Personal Data Processing and Protection Policy
ORGANO TARIM TEKNOLOJİLERİ SANAYİ VE TİCARET A.Ş.
PERSONAL DATA
PROCESSING AND PROTECTION POLICY
ORGANO TARIM TEKNOLOJİLERİ SANAYİ VE TİCARET A.Ş.
PERSONAL DATA PROCESSING AND PROTECTION POLICY
Addressee:
All natural persons, other than the employees of Organo Tarım Teknolojileri Sanayi ve Ticaret A.Ş., whose personal data is processed by Organo Tarım Teknolojileri Sanayi ve Ticaret A.Ş.
Prepared by:
Organo Tarım Teknolojileri Sanayi ve Ticaret A.Ş. KVKK Compliance Committee
Approved by:
Organo Tarım Teknolojileri Sanayi ve Ticaret A.Ş. Board of Directors
VERSION: 1.0
Effective Date: 06/08/2026
© Organo Tarım Teknolojileri Sanayi ve Ticaret A.Ş. 2026
This document may not be reproduced or distributed without the written permission of Organo Tarım Teknolojileri Sanayi ve Ticaret A.Ş.
1. INTRODUCTION
1.1 Introduction
Organo Tarım Teknolojileri Sanayi ve Ticaret A.Ş. (the "Company") attaches the utmost importance to protecting the fundamental rights and freedoms of individuals, particularly the privacy of private life regulated in Article 20 of the Constitution, in the protection and processing of personal data. In this framework, it takes care to protect and process personal data lawfully in accordance with Personal Data Protection Law No. 6698 (the "Law" or the "KVK Law") and acts with this understanding in all of its planning and activities.
Our Company does not regard the protection and processing of personal data, which is the foundation of the privacy of private life, solely as compliance with legislation; it places the value it attaches to human beings at the foundation of its approach. Acting with this awareness, our Company takes every kind of administrative and technical measure necessary for the lawful protection and processing of personal data.
1.2 Purpose of the Policy
The purpose of the Personal Data Processing and Protection Policy (the "Policy") is, in line with the purpose of the Law, to protect to the maximum extent the fundamental rights and freedoms of individuals, particularly the privacy of private life regulated in Article 20 of the Constitution, in the protection and processing of personal data processed wholly or partly by automated means or, provided that it is part of any data recording system, by non-automated means, and to inform personal data subjects (relevant persons) about our Company's obligations and the procedures and principles it will comply with under the Law. In line with the purpose of the Policy, the aim is to ensure full compliance with legislation in the personal data protection and processing activities carried out by our Company and to protect personal data subjects' right to the privacy of private life and to data security.
1.3 Scope of the Policy
This Policy covers, provided that they are natural persons, Employee Candidates, Shareholders/Partners, Potential Product or Service Recipients, Interns, Supplier Employees, Supplier Officials, Persons Receiving Products or Services, Reference Persons and Visitors, and will apply to the persons so specified. The Company informs these personal data subjects about the Law by publishing this Policy on its website. This Policy will not apply to legal entities, in whatever capacity. The "Policy on the Processing and Protection of Personal Data for Employees" will apply to the employees of our Company.
This Policy will apply to the relevant persons specified above where their personal data is processed by our Company wholly or partly by automated means or, provided that it is part of any data recording system, by non-automated means. This Policy will not apply if the data does not fall within the scope of "Personal Data" as specified below or if the personal data processing activity carried out by our Company is not carried out by the means specified above.
