Personal Data Protection Notice (KVKK)

PERSONAL DATA PROTECTION NOTICE (KVKK)
INFORMATION NOTICE ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

At Santech, we attach great importance to the protection and security of your personal data. Accordingly, as the Data Controller, we wish to inform you as clearly as possible about how your personal data is collected, the purposes for which it is processed, the legal grounds for processing and your rights, in accordance with Law No. 6698 on the Protection of Personal Data (KVKK), which was enacted to protect the fundamental rights and freedoms of individuals, in particular the right to privacy, and to protect personal data, and with the provisions of other applicable legislation.

Personal Data: Under the KVKK, personal data means any information relating to an identified or
identifiable natural person (“Personal Data”).

1. Method of Collecting Personal Data and Purpose of Processing

Personal data is collected in connection with your dealings with Santech, for the purposes and within the scope set out below, by automated or non-automated means, verbally, in writing or electronically, and through the methods and third parties described below.

Your personal data is obtained through the information and documents you provide and is stored on the legal grounds for processing personal data set out in Articles 5 and 6 of the KVKK, such as:

• Your explicit consent,
• Processing being expressly provided for by law,
• Processing being necessary to protect the life or physical integrity of a person, or of another person, who is unable to give consent due to actual impossibility or whose consent is not legally valid,
• Processing of personal data being related to the conclusion or performance of a contract,
• Processing being necessary for us to fulfil our legal obligations,
• The data having been made public by the data subject,
• Processing being necessary for the establishment, exercise or protection of a right,
• Processing being necessary for our legitimate interests, provided that it does not harm your fundamental rights and freedoms

and similar legal grounds.

Your personal information is collected from sources such as your visits to our website and what you share in telephone or e-mail correspondence with our company. If you enter into a commercial or legal relationship with Santech, this data, in particular your identity details (name, surname, Turkish ID number, date of birth) and your contact details (e-mail address, postal address and telephone details), will be processed for the performance of the contract concluded between the parties and the fulfilment of legal obligations.

2. To Whom and for What Purpose Personal Data May Be Transferred

Where legally permitted (and within the scope of specific purposes), Santech may transfer your personal data within Turkey to natural and legal person business partners with whom we cooperate and/or from whom we receive services, including security services; to persons from whom we receive support in legal matters; to other third parties where transfer is necessary for the specified purposes; and to public institutions and organisations authorised to request such data.

3. Rights of the Data Subject under Article 11 of the KVKK

As a data subject, you may at any time request the following rights from us, as the data controller, pursuant to Article 11 of the KVKK.

In this context, your rights are as follows:

• To learn whether your personal data is being processed,
• To request information if your personal data has been processed,
• To learn the purpose of processing your personal data and whether it is used in accordance with that purpose,
• To know the third parties in Turkey or abroad to whom your personal data has been transferred,
• To request the rectification of your personal data if it has been processed incompletely or inaccurately, and to request that the third parties to whom the personal data has been transferred be notified of the action taken in this regard,
• To request, where the reasons requiring processing no longer exist despite the data having been processed in accordance with the KVKK and other applicable laws, that the data be erased, destroyed or anonymised within 30 (thirty) days in accordance with the provisions of the Regulation on the Erasure, Destruction or Anonymisation of Personal Data, and that the third parties to whom the personal data has been transferred be notified of the action taken in this regard,
• To object to any outcome to your detriment arising from the analysis of the processed data exclusively by automated systems,
• To claim compensation for damage suffered as a result of the unlawful processing of your personal data.

For comprehensive information on the principles of protection and processing of your personal data, you may review the “Cookie Policy” on the Santech website. Should you wish to request information under the Law on the Protection of Personal Data, you may contact us through the channels set out below, provided that your application contains the minimum elements specified in the law.