Law on the Protection of Personal Data

As Aegean Kimya, we attach great importance to the privacy and security of your personal data.

In this context, it is one of our priorities to process and store all personal data belonging to all persons associated with Aegean Kimya, including our customers and business contacts who benefit from our products and services, in accordance with the Law on the Protection of Personal Data No. 6698 (“KVKK” - "LPPD"). In our capacity as "Data Controller" under the KVKK and with the awareness of this responsibility, we would like to inform you as follows regarding the purposes of processing your personal data, the methods and reasons for collecting your data, your rights regarding the processing of your personal data, and the application procedures and principles, which are the methods for exercising these rights.

a. What is Personal Data? What Personal Data Do We Collect?

Personal data refers to any information that can be associated with you (“Personal Data”), primarily your personal identification information (name, surname, TR identity number, etc.), as well as address and phone information, vehicle and license plate information, family status information, IP address, bank account information, and a special type of this, Special Categories of Personal Data, refers to sensitive personal data (“Special Categories of Personal Data”) such as your race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures, and your biometric and genetic data. The explanations we make for your Personal Data on this page also cover your Special Categories of Personal Data.

In this context, as Aegean Kimya, we collect Personal Data belonging to our customers, business contacts, employees, employee candidates, platform (our internet / mobile sites and applications) users, visitors, and subcontractor and similar business relationship institution officials and employees, in accordance with the KVKK when necessary. We can detail the Personal Data we collect as follows:

• Identity Data: This is data regarding the person's identity, such as name, surname, T.R. identity number, and ID photocopy, which we collect from our customers, business contacts, employees, employee candidates, platform (our internet / mobile sites and applications) users, visitors, and subcontractor and similar business relationship institution officials and employees.
• Contact Data: This is data that enables communication with the person, such as phone number, address, e-mail address, and IP address, which we collect from our customers, business contacts, employees, employee candidates, platform (our internet / mobile sites and applications) users, visitors, and subcontractor and similar business relationship institution officials and employees.
• Family Member Data: This is data about the family members and relatives of the relevant person, which we collect from our employees, employee candidates, and subcontractor and similar business relationship institution officials and employees, as required by relevant legislation and/or to protect the legal and other interests of our Company or the relevant person.
• Financial Data: This is data such as wage, salary information, and bank account information, which we collect from our employees, employee candidates, customers, business contacts, and subcontractor and similar business relationship institution officials and employees, according to the legal relationship our Company has established with the data subject.
• Personnel Data: This is all personal data that forms the basis for the creation of personnel rights of real persons who have a working relationship with our Company, which we collect from our employees, employee candidates, and subcontractor and similar business relationship institution employees.
• Physical Space Security Data: This is personal data such as security and camera recordings taken during entry into and stay within the physical space, collected from our customers, business contacts, employees, employee candidates, visitors, and subcontractor and similar business relationship institution officials and employees.
• Communication and Complaint Management Data: This is personal data obtained from our customers, business contacts, platform (our internet / mobile sites and applications) users, visitors, and subcontractor and similar business relationship institution officials and employees during the processes of receiving and evaluating all kinds of requests or complaints directed at our Company.
• Special Categories of Personal Data: This is data specified in Article 6 of the KVKK, such as health data, biometric data (voice and video recordings), religion, and association/union membership information, which we collect from our customers, business contacts, employees, employee candidates, visitors, and subcontractor and similar business relationship institution officials and employees.
• Other Data: This is data processed for technical transaction security, purchase information, cookies, and data collected through other means automatically, which we collect from our customers, business contacts, employees, employee candidates, platform (our internet / mobile sites and applications) users, and subcontractor and similar business relationship institution officials and employees.

b. By What Methods and Legal Reasons Do We Collect / Process Your Personal Data?

We collect your Personal Data for the following main purposes and by the following methods, and through other channels that may be added to these in the future, by automatic or non-automatic means, verbally, orally, in writing, or electronically.

We collect your Personal Data through various channels including our internet and mobile platforms (our internet / mobile sites and applications), our social media accounts operated on behalf of Aegean Kimya on various social media platforms, our call center managed by Aegean Kimya, other communication methods including e-mail, short messages (“SMS”) or multimedia messages (“MMS”), Contracts we sign with you or your company as an official within the scope of Aegean Kimya sales and marketing activities, commercial offers presented, printed and electronic forms, business cards and other documents provided by you during our customer visits, and through third parties such as Aegean Kimya group companies, business contacts, dealers and sales channels, manufacturing firms or firms from which it procures services/products, and sources including the Trade Registry, verbally, in writing or electronically, wholly or partially automatically, or as part of any data recording system by non-automatic methods.

