Personal Data Processing andProtection Privacy Notice

Revotek Elektronik Sanayi ve Ticaret Anonim Şirketi Personal Data Processing and Protection Policy and Privacy Notice

1. Preamble

The right to the protection of personal data is enshrined as a fundamental human right in Article 8 of the Charter of Fundamental Rights of the European Union and Article 16 of the Treaty on the Functioning of the European Union. Personal data is also regulated under Article 20 of the Constitution of the Republic of Türkiye, titled “Privacy of Private Life”, and is included among fundamental rights. Given this importance, Law No. 6698 on the Protection of Personal Data (“KVKK”) was published in the Official Gazette on 7 April 2016 to protect the fundamental rights and freedoms of individuals, in particular the privacy of private life, in the processing of personal data of natural persons, and to regulate the obligations of natural and legal persons processing personal data and the procedures and principles to be followed.

2. Purpose and scope

At REVOTEK, we take care to carry out the protection, processing and transfer of personal data in accordance with Law No. 6698 on the Protection of Personal Data and related legislation (“KVKK”). We therefore take the necessary measures and fulfil our responsibilities to ensure that personal data processing activities comply with the KVKK.

This Privacy Notice, prepared within this framework, is intended by Revotek Elektronik Sanayi ve Ticaret Anonim Şirketi (“REVOTEK”), acting as data controller, to explain the processing and transfer of personal data in accordance with the KVKK and to inform the data subjects concerned.

Under this privacy notice, the data controller — the legal entity that determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system — is REVOTEK (“Mersis No 0734200215500001”).

Information on the identity of the data controller for all personal data processing activities covered by this policy is provided below.

Data Controller’s Full Name: Revotek Elektronik Sanayi ve Ticaret Anonim Şirketi

Short Name: Revotek

Address: Birlik Organised Industrial Zone 4.Sk. No:2/2 Tuzla-Istanbul

Website: www.revotek.com.tr

Registered Email (KEP): revotek@hs01.kep.tr

3. Transfer of Personal Data to Third Parties

For the purposes stated above and to the extent required, your personal data may be transferred, within the framework of the processing conditions and purposes set out in the KVKK, to business partners in Türkiye or abroad, domestic and foreign suppliers of products and services, third-party institutions and organisations processing data on behalf of our company, authorised public institutions and/or private persons, judicial and enforcement authorities, law enforcement units, insurance companies, insurance intermediaries, relevant third parties within the scope of contract performance, and the company’s attorneys and lawyers.

4. Method and Legal Basis of Personal Data Collection

Your personal data is processed on the legal grounds set out under the heading “Purpose and scope” in Article 2. General information on legal grounds is as follows: the KVKK lists the conditions for processing personal data in Article 5(2). If a data controller’s purposes for processing can be assessed within the conditions listed in the KVKK, that data controller may lawfully process personal data. Accordingly, the Company carries out personal data processing activities where its purposes can be assessed within the processing conditions regulated in the KVKK. The Company does not carry out any processing activity that falls outside these conditions. The processing conditions (legal grounds) in the KVKK are:

• the explicit consent of the data subject,
• being expressly provided for by law,
• being necessary to protect the life or bodily integrity of a person who is unable to give consent due to actual impossibility, or whose consent is not legally valid, or of another person,
• processing the personal data of the parties being necessary, provided that it is directly related to the establishment or performance of a contract,
• being necessary for the data controller to fulfil its legal obligation,
• having been made public by the data subject,
• processing being