1.4 Definitions
The concepts used in the application of this Policy have the meanings given below:
| Explicit Consent | Consent that relates to a specific subject, is based on information and is declared with free will. |
| Making Public | The concept of making public, which means "making known to everyone", is listed in Article 5 of Law No. 6698 as one of the exceptions to the "requirement to obtain the explicit consent of the natural person whose personal data is processed" that is necessary for personal data to be processed. |
| Obligation to Inform | The data controller's obligation to inform the persons whose personal data it processes about by whom, for what purposes and on what legal grounds their data may be processed, and to whom and for what purposes it may be transferred. |
| Relevant User | Persons who process personal data within the data controller's organization or in line with the authorization and instructions received from the data controller, excluding the person or unit responsible for the technical storage, protection and backup of the data. |
| Destruction | Refers to the deletion, destruction or anonymization of personal data. |
| Processing of Personal Data | Any operation performed on personal data, such as obtaining, recording, storing, retaining, changing, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, wholly or partly by automated means or, provided that it is part of any data recording system, by non-automated means. |
| KVK Board | The Personal Data Protection Board. |
| Relevant Person / Personal Data Subject | Refers to Employee Candidates, Shareholders/Partners, Potential Product or Service Recipients, Interns, Supplier Employees, Supplier Officials, Persons Receiving Products or Services, Reference Persons and Visitors whose personal data (including special categories of personal data) is processed. |
| Personal Data | Any information relating to an identified or identifiable natural person. |
| Authority | The Personal Data Protection Authority, consisting of the Board and the Presidency. |
| Automated Data Processing | A processing activity that takes place spontaneously, without human intervention, within the scope of algorithms prepared in advance through software or hardware features, carried out by devices with processors such as computers, telephones and watches. |
| Special Categories of Personal Data | Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, are special categories of data. |
| Registry | The Data Controllers' Registry. |
| Company / Our Company | Organo Tarım Teknolojileri Sanayi ve Ticaret A.Ş. |
| Data Processor | A natural or legal person who processes personal data on behalf of the data controller based on the authority given by the data controller. |
| Data Recording System | Refers to the recording system in which personal data is structured according to certain criteria and processed. |
| Data Category | A class of personal data belonging to the data subject group or groups, in which personal data is grouped according to common characteristics. |
| Data Subject Group | The group of relevant persons whose personal data is processed by the data controller. |
| Data Controller | The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system. |
1.5 Entry into Force of the Policy
The Policy, which was drawn up by Organo Tarım Teknolojileri Sanayi ve Ticaret A.Ş. and entered into force on 06/08/2026, is published on the Company's website (www.fergo.com) and made available to the relevant persons.
2. PROTECTION OF PERSONAL DATA
2.1 Security of Personal Data
Under the Law, our Company takes every kind of administrative and technical measure necessary to ensure an appropriate level of security in order to store personal data securely and to prevent personal data from being processed and accessed unlawfully. The administrative and technical measures taken regarding the security of personal data are regulated in detail in our Company's Personal Data Retention and Destruction Policy.
In order to ensure compliance with the Law and other legislation, our Company has established a "Personal Data Protection Management System" and, within this scope, has formed a Personal Data Protection Committee within its organization to ensure the implementation of the Policy and other relevant policies.
2.2 Audit
Our Company carries out and has carried out the necessary audits in order to establish the data security described above and to ensure the regularity and continuity of the measures taken. The Personal Data Protection Committee audits the measures taken for the security of personal data.
2.3 Confidentiality
Our Company takes all necessary administrative and technical measures, according to technological possibilities and implementation costs, to ensure that the relevant data controllers and data processors do not disclose the personal data they hold to others in violation of the provisions of the Law and the Policy and do not use it outside the purpose of processing. In this context, information and training activities about the Law and the Policy are carried out for Company employees, and confidentiality agreements are signed as part of the hiring process of the relevant employees.
2.4 Unauthorized Disclosure of Personal Data
If personal data processed by our Company is obtained by others through unlawful means, our Company carries out the necessary procedures to notify the relevant person and the KVK Board within the periods determined by the KVK Board. If the KVK Board deems it necessary, this situation is announced on the KVK Board's website or by another method the KVK Board deems appropriate.
2.5 Respecting the Legal Rights of Relevant Persons
Our Company respects all legal rights of relevant persons relating to the application of the Policy and the Law and takes all necessary measures to protect these rights.
2.6 Protection of Special Categories of Personal Data
Data relating to persons' race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, are special categories of personal data. Our Company is aware that special categories of personal data are data that, if learned by others, may cause the relevant person to be victimized or subjected to discrimination, and therefore takes with care the adequate measures determined by the Board for the protection of such personal data processed lawfully. In this framework, it has a separate policy (Policy on the Security of Special Categories of Personal Data) and procedure that are systematic, with clearly defined rules, manageable and sustainable.
3. PROCESSING AND TRANSFER OF PERSONAL DATA
3.1 General Principles in the Processing and Transfer of Personal Data
Personal data is processed by our Company in accordance with the procedures and principles set out in the Law and this Policy. Our Company complies with the following principles while processing personal data.
3.1.1 Compliance with the Law and the Rules of Good Faith
Our Company processes personal data in accordance with the relevant legislation and the requirements of the rule of good faith and uses it within these limits. In accordance with the principle of compliance with the rule of good faith, our Company takes into account the interests and reasonable expectations of relevant persons while trying to achieve its goals in data processing. It acts in a way that prevents the occurrence of results that the relevant person does not expect and need not expect. In accordance with the principle, it also ensures that the data processing activity in question is transparent for the relevant person and acts in accordance with its obligations to inform and warn.
