Board of Directors

İÇTAŞ CONSTRUCTION, INDUSTRY, AND TRADE CORPORATION

PRIVACY NOTICE REGARDING THE PROCESSING OF YOUR PERSONAL DATA

As İçtaş Construction, Industry, and Trade Joint Stock Company (“the Company”), we place the utmost importance on ensuring the security of your personal data. In this context, in accordance with the Personal Data Protection Law No. 6698 (“PDPA”), during the processing of your personal data and its transfer to third parties, we take the necessary measures to ensure an appropriate level of security to prevent the unlawful processing of your personal data and unlawful access to your personal data, and to ensure the protection of your personal data. For this reason, this document has been prepared to inform data subjects.

This document will be updated if the entire text or specific provisions of this document, prepared by our company, are revised.

1. DATA CONTROLLER:

As a company, we are the legal entity that determines the purposes and means of processing your personal data and is responsible for establishing and managing the data processing system. Upon your explicit consent to the processing of your personal data—or, in cases where explicit consent is not required, following the information we provide—our Company will begin processing your personal data while ensuring data security. While processing your personal data, we may also have one or more data processors process your personal data on our behalf, provided that we ensure the necessary level of security by authorizing them.

2. THE LEGAL BASIS FOR THE PROCESSING OF YOUR PERSONAL DATA, THE METHODS BY WHICH IT MAY BE COLLECTED, AND WHAT PERSONAL DATA WILL BE PROCESSED:

Your personal data will be processed by our Company in accordance with the provisions of applicable legislation to provide the services to be rendered and to improve the quality of these services; to carry out activities required by public authorities and/or those deemed exempt; to fulfill the Company’s operational obligations; and for data storage, reporting, and to comply with information disclosure obligations. Additionally, to enable you to visit our Company, to protect security and legitimate interests related to your visit, to offer our Company’s products and services, to establish communication regarding the products and services you have received or will receive, and to provide services related to our Company’s business activities—such as product/service offers, modeling, reporting, scoring, and risk monitoring—as well as to enhance the quality of these services, carry out other activities, and comply with disclosure obligations.

For this purpose, we may share the personal data we process with our affiliates, business partners, suppliers, company officials, shareholders, group companies, and public institutions and private individuals authorized by law, both within Turkey and abroad.

3. SHARING OF YOUR PERSONAL DATA:

Your personal data may be collected verbally, in writing, or electronically—in accordance with the provisions of applicable legislation—through our Company, our affiliates, our business partners, and our employees, as well as via our website, social media channels, and any other means.

This information notice serves as an annex and an integral part of any contract you have signed with our Company and of your requests for the provision of services.

4. DISPOSAL OF YOUR PERSONAL DATA:

Our Company retains your processed personal data for the periods specified by law. However, if the applicable legislation does not specify a retention period for your personal data, your personal data will be retained for as long as necessary to process such data in accordance with our Company’s practices and commercial customs related to the services provided, and thereafter only for the periods deemed necessary in practice to serve as evidence in potential legal disputes. Upon the expiration of the specified periods, in accordance with Article 7 of the Personal Data Protection Law, your personal data in question will be deleted, destroyed, or anonymized as of the first scheduled disposal date.

5. YOUR RIGHTS REGARDING THE PROCESSING OF YOUR PERSONAL DATA:

Under Article 11 of the Personal Data Protection Law, you may submit the following requests to our Company by contacting us:

To learn whether your personal data has been processed and, if so, to request information regarding such processing,
To learn the purpose of the processing of your personal data and whether it is being used in accordance with that purpose,
To learn the third parties to whom your personal data has been transferred, both domestically and internationally,
To request the correction of your personal data if it has been processed incompletely or incorrectly,
To request that your personal data be erased, destroyed, or anonymized if the grounds for processing your personal data under Article 7 of the Personal Data Protection Law no longer exist,
To request that the actions taken pursuant to subparagraphs (d) and (e) be notified to the third parties to whom your personal data has been transferred,
To object to a decision made solely through the automated processing of your personal data that adversely affects you,
To request compensation for damages incurred as a result of the unlawful processing of your personal data.

You may exercise the rights listed above in accordance with the Personal Data Protection Law, the provisions of the “Communication on the Procedures and Principles for Applications to the Data Controller” published on March 10, 2018, and relevant current legislation by using the application form available at www.ictas.com.tr;

by submitting a handwritten, signed petition in person to the address: Merkez Mahallesi, Silahşör Caddesi, Hilton Hotel, No. 42/1, Şişli/Istanbul, or by having it sent to this address via a notary public,
Via Registered Electronic Mail to the address [email protected],
By email to [email protected], including a secure electronic signature or mobile signature,

Information regarding the specific application channels through which your applications can be submitted to us is provided below.

