Privacy Notice Regarding Communication

IC İÇTAŞ – PRIVACY NOTICE FOR THOSE WHO CONTACT US

INTRODUCTION

This Information Notice for Those Who Contact Us (“Information Notice”); IC İçtaş Construction Industry and Trade Joint Stock Company, located at Merkez Mahallesi, Silahşör Cad., Hilton Otel Apt., No: 42/1, Şişli, Istanbul, operating under Tax Identification Number (VKN) 4700005438 (“IC İçtaş”), is prepared to ensure that the personal data of visitors who contact us is processed in accordance with the Constitution of the Republic of Turkey, international treaties related to human rights to which our country is a party, and the Law No. 6698 on the Protection of Personal Data (“KVKK”), as well as relevant legislation, and to ensure that data subjects can effectively exercise their rights. All personal data shared with IC İçtaş will be processed in a lawful manner, in a way that is relevant to and proportionate to our business activities and services.

Definitions

The terms “personal data,” “sensitive personal data,” and “data processing” used in this Privacy Notice are based on the definitions provided in the KVKK. The concept of “personal data” as defined in the KVKK refers to any information relating to an identified or identifiable natural person; the concept of “processing of personal data” refers to the collection, stored, retained, modified, reorganized, disclosed, transferred, acquired, made accessible, classified, or restricted from use.

Principles of Personal Data Processing

Pursuant to Article 4 of the Personal Data Protection Law (KVKK), personal data belonging to the data subject shall be processed by the data controller, IC İçtaş, in accordance with the following principles: in compliance with the law and the principles of good faith; accurate and, where necessary, up-to-date; for specific, explicit, and legitimate purposes; relevant, limited, and proportionate to the purpose for which it is processed; and in accordance with the rules regarding retention for the period prescribed by applicable legislation or as necessary for the purpose of processing, by the data controller, IC İçtaş, within the scope of the purposes specified below.

Personal Data Being Processed

IC İçtaş processes your Identity Information (First Name, Last Name) and Contact Information (Email Address, Message, Phone Number) for the purposes specified below, provided that the data subject has given explicit consent or one of the legal grounds for processing is met.

Purposes of Processing Personal Data

IC İçtaş processes your personal data for the purposes listed below:

Conducting information security processes,
Conducting communication activities,
Conducting and auditing business operations,
Conducting storage and archiving activities,
Tracking requests and complaints,
Providing information to authorized individuals, institutions, and organizations,

Conducting management activities, will be processed in accordance with the conditions for personal data processing specified in Articles 5 and 6 of the KVKK. In the event of any changes to the purposes of personal data processing, IC İçtaş reserves the right to amend this Privacy Notice at any time.

Transfer of Your Personal Data

IC İçtaş acts in accordance with the regulations set forth in the KVKK regarding the transfer of personal data. Subject to the provisions of the law or the exceptional cases listed below, your personal data will not be transferred by us to other natural or legal persons without the Data Subject’s explicit consent. In the exceptional cases provided for by the KVKK and other applicable legislation, we exercise the utmost care to ensure that the transfer of personal data to authorized administrative or judicial bodies or private organizations is carried out in accordance with the forms and limitations set forth in the legislation.

Your personal data;

To authorized public institutions and organizations, as well as private individuals legally authorized, for the purpose of fulfilling legal obligations;
To relevant judicial authorities, including attorneys, for the purpose of conducting or ensuring the follow-up of judicial proceedings; may be transferred in accordance with the procedures and principles set forth in the relevant legislation and in compliance with the conditions and purposes for the transfer of personal data specified in Articles 8 and 9 of the KVKK.

Method and Legal Basis for the Collection of Personal Data/Sensitive Personal Data

Your personal data may be collected through semi-automated methods via the “Contact Form” available on our website.

The legal grounds for the processing of your personal data by IC İçtaş are the exceptions to the requirement of explicit consent specified in Articles 5/2/c, 5/2/ç, 5/2/d, 5/2/e, and 5/2/f of the KVKK. Your personal data is collected by IC İçtaş for the purposes specified in Articles 4 and 5 of this Privacy Notice.

Rights of the Data Subject

The data subject may contact IC İçtaş, acting as the data controller, to: learn whether their personal data has been processed; if so, request information regarding such processing; learn the purpose of the processing of their personal data and whether it is being used in accordance with that purpose; to be informed about third parties to whom their personal data has been transferred within or outside the country; to request the correction of their personal data if it has been processed incompletely or incorrectly; to request the erasure or destruction of their personal data under the conditions specified in Article 7 of the KVKK; to request that the actions taken pursuant to Article 11/d and Article 11/e of the KVKK be notified to the third parties to whom their personal data has been transferred; to object to a decision made solely through the automated processing of their personal data that adversely affects them; the right to request compensation for damages incurred as a result of the unlawful processing of personal data.

In accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller, applications submitted by you must include your first name, last name, signature (if the application is in writing) or an electronic signature or mobile signature (if submitted electronically), Turkish ID number (TCKN), the residential or business address for service of notice, the email address for notification (if any), phone number, and information regarding the subject of the request. To exercise the rights specified above, the data subject is required to clearly and comprehensibly state the matter being requested in the application—which must include an explanation of the relevant right—and to attach the necessary information and documents to the application.