3.1.2 Being Accurate and, Where Necessary, Up to Date
Our Company ensures that the personal data it processes is accurate and up to date, taking into account the fundamental rights and legitimate interests of relevant persons. In this scope, it carefully takes into account matters such as the sources from which the data is obtained being identified, its accuracy being verified, and the assessment of whether it needs to be updated. In accordance with its duty of active care, our Company always keeps open the channels that will ensure the information of the personal data subject is accurate and up to date. Keeping personal data accurate and up to date is necessary not only to protect our Company's interests but also to protect the fundamental rights and freedoms of the relevant person.
3.1.3 Processing for Specific, Explicit and Legitimate Purposes
Our Company determines its data processing purpose clearly and precisely and ensures that this purpose is legitimate. The legitimacy of the purpose means that the personal data processed by our Company is connected with and necessary for the work it does or the service it provides. Our Company does not process data for purposes other than those it has specified. Accordingly, it shows sensitivity in complying with the principle of specificity and clarity in the legal transactions and texts in which personal data processing purposes are explained.
3.1.4 Being Relevant, Limited and Proportionate to the Purposes for Which They Are Processed
Our Company ensures that the personal data processed is suitable for achieving the specified purposes and avoids processing data that is not related to achieving the purpose or is not needed. Our Company does not collect or process personal data for purposes that do not currently exist and are envisaged to arise later. In order to process data to meet needs that may arise later, it fulfills the processing conditions regulated in the Law as if it were starting the processing for the first time. It also keeps the processed data limited to what is necessary for achieving the purpose. Within the scope of the principle of proportionality, it establishes a reasonable balance between data processing and the purpose desired to be achieved.
3.1.5 Being Retained for the Period Stipulated in the Relevant Legislation or Required for the Purpose for Which They Are Processed
If a period is stipulated in the relevant legislation for the retention of data, our Company complies with these periods; otherwise, it retains personal data only for the period necessary for the purpose for which it is processed. If there is no valid reason for our Company to retain a piece of personal data any longer, that data is deleted, destroyed or anonymized. The procedures for the retention and destruction of personal data are regulated in detail in our Company's Personal Data Retention and Destruction Policy.
3.2 Conditions for Processing Personal Data
Our Company does not process personal data without the explicit consent of the relevant person. Personal data may be processed without seeking the explicit consent of the relevant person only if one of the following conditions exists:
3.2.1 It Is Expressly Provided for in Laws
Our Company may process personal data without seeking the explicit consent of the relevant person in cases expressly provided for by laws.
3.2.2 It Is Necessary for the Protection of the Life or Physical Integrity of the Person Themself or of Another Person Who Is Unable to Express Consent Due to Actual Impossibility or Whose Consent Is Not Legally Valid
Our Company may process personal data without seeking explicit consent where consent cannot be expressed or is not valid, in order to protect the life or physical integrity of persons.
3.2.3 Processing of Personal Data of the Parties to a Contract Is Necessary, Provided That It Is Directly Related to the Establishment or Performance of the Contract
Where the processing of personal data of the parties to a contract is necessary in direct relation to the establishment or performance of the contract, our Company may, in the ordinary course of life and limited to this purpose, process the personal data of the relevant persons without seeking explicit consent.
3.2.4 It Is Necessary for Our Company to Fulfill Its Legal Obligation
Our Company, as the data controller, may process the personal data of the relevant person without seeking explicit consent where this is necessary to fulfill its legal obligations.
3.2.5 The Data Has Been Made Public by the Relevant Person Themself
Our Company may process personal data that has been made public by the relevant persons themselves, in other words, disclosed to the public in any way, limited to the purpose of making it public, since the legal interest requiring protection in the processing of such data, which has been made public by the relevant persons and has thus become knowable by everyone, is deemed to have disappeared.
3.2.6 Data Processing Is Necessary for the Establishment, Exercise or Protection of a Right
Our Company may process the personal data of relevant persons without seeking explicit consent where data processing is necessary for the exercise or protection of a legally legitimate right.