Application Method	Address for Submission (in the event of an address change, the most recent address published in the Commercial Registry Gazette must be used)	Information to Be Included in the Submission
In-Person Application (The applicant must appear in person and submit the application with a valid identification document)	Merkez Mahallesi, Silahşör Caddesi, Hilton Hotel, No. 42/1, Şişli/Istanbul	The envelope must be marked “Request for Information Under the Law on the Protection of Personal Data.”
Service of Process via Notary	Merkez Neighborhood, Silahşör Street, Hilton Hotel, No. 42/1, Şişli/Istanbul	The service envelope must be marked “Request for Information Under the Personal Data Protection Law.”
Via Registered Electronic Mail (KEP)	[email protected]	The subject line of the email must read “Request for Information Under the Law on the Protection of Personal Data.”
Via email, including a secure electronic signature or mobile signature	[email protected]	The subject line of the email must read “Request for Information Under the Law on the Protection of Personal Data.”

If a request is submitted by someone other than the data subject, a notarized special power of attorney issued by the data subject in the name of the person making the request must be provided.

Requests submitted to our Company in accordance with these procedures will be processed within thirty days at the latest. If the resolution of your request entails additional costs, our Company will charge the applicant a fee in accordance with the schedule established by the Personal Data Protection Board (“Board”). If our Company responds to your request via a storage medium such as a CD or flash drive, a fee may be charged that does not exceed the cost of the storage medium.

Our Company may request the necessary information and documents from you to determine whether you are the actual owner of the personal data in question, and may ask you questions regarding your request to clarify the matters stated therein.

Our company may reject your request, providing an explanation of the grounds, in the following cases:

The processing of your personal data for purposes such as research, planning, and statistics by anonymizing it through official statistics.
The processing of your personal data for artistic, historical, literary, or scientific purposes, or within the scope of freedom of expression, provided that such processing does not violate national defense, national security, public safety, public order, economic security, the privacy of private life, or personal rights, nor constitutes a crime.
The processing of your personal data within the scope of preventive, protective, and intelligence activities conducted by public institutions and organizations authorized by law to ensure national defense, national security, public safety, public order, or economic security.
The processing of your personal data by judicial authorities or enforcement agencies in connection with investigations, prosecutions, trials, or enforcement proceedings.
The processing of your personal data where it is necessary to prevent the commission of a crime or for the investigation of a crime.
The processing of your personal data that you have made public.
The processing of your personal data is necessary for the performance of supervisory or regulatory duties, or for disciplinary investigations or proceedings, by competent and authorized public institutions and organizations, as well as professional organizations with the status of public institutions, based on the authority granted by law.
The processing of your personal data is necessary to protect the State’s economic and financial interests regarding budgetary, tax, and financial matters.
There is a possibility that your request may infringe upon the rights and freedoms of others.
You have made requests that would require a disproportionate amount of effort on our part.
The information you have requested is publicly available.

Our Company will notify you of its response to your request in writing or electronically. In accordance with Article 14 of the Personal Data Protection Law, if your request is rejected, if you deem the response provided by our Company to be insufficient, or if no response is provided within the prescribed timeframe; You may file a complaint with the Board within 30 (thirty) days from the date you receive our response—or, if we fail to respond, from the expiration of the response period—and in any case, within 60 (sixty) days from the date of your request.

APPENDIX 1: Categories of Personal Data

Identity Information	Information clearly belonging to an identified or identifiable natural person; processed either partially or fully automatically, or non-automatically as part of a data recording system; such as a driver’s license, national ID card, residence permit, passport, attorney’s ID, marriage certificates
Contact Information	Information that clearly pertains to an identified or identifiable natural person; processed either partially or fully automatically, or non-automatically as part of a data recording system; such as phone number, address, and email address
Physical Premises Security Information	Personal data clearly belonging to an identified or identifiable natural person and contained within a data recording system; personal data related to records and documents collected upon entry to a physical location or during the stay within that physical location
Transaction security information	Personal data clearly belonging to an identified or identifiable natural person and contained within the data recording system; your personal data processed for the purpose of ensuring compliance with technical, administrative, legal, and commercial obligations while conducting our business activities
Risk management information	Personal data clearly belonging to an identified or identifiable natural person and contained within the data recording system; personal data processed through methods used in accordance with generally accepted legal, commercial practices, and the principle of good faith in these areas to enable us to manage our commercial, technical, and administrative risks
Financial information	Personal data clearly attributable to an identified or identifiable natural person, processed either partially or fully automatically or non-automatically as part of a data recording system; personal data of subcontractors, supplier representatives, or employees relating to information, documents, and records reflecting the data subject’s financial status

Privacy Preferences