for Turkish citizens, nationality for foreigners, passport number, or, if any, ID number,
Residential or business address for notification purposes,
If available, the electronic mail address for notification, telephone, and fax numbers,
Subject of the request,
and relevant information and documents should be attached to the application. Applications can be made using the "Application Request Form." Data subjects can use the communication channels specified in the "Information about the Data Controller" section of this information text for their applications.
YILMAZLAR MAKİNA processes the requests included in the application, depending on the nature of the request, as soon as possible and within thirty days at the latest, free of charge. However, if the transaction requires an additional cost, a fee may be charged in the amount specified in Article 7 of the "Communiqué on the Procedures and Principles of Application to the Data Controller." If the fee is charged due to an error of the data controller, the fee shall be refunded to the relevant person.
12- AMENDMENTS AND UPDATES
This information text has been prepared within the scope of Law No. 6698 and the Regulation and Communiqués published within the scope of the said Law and YILMAZLAR MAKİNA's personal data processing purposes and policies. Necessary changes may be made in the information text in accordance with the changes that may occur in the relevant legislation and/or YILMAZLAR MAKİNA's personal data processing purposes and policies.
The most up-to-date version of the Information Text can be accessed at https://recber.com/kisisel-verilerin-korunmasina-iliskin-aydinlatma-metni/."