3.2.7 Data Processing Is Necessary for the Legitimate Interests of Our Company, Provided That It Does Not Harm the Fundamental Rights and Freedoms of the Relevant Persons
Our Company may process the personal data of relevant persons where the processing of personal data is necessary for ensuring its legitimate interests, provided that it does not harm the fundamental rights and freedoms of relevant persons protected within the scope of the Law and the Policy. Our Company shows the necessary sensitivity in complying with the basic principles on the protection of personal data and in observing the balance of interests between our Company and personal data subjects. By legitimate interest is meant an interest that is legitimate, effective enough to compete with the fundamental rights and freedoms of the relevant person, specific and already existing. Our Company takes additional protective measures to ensure that the rights of the relevant person are not harmed. A reasonable balance is maintained between our Company's interest and the fundamental rights and freedoms of the relevant person.
3.3 Conditions for Processing Special Categories of Personal Data
Our Company processes special categories of personal data in the presence of the cases listed below;
a) The explicit consent of the relevant person exists,
b) It is expressly provided for in laws,
c) It is necessary for the protection of the life or physical integrity of the person themself or of another person who is unable to express consent due to actual impossibility or whose consent is not legally valid,
ç) It relates to personal data made public by the relevant person and is in line with the will of making it public,
d) It is necessary for the establishment, exercise or protection of a right,
e) It is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services, by persons under an obligation of confidentiality or by authorized institutions and organizations,
f) It is necessary for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance,
g) It concerns current or former members and affiliates of foundations, associations and other non-profit organizations or formations established for political, philosophical, religious or trade union purposes, or persons who are in regular contact with these organizations and formations, provided that it complies with the legislation they are subject to and with their purposes, is limited to their fields of activity and is not disclosed to third parties.
3.4 Conditions for Transferring Personal Data
Our Company may transfer personal data to third parties, by taking the necessary security measures and on a limited basis, based on one or more of the personal data processing conditions specified below under Article 8 of the Law:
- The explicit consent of the relevant person exists,
- There is an explicit provision in laws regarding the transfer of the personal data,
- The transfer of personal data is necessary for the protection of the life or physical integrity of the relevant person or of another person, and the relevant person is unable to express consent due to actual impossibility or their consent is not legally valid,
- The transfer of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract,
- The transfer of personal data is necessary for our Company to fulfill its legal obligation,
- The personal data has been made public by the relevant person,
- The transfer of personal data is necessary for the establishment, exercise or protection of a right,
- The transfer of personal data is necessary for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the relevant person.
Our Company may transfer special categories of personal data if the personal data subject has given explicit consent, or, by taking the necessary security measures and adequate precautions, on a limited basis and based on one of the conditions listed in Article 8 of the Law.
4. PERSONAL DATA CATEGORIES AND DATA SUBJECT GROUPS
4.1 Personal Data Categories
Personal data is processed by our Company by being categorized as follows:
| Identity | Data containing information about the identity of personal data subjects: Name-surname, T.C. identity number, marital status, parents' names and surnames, place and date of birth, gender and other identity information, and copies of driver's licenses, identity cards and passports containing this information; tax number, social security number, signature information, etc. |
| Contact | Contact information of personal data subjects: Telephone number, address, e-mail address, fax number, etc. |
| Location | Information relating to the location of personal data subjects: Location information that can be obtained while using vehicles or devices belonging to the Company; location data that can be obtained through systems such as OGS (automatic toll collection), vehicle recognition and meal cards. |
| Personnel File | Information processed to obtain the information that will form the basis for protecting the personnel rights of personal data subjects: Registration number, title, unit information; social security/retirement information; salary information, driver's license, military service and leave information, etc. |
| Legal Action | Data processed within the scope of the determination and pursuit of the Company's legal receivables and rights, the performance of its debts, and its legal obligations: Signature circular, contract information, power of attorney information, court and administrative authority decisions, information on receivables and rights. |
| Physical Premises Security | Personal data relating to records and documents taken upon entry to and while inside the Company's physical premises: Entry-exit records, magnetic card records, security camera records, vehicle license plate, etc. |