Such applications must be submitted:

submitted in person, by hand, or in writing to IC İçtaş at “Merkez Mahallesi Silahşör Cad. Hilton Otel Apt. No: 42/1 Şişli/İstanbul,”
through a notary public to IC İçtaş at the address “Merkez Mahallesi Silahşör Cad. Hilton Otel Apt. No: 42/1 Şişli/İstanbul,”
or to IC İçtaş’s previously notified KEP address ([email protected]), which is registered in IC İçtaş’s system.

İÇTAŞ CONSTRUCTION, INDUSTRY, AND TRADE CORPORATION

PRIVACY NOTICE REGARDING THE PROCESSING OF YOUR PERSONAL DATA

As İçtaş Construction, Industry, and Trade Joint Stock Company (“the Company”), we place the utmost importance on ensuring the security of your personal data. In this context, in accordance with the Personal Data Protection Law No. 6698 (“PDPA”), during the processing of your personal data and its transfer to third parties, we take the necessary measures to ensure an appropriate level of security to prevent the unlawful processing of your personal data and unlawful access to your personal data, and to ensure the protection of your personal data. For this reason, this document has been prepared to inform data subjects.

This document will be updated if the entire text or specific provisions of this document, prepared by our company, are revised.

1. DATA CONTROLLER:

As a company, we are the legal entity that determines the purposes and means of processing your personal data and is responsible for establishing and managing the data processing system. Upon your explicit consent to the processing of your personal data—or, in cases where explicit consent is not required, following the information we provide—our Company will begin processing your personal data while ensuring data security. While processing your personal data, we may also have one or more data processors process your personal data on our behalf, provided that we ensure the necessary level of security by authorizing them.

2. THE LEGAL BASIS FOR THE PROCESSING OF YOUR PERSONAL DATA, THE METHODS BY WHICH IT MAY BE COLLECTED, AND WHAT PERSONAL DATA WILL BE PROCESSED:

Your personal data will be processed by our Company in accordance with the provisions of applicable legislation to provide the services to be rendered and to improve the quality of these services; to carry out activities required by public authorities and/or those deemed exempt; to fulfill the Company’s operational obligations; and for data storage, reporting, and to comply with information disclosure obligations. Additionally, to enable you to visit our Company, to protect security and legitimate interests related to your visit, to offer our Company’s products and services, to establish communication regarding the products and services you have received or will receive, and to provide services related to our Company’s business activities—such as product/service offers, modeling, reporting, scoring, and risk monitoring—as well as to enhance the quality of these services, carry out other activities, and comply with disclosure obligations.

For this purpose, we may share the personal data we process with our affiliates, business partners, suppliers, company officials, shareholders, group companies, and public institutions and private individuals authorized by law, both within Turkey and abroad.

3. SHARING OF YOUR PERSONAL DATA:

Your personal data may be collected verbally, in writing, or electronically—in accordance with the provisions of applicable legislation—through our Company, our affiliates, our business partners, and our employees, as well as via our website, social media channels, and any other means.

This information notice serves as an annex and an integral part of any contract you have signed with our Company and of your requests for the provision of services.

4. DISPOSAL OF YOUR PERSONAL DATA:

Our Company retains your processed personal data for the periods specified by law. However, if the applicable legislation does not specify a retention period for your personal data, your personal data will be retained for as long as necessary to process such data in accordance with our Company’s practices and commercial customs related to the services provided, and thereafter only for the periods deemed necessary in practice to serve as evidence in potential legal disputes. Upon the expiration of the specified periods, in accordance with Article 7 of the Personal Data Protection Law, your personal data in question will be deleted, destroyed, or anonymized as of the first scheduled disposal date.

5. YOUR RIGHTS REGARDING THE PROCESSING OF YOUR PERSONAL DATA:

Under Article 11 of the Personal Data Protection Law, you may submit the following requests to our Company by contacting us:

To learn whether your personal data has been processed and, if so, to request information regarding such processing,
To learn the purpose of the processing of your personal data and whether it is being used in accordance with that purpose,
To learn the third parties to whom your personal data has been transferred, both domestically and internationally,
To request the correction of your personal data if it has been processed incompletely or incorrectly,
To request that your personal data be erased, destroyed, or anonymized if the grounds for processing your personal data under Article 7 of the Personal Data Protection Law no longer exist,
To request that the actions taken pursuant to subparagraphs (d) and (e) be notified to the third parties to whom your personal data has been transferred,
To object to a decision made solely through the automated processing of your personal data that adversely affects you,
To request compensation for damages incurred as a result of the unlawful processing of your personal data.

You may exercise the rights listed above in accordance with the Personal Data Protection Law, the provisions of the “Communication on the Procedures and Principles for Applications to the Data Controller” published on March 10, 2018, and relevant current legislation by using the application form available at www.ictas.com.tr;

by submitting a handwritten, signed petition in person to the address: Merkez Mahallesi, Silahşör Caddesi, Hilton Hotel, No. 42/1, Şişli/Istanbul, or by having it sent to this address via a notary public,
Via Registered Electronic Mail to the address [email protected],
By email to [email protected], including a secure electronic signature or mobile signature,

Information regarding the specific application channels through which your applications can be submitted to us is provided below.