We process your Personal Data, which we collect in line with the methods above, based on one or more of the following legal reasons:

• Your explicit consent exists,
• The provisions of laws and regulations in force in the Republic of Turkey permit the processing,
• It is necessary for the protection of your life or physical integrity or that of another person, while you are unable to disclose your consent due to actual impossibility,
• It is necessary for the performance of a contract we have concluded with you or your company,
• Processing your Personal Data is necessary for us to fulfill our legal obligations,
• Your Personal Data has been made public by you,
• It is necessary for the exercise or protection of our legal or contractual rights as Aegean Kimya.,
• Processing your Personal Data is necessary for our legitimate interests, provided that it does not harm your fundamental rights and freedoms.

As Aegean Kimya, we retain all Personal Data we process in accordance with the periods mandated by the KVKK and other legislation, and in any case, as long as the legitimate purposes above are not eliminated, by taking all necessary administrative and technical measures.

c. For What Purpose Do We Process Your Personal Data?

We process the Personal Data we collect for the following general purposes, depending on its nature:

1. Fulfillment of the requirements of contracts concluded by Aegean Kimya, provision of products and services offered, execution of production, sales, delivery, and installation processes, conducting necessary studies and evaluations to develop products and services and to enable you to benefit from them, and performing post-sales maintenance and repair operations
2. Monitoring and fulfillment of obligations arising from consumer legislation and responding to consumer applications
3. Monitoring, evaluating, and providing support services for the requests and complaints of relevant persons such as customers and consumers, managing consumer satisfaction, and planning, statistics, and implementation of satisfaction surveys in this context
4. Conducting quality assessment and improvement studies to provide better and more reliable products and services and to ensure sustainability, and auditing suppliers, subcontractors, and similar persons with whom we have business relationships
5. Carrying out advertising and marketing activities for products and services offered by Aegean Kimya to provide information on promotions, campaigns, offers, events, and similar topics, and new products and services, and conducting corporate communication activities
6. Carrying out marketing and CRM (Customer Relationship Management) studies
7. Organizing corporate communication and, in this context, other events and invitations and providing information about them, conducting market research studies
8. Improving the digital platforms we offer to our customers, consumers, and business contacts, and generating statistics such as the number, type, visit frequency, behaviors, geographical locations of users to provide an efficient and personalized experience, presenting personalized content, campaigns, and advertisements according to the interests and needs of platform (internet and mobile site and applications) users, and using cookies for this purpose
9. Ensuring the legal and commercial security of persons who have a business relationship with Aegean Kimya. (planning administrative operations for communication carried out by our Company, ensuring and auditing the physical security of Company locations, business partner/customer/supplier (officials or employees) evaluation and audit processes, legal compliance process, etc.)
10. Exercising legal rights, using information regarding transaction history as evidence in case of disputes after the termination of the legal relationship
11. Determining and implementing Aegean Kimya's commercial, legal, and business strategies
12. Executing Aegean Kimya's human resources, accounting/finance policies
13. Planning, auditing, and executing information security processes
14. Compliance with domestic and international legislation, providing information requested by public institutions and organizations, and fulfilling reporting obligations.

d. Transfer of Personal Data and Processing of Personal Data by Third Parties

The Company may transfer personal data to a third real or legal person in accordance with KVKK regulations. In this case, the Company ensures that the third parties to whom it transfers data also comply with this Policy. In this context, necessary protective arrangements are added to the contracts concluded with the third party.

• Transfer of personal data to third parties in Turkey; Personal Data may be transferred by the Company to third parties located in Turkey without seeking explicit consent in the exceptional cases specified in KVKK Article 5.2 and Article 6.3, or in other cases by obtaining the explicit consent of the Data Subject (KVKK Article 5.1 and Article 6.2).
• Transfer of personal data to third parties abroad; Personal Data may be transferred by the Company to third parties located abroad without seeking explicit consent in the exceptional cases specified in KVKK Article 5.2 and Article 6.3, or in other cases by obtaining the explicit consent of the Data Subject (KVKK Article 5.1 and Article 6.2). However, one of the following conditions must exist for the foreign country to which it will be transferred.
• The foreign country to which personal data is transferred is in the status of countries with adequate protection as determined by the Board
• If the foreign country where the transfer will take place is not on the Board's list of safe countries, provided that the Company and the Data Controllers in the relevant country make a written commitment to provide adequate protection and obtain permission from the Board

e. Your Rights and Application Procedure

e.1. Your Rights Regarding Your Personal Data

We would like to state that you have the following rights regarding your data being processed within Aegean Kimya. and its subsidiaries:

1. To learn whether your Personal Data is being processed,
2. To request information if your Personal Data is being processed,
3. To learn the purpose of processing your Personal Data and whether your personal data is used in accordance with its purpose,
4. To know the third parties to whom the data is transferred, if any, domestically or abroad, and what data is transferred,
5. To request the correction of your Personal Data if it is incomplete or incorrectly processed,
6. To request that these operations be notified to third parties to whom your Personal Data has been transferred, in case your personal data is corrected, deleted, or destroyed,
7. To request the deletion or destruction of your processed Personal Data if the reasons requiring its processing cease to exist or your Personal Data loses its timeliness,
8. To object to a result against you arising from the analysis of your processed Personal Data exclusively through automated systems,
9. You have the right to demand compensation for the damage if you suffer damage due to the unlawful processing of your Personal Data.

e.2. Application

You can submit your requests regarding your Personal Data by filling out the application form linked below:

1. By delivering it to the consultation office at our company address located in the Data Controller Identity information area, or by sending a notification to the same address via a Notary Public,
2. It can be done via registered electronic mail.

Aegean Kimya will conclude the requests directed to it free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request. In case a cost arises due to the fulfillment of your requests, we may only request the fees in the tariff determined by the Personal Data Protection Board from you.

As a result of the requests directed to Aegean Kimya, we may accept the requests or reject them by explaining the reason, and we can transmit this response to the person making the request in writing or electronically. If the request is accepted, we, as Aegean Kimya, are obliged to fulfill the requirement of the request immediately.

e.3. Complaint

If the requests you have directed to Aegean Kimya are rejected by Aegean Kimya, you are not satisfied with the response given by Aegean Kimya, or no response is given, you can file a complaint with the Personal Data Protection Board within 30 (thirty) days from the date the response is notified to you, and within 30 days from the end of the 30 (thirty) day period if no response is given.

f. Data Controller Identity Information

The expression Aegean Kimya used in this text is arranged for the Aegean Kimya subsidiary established in Turkey and whose information is given below, and is addressed to the data subjects of the data for which the company specified below is the data controller:

Aegean Kimya

Address: Cumhuriyet Mah. Ali Osman Çelebi Blv. Uysal İş Ticaret Merkezi D:149 EN 59850 Çorlu / Tekirdağ - Turkey

Phone: +90 532 795 80 31

E-Mail: info@aegean.kim

Application Form within the Scope of KVKK

Personal data owners (Hereinafter referred to as “Applicant”), defined as data subjects in the Law on the Protection of Personal Data No. 6698 (“KVK Law”), are granted the right to make certain requests regarding the processing of their personal data in Article 11 of the KVK Law. Pursuant to the first paragraph of Article 13 of the KVK Law; applications to be made to our Company, which is the data controller, regarding these rights must be submitted to us personally, in Turkish, in writing, and through the following methods determined by the Personal Data Protection Board (“Board”).

Information on how written applications should be delivered to us is provided below.

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller (Official Gazette dated 10/03/2018 and numbered 30356), the following information is mandatory in applications.

Information to be Filled in During Application:

• Name, surname, and signature if the application is in writing,
• T.R. identity number for citizens of the Republic of Turkey, nationality, passport number, or identification number, if any, for foreigners,
• Residential or business address for notification,
• E-mail address, telephone, and fax number for notification, if any,
• Subject of the request

Additionally, information and documents related to the subject are attached to the application.

If you wish to make an application regarding your personal data, you must fill out the application form below completely. This application form has been prepared to identify your relationship with our Company, to fully determine your personal data processed by our Company, if any, and to respond to your relevant application correctly and within the legal period. In order to eliminate legal risks that may arise from unlawful and unfair data sharing and especially to ensure the security of your personal data, our Company reserves the right to request additional documents and information (copy of ID card or driver's license, etc.) for identity and authorization verification. Our Company does not accept responsibility for requests arising from incorrect information or unauthorized applications if the information regarding your requests submitted within the scope of the form is not correct and up-to-date or if an unauthorized application is made.

Your applications submitted to us will be answered free of charge in writing within thirty days at the latest from the date your request reaches us, depending on the nature of the request, in accordance with Article 13, paragraph 2 of the KVK Law.