| Transaction Security | Personal data processed regarding the technical, administrative, legal and commercial security of both the personal data subject and the Company while carrying out Company activities: IP address information, website login-logout (traffic) information, internet access records, password and passcode information, etc. |
| Finance | Personal data processed relating to information, documents and records showing the outcome of any kind of financial relationship established by the Company with personal data subjects, as well as bank account information, credit card information, financial profile, assets and insurance information, etc. |
| Professional Experience | Training/course/certificate information, reference information, driver's license information, foreign language information and similar data recorded during and after the hiring process of personal data subjects. |
| Visual and Audio Recordings | Photographs, camera and audio recordings of personal data subjects that may be taken outside the scope of physical premises security, and other documents to which this data is transferred: Photographs attached to information forms, call center recordings, video interview and meeting recordings, etc. |
| SPECIAL CATEGORIES OF PERSONAL DATA | |
| Health Information | Health data of personal data subjects: Examination information, medical reports, health leaves, blood type information, etc. |
| Criminal Convictions and Security Measures | Information on criminal convictions of personal data subjects: Criminal record, etc. |
4.2 Data Subject Groups
Only natural persons can benefit from the protection of this Policy and the Law. Personal data subjects within this scope are grouped as follows:
| Employee Candidate | Natural persons who have applied for a job at our Company in any way or who have made their résumé and related information available for our Company's review. |
| Shareholder/Partner | Persons who are shareholders/partners of Organo Tarım Teknolojileri Sanayi ve Ticaret A.Ş. |
| Potential Product or Service Recipient | Natural persons who have requested or shown interest in using our products and services, or who have been assessed, in accordance with commercial custom and the rules of good faith, as possibly having such interest. |
| Intern | Natural persons who undertake a period of practical learning at our Company in order to develop their professional knowledge and gain experience. |
| Supplier Employee | Employees, whose identity is identified/identifiable, of natural or legal persons who provide inputs, raw materials or products to our Company in order to offer a product or service. |
| Supplier Official | Officials of natural or legal persons who provide inputs, raw materials or products to our Company in order to offer a product or service. |
| Persons Receiving Products or Services | Natural persons who use or have used the products and services offered by our Company, regardless of whether they have any contractual relationship with our Company. |
| Reference Persons | Reference persons who do not fall within the scope of the Organo Tarım Teknolojileri Sanayi ve Ticaret A.Ş. Policy on the Processing and Protection of Personal Data for Employees prepared for Company employees, and who do not fall into any data subject group in this Policy. |
| Visitor | All natural persons who have entered the physical premises owned by our Company for various purposes or who visit our websites for any purpose. |
5. METHOD OF COLLECTING PERSONAL DATA AND LEGAL BASIS
5.1 Method of Collecting Personal Data
Our Company collects personal data, in line with the purposes specified in article 6.1, wholly or partly by automated or non-automated means; in any oral, written or electronic medium; through the following channels, without being limited to them:
- Job application forms,
- Customer information forms,
- Various documents submitted to the Company,
- Mail and e-mails sent to the Company,
- Internal Company documents (Interview Evaluation Reports, Human Resources Forms, General Assembly/Board of Directors Documents, Signature Circular, Forms Specified in Company Regulations, etc.)
- Call center,
- Company website,
- Social media tools,
- Third parties such as persons and companies to which the Company provides services or from which it receives services, business partners, subcontractors, firms from which it procures services/products, and group companies,
- Employment agencies and job search portals,
- Corporate communication accounts and devices,
- Software, IT systems and devices used by the Company,
- Security cameras,
- GPS, OGS, vehicle recognition and similar systems. (For Company Shareholders/Partners, Business Partner Officials, Business Partner Employees, Company Officials)
5.2 Legal Basis for Collecting Personal Data
Our Company collects personal data based on one of the legal grounds specified below, under Articles 5 and 6 of the Law:
- The explicit consent of the relevant person,
- It is expressly provided for in laws;
- The personal data has been made public by the relevant person themself,
- Processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of the contract,
- It is necessary for our Company to be able to fulfill its legal obligation,
- Data processing is necessary for the establishment, exercise or protection of a right,
- Data processing is necessary for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the relevant persons.
6. PURPOSES OF PROCESSING PERSONAL DATA
6.1 Matching Data Subject Groups with the Processing Purposes Relating to Personal Data Categories
The matching of the data subject groups, whose definitions and scope are given above, with the processing purposes relating to personal data categories is presented below: (Natural persons can be included in only one person group.)