Application Method	Address for Submission (in the event of an address change, the most recent address published in the Commercial Registry Gazette must be used)	Information to Be Included in the Submission
In-Person Application (The applicant must appear in person and submit the application with a valid identification document)	Merkez Mahallesi, Silahşör Caddesi, Hilton Hotel, No. 42/1, Şişli/Istanbul	The envelope must be marked “Request for Information Under the Law on the Protection of Personal Data.”
Service of Process via Notary	Merkez Neighborhood, Silahşör Street, Hilton Hotel, No. 42/1, Şişli/Istanbul	The service envelope must be marked “Request for Information Under the Personal Data Protection Law.”
Via Registered Electronic Mail (KEP)	[email protected]	The subject line of the email must read “Request for Information Under the Law on the Protection of Personal Data.”
Via email, including a secure electronic signature or mobile signature	[email protected]	The subject line of the email must read “Request for Information Under the Law on the Protection of Personal Data.”

If a request is submitted by someone other than the data subject, a notarized special power of attorney issued by the data subject in the name of the person making the request must be provided.

Requests submitted to our Company in accordance with these procedures will be processed within thirty days at the latest. If the resolution of your request entails additional costs, our Company will charge the applicant a fee in accordance with the schedule established by the Personal Data Protection Board (“Board”). If our Company responds to your request via a storage medium such as a CD or flash drive, a fee may be charged that does not exceed the cost of the storage medium.

Our Company may request the necessary information and documents from you to determine whether you are the actual owner of the personal data in question, and may ask you questions regarding your request to clarify the matters stated therein.

Our company may reject your request, providing an explanation of the grounds, in the following cases:

The processing of your personal data for purposes such as research, planning, and statistics by anonymizing it through official statistics.
The processing of your personal data for artistic, historical, literary, or scientific purposes, or within the scope of freedom of expression, provided that such processing does not violate national defense, national security, public safety, public order, economic security, the privacy of private life, or personal rights, nor constitutes a crime.
The processing of your personal data within the scope of preventive, protective, and intelligence activities conducted by public institutions and organizations authorized by law to ensure national defense, national security, public safety, public order, or economic security.
The processing of your personal data by judicial authorities or enforcement agencies in connection with investigations, prosecutions, trials, or enforcement proceedings.
The processing of your personal data where it is necessary to prevent the commission of a crime or for the investigation of a crime.
The processing of your personal data that you have made public.
The processing of your personal data is necessary for the performance of supervisory or regulatory duties, or for disciplinary investigations or proceedings, by competent and authorized public institutions and organizations, as well as professional organizations with the status of public institutions, based on the authority granted by law.
The processing of your personal data is necessary to protect the State’s economic and financial interests regarding budgetary, tax, and financial matters.
There is a possibility that your request may infringe upon the rights and freedoms of others.
You have made requests that would require a disproportionate amount of effort on our part.
The information you have requested is publicly available.

Our Company will notify you of its response to your request in writing or electronically. In accordance with Article 14 of the Personal Data Protection Law, if your request is rejected, if you deem the response provided by our Company to be insufficient, or if no response is provided within the prescribed timeframe; You may file a complaint with the Board within 30 (thirty) days from the date you receive our response—or, if we fail to respond, from the expiration of the response period—and in any case, within 60 (sixty) days from the date of your request.

APPENDIX 1: Categories of Personal Data

Identity Information	Information clearly belonging to an identified or identifiable natural person; processed either partially or fully automatically, or non-automatically as part of a data recording system; such as a driver’s license, national ID card, residence permit, passport, attorney’s ID, marriage certificates
Contact Information	Information that clearly pertains to an identified or identifiable natural person; processed either partially or fully automatically, or non-automatically as part of a data recording system; such as phone number, address, and email address
Physical Premises Security Information	Personal data clearly belonging to an identified or identifiable natural person and contained within a data recording system; personal data related to records and documents collected upon entry to a physical location or during the stay within that physical location
Transaction security information	Personal data clearly belonging to an identified or identifiable natural person and contained within the data recording system; your personal data processed for the purpose of ensuring compliance with technical, administrative, legal, and commercial obligations while conducting our business activities
Risk management information	Personal data clearly belonging to an identified or identifiable natural person and contained within the data recording system; personal data processed through methods used in accordance with generally accepted legal, commercial practices, and the principle of good faith in these areas to enable us to manage our commercial, technical, and administrative risks
Financial information	Personal data clearly attributable to an identified or identifiable natural person, processed either partially or fully automatically or non-automatically as part of a data recording system; personal data of subcontractors, supplier representatives, or employees relating to information, documents, and records reflecting the data subject’s financial status

IC İÇTAŞ – PRIVACY NOTICE FOR THOSE WHO CONTACT US

INTRODUCTION

Privacy Preferences