Employee Candidate
Data Categories: Identity, Contact, Personnel File, Professional Experience, Health, Criminal Convictions and Security Measures, Visual and Audio Recordings,
Processing Purposes: Carrying out Employee Candidate/Intern Selection and Placement Processes, Carrying out Employee Candidates' Application Processes, Carrying out Communication Activities, Carrying out Audit/Ethics Activities
Company Shareholder/Partner
Data Categories: Identity, Contact, Location, Personnel File, Legal Action, Physical Premises Security, Transaction Security, Finance, Professional Experience, Visual and Audio Recordings, Health Information
Processing Purposes: Carrying out Finance and Accounting Affairs, Carrying out Activities in Compliance with Legislation, Carrying out Fringe Benefits and Interests Processes, Carrying out Investment Processes, Providing Information to Authorized Persons/Institutions and Organizations, Follow-up and Conduct of Legal Affairs, Carrying out Communication Activities, Carrying out Emergency Management Processes, Carrying out/Auditing Business Activities, Carrying out Contract Processes, Carrying out Audit/Ethics Activities, Carrying out Assignment Processes, Planning Human Resources Processes, Carrying out Occupational Health/Safety Activities, Carrying out Emergency Management Processes, Carrying out Management Activities, Ensuring Physical Premises Security
Potential Product or Service Recipients
Data Categories: Identity, Contact, Physical Premises Security, Visual and Audio Recordings
Processing Purposes: Carrying out goods/services sales processes, Carrying out customer relationship management processes, Carrying out marketing analysis work, Carrying out product/service marketing processes, Carrying out/auditing business activities, Carrying out communication activities, Carrying out contract processes,
Intern
Data Categories: Identity, Contact, Personnel File, Health, Criminal Convictions and Security Measures, Visual and Audio Recordings, Finance, Location, Physical Premises Security
Processing Purposes: Carrying out Employee Candidate/Intern Selection and Placement Processes, Carrying out Communication Activities, Carrying out Emergency Management Processes, Carrying out/Auditing Business Activities, Carrying out Activities in Compliance with Legislation, Carrying out Performance Evaluation Processes, Carrying out Audit/Ethics Activities, Ensuring Physical Premises Security, Carrying out Finance and Accounting Affairs, Fulfilling Obligations Arising from the Employment Contract/Legislation for Employees, Carrying out Information Security Processes, Carrying out access authorizations, Follow-up and Conduct of Legal Affairs, Providing Information to Authorized Persons/Institutions and Organizations
Supplier Official
Data Categories: Identity, Contact, Finance, Physical Premises Security, Legal Action, Visual and Audio Recordings
Processing Purposes: Carrying out Activities in Compliance with Legislation, Carrying out Contract Processes, Carrying out/Auditing Business Activities, Carrying out Communication Activities, Carrying out Finance and Accounting Affairs, Ensuring Physical Premises Security, Carrying out Audit/Ethics Activities, Follow-up of Requests/Complaints, Follow-up and Conduct of Legal Affairs, Providing Information to Authorized Persons/Institutions and Organizations
Supplier Employee
Data Categories: Identity, Contact, Physical Premises Security, Visual and Audio Recordings
Processing Purposes: Carrying out/Auditing Business Activities, Carrying out Goods/Services Procurement Processes, Carrying out Goods/Services/Production and Operation Processes, Carrying out Communication Activities, Ensuring Physical Premises Security, Carrying out Audit/Ethics Activities, Follow-up of Requests/Complaints, Follow-up and Conduct of Legal Affairs, Carrying out Activities in Compliance with Legislation, Providing Information to Authorized Persons/Institutions and Organizations, Carrying out Contract Processes
Person Receiving Products or Services
Data Categories: Identity, Contact, Legal Action, Customer Transaction, Physical Premises Security, Finance, Visual and Audio Recordings
Processing Purposes: Carrying out Finance and Accounting Affairs, Carrying out Activities in Compliance with Legislation, Carrying out Communication Activities, Carrying out/Auditing Business Activities, Carrying out Contract Processes, Carrying out Goods / Services Sales Processes, Carrying out After-Sales Support Services for Goods / Services, Carrying out Customer Relationship Processes, Carrying out Activities Relating to Customer Satisfaction, Carrying out Processes for Loyalty to the Company/Products/Services, Follow-up of Requests/Complaints, Carrying out Goods/Services/Production and Operation Processes, Carrying out Audit/Ethics Activities, Follow-up and Conduct of Legal Affairs, Providing Information to Authorized Persons/Institutions and Organizations
Visitor
Data Categories: Identity, Contact, Physical Premises Security, Transaction Security, Visual and Audio Recordings
Processing Purposes: Ensuring Physical Premises Security, Creating and Following Up Visitor Records, Carrying out Audit/Ethics Activities, Carrying out Information Security Processes, Carrying out Activities in Compliance with Legislation
Reference Persons
Data Categories: Identity, Contact, Personnel File (title information)
Processing Purposes: Carrying out Employee Candidate/Intern Selection and Placement Processes, Carrying out Employee Candidates' Application Processes, Carrying out Communication Activities, Carrying out Audit/Ethics Activities
6.2 Personal Data Processing Activities Carried Out in Physical Premises
Camera monitoring is carried out in our Company's work areas in order to ensure security. There are notices in the areas where camera monitoring is carried out.
Records relating to internet access provided at our Company are recorded in accordance with Law No. 5651 on the Regulation of Publications Made on the Internet and Combating Crimes Committed Through Such Publications, and other legislation; these records may be shared with authorized public institutions and organizations upon request and may be used, when necessary, to fulfill the relevant legal obligation in audit activities.
6.3 Personal Data Processing Activities Carried Out on the Website
Traffic information of online visitors who visit our website is processed automatically for the purpose of carrying out information security processes. On the other hand, under Law No. 5651 and other legislation, hosting providers have an obligation to record and retain website traffic information.
Detailed explanations regarding personal data processed through the website are available on the relevant website.
6.4 Personal Data Processing Activities Carried Out Through Communication Channels
Communications made through channels such as the call center, mail and e-mail are monitored and recorded by our Company for the purposes of carrying out/auditing business activities and following up requests/complaints.
Relevant persons are required to use these channels only within the scope of business activities.
7. PURPOSES OF TRANSFER OF PERSONAL DATA AND PERSONS/ORGANIZATIONS TO WHICH IT IS TRANSFERRED
7.1 Purposes of Transfer of Personal Data
Our Company transfers personal data, within the framework of the conditions specified in Articles 8 and 9 of the Law, limited to the following purposes:
- Carrying out Emergency Management Processes
- Carrying out Information Security Processes
- Carrying out Audit / Ethics Activities
- Organizing Training Activities
- Carrying out Activities in Compliance with Legislation
- Carrying out Finance and Accounting Activities
- Carrying out Assignment Processes
- Follow-up and Conduct of Legal Affairs
- Carrying out Communication Activities
- Fulfilling Obligations Arising from the Employment Contract/Legislation
- Carrying out/Auditing Business Activities
- Carrying out Occupational Health/Safety Activities
- Carrying out Quality Control Activities
- Carrying out Logistics Activities
- Carrying out Processes for Loyalty to the Company / Products / Services
- Carrying out Goods / Services Sales Processes
- Carrying out Goods/Services Production and Operation Processes
- Carrying out Customer Relationship Management Processes
- Carrying out Activities Aimed at Customer Satisfaction
- Responding to Customer Complaints/Requests
- Organization and Event Management
- Carrying out Retention and Archive Activities
- Carrying out Contract Processes
- Carrying out Marketing Processes for Products / Services
- Follow-up of Requests / Complaints
- Ensuring the Security of Movable Property and Resources
- Carrying out Supply Chain Management Processes
- Ensuring the Security of Data Controller Operations
- Carrying out Fringe Benefits and Interests Processes
- Carrying out Investment Processes
- Providing Information to Authorized Persons/Institutions and Organizations
- Carrying out Management Activities
7.2 Persons/Organizations to Which Personal Data Is Transferred
Our Company may transfer personal data to the persons and organizations specified below, limited to the data subject groups and data required by the purpose of transfer:
- Shareholders,
- Business Partners,
- Suppliers,
- Authorized public institutions and organizations
- Natural persons or private law legal entities (organizations with which the Company cooperates in order to fulfill its contractual or legal obligations: Independent audit firms, insurance companies, law firms, banks, etc.)
8. DESTRUCTION OF PERSONAL DATA AND RETENTION PERIODS
8.1 Destruction of Personal Data
Without prejudice to the provisions on the destruction of personal data in other laws, if the reasons requiring the processing of personal data processed in accordance with this Law and other legal provisions no longer exist, our Company deletes, destroys or anonymizes such data, ex officio or upon the request of the relevant person, in accordance with the Personal Data Retention and Destruction Policy.
Deletion of personal data refers to the process of making personal data inaccessible and unusable in any way for relevant users.
Destruction of data refers to the process of making personal data inaccessible, irretrievable and unusable by anyone in any way.
Anonymization of data refers to the process of making personal data impossible to associate in any way with an identified or identifiable natural person, even when matched with other data, through techniques such as masking, variable extraction and generalization.
8.2 Retention Periods of Personal Data
Our Company retains personal data for the periods stipulated in laws and other legislation. If there is no retention period stipulated in laws and other legislation, personal data is retained, in accordance with our Company's Personal Data Retention and Destruction Policy, for the period required for the purpose of processing that personal data to be fulfilled, and is then deleted, destroyed or anonymized within the framework of periodic destruction periods.
9. INFORMING THE PERSONAL DATA SUBJECT AND THEIR RIGHTS UNDER THE KVK LAW
9.1 Informing the Relevant Person
In accordance with Article 10 of the KVK Law, our Company informs relevant persons at the time personal data is obtained. In this scope, it clarifies the identity of the Company representative, if any, the purpose for which personal data will be processed, to whom and for what purpose the processed personal data may be transferred, the method and legal basis of collecting personal data, and the rights the relevant person has.
9.2 Cases in Which the Policy and the Law Will Not Apply, Wholly or Partly
The provisions of this Policy and the Law will not apply in the following cases:
- Processing of personal data by natural persons within the scope of activities entirely related to themselves or to family members living in the same dwelling, provided that the data is not given to third parties and the obligations regarding data security are complied with,
- Processing of personal data for purposes such as research, planning and statistics by anonymizing it with official statistics,
- Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public safety, public order, economic security, the privacy of private life or personal rights, and does not constitute a crime,
- Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations vested with duties and powers by law to ensure national defense, national security, public safety, public order or economic security,
- Processing of personal data by judicial authorities or execution authorities in relation to investigation, prosecution, trial or execution proceedings.
Provided that it is in line with and proportionate to the purpose and basic principles of this Policy and the Law, Article 10, which regulates the data controller's obligation to inform, Article 11, which regulates the rights of the relevant person (except for the right to claim compensation for damage), and Article 16, which regulates the obligation to register with the Data Controllers' Registry, will not apply in the following cases:
- Where the processing of personal data is necessary for the prevention of crime or for a criminal investigation,
- Processing of personal data made public by the relevant person themself,
- Where the processing of personal data is necessary for the performance of supervisory or regulatory duties and for disciplinary investigations or prosecutions by authorized and competent public institutions and organizations and professional organizations in the nature of public institutions, based on the authority granted by law,
- Where the processing of personal data is necessary for the protection of the State's economic and financial interests with respect to budgetary, tax and financial matters.
9.3 Rights of the Relevant Person Under the KVK Law
Under Article 10 of the Law, our Company informs relevant persons of their rights, provides guidance on how to exercise these rights, and puts in place the internal operations and administrative and technical arrangements necessary for all of this. The rights that persons whose personal data is processed have under Article 11 of the Law are listed below:
- To learn whether their personal data is processed,
- To request information if their personal data has been processed,
- To learn the purpose of processing their personal data and whether it is used in accordance with that purpose,
- To know the third parties to whom their personal data is transferred, in Türkiye or abroad,
- To request the correction of their personal data if it is incomplete or inaccurately processed,
- To request the deletion or destruction of their personal data within the framework of the conditions stipulated in Article 7 of the Law,
- To request that the actions taken under subparagraphs (d) and (e) of Article 11 of the Law (correction and destruction) be notified to the third parties to whom their personal data has been transferred,
- To object to the occurrence of a result against the person themself by analysis of the processed data exclusively through automated systems,
- To request compensation for the damage if they suffer damage due to unlawful processing of their personal data.
Requests and applications under Article 11 of the Law, which regulates the rights of the relevant person, may be delivered in person in writing to the address "Doğanca Köyü 3. Sokak No.17 İç Kapı No. 1 Sivas" by filling in the application form available on our website (www.fergo.com), may be sent through a notary, or may be submitted via registered electronic mail (KEP) to [email protected].
In requests and applications,
- Name, surname and, if the application is in writing, signature,
- For citizens of the Republic of Türkiye, T.C. identity number; for foreigners, nationality, passport number or identity number, if any,
- Place of residence or workplace address for notification,
- Electronic mail address, telephone and fax number for notification, if any,
- Subject of the request
must be included.
Information and documents relating to the subject must be attached to the application
Our Company concludes the requests in the application free of charge, depending on the nature of the request, as soon as possible and at the latest within thirty days. However, if the process requires an additional cost, the fee in the tariff determined by the Board may be charged.
Our Company may accept the request submitted to it or may reject it by explaining its reasons, and notifies the relevant person of its response in writing or electronically. If the request in the application is accepted, our Company fulfills its requirements as soon as possible and informs the relevant person. If the application arises from our Company's error, the fee charged is refunded to the relevant person.
In cases where the application is rejected, the response given is found insufficient, or the application is not responded to within the period, the relevant person has the right to file a complaint with the Board within thirty days from the date they learn of the response and in any case within sixty days from the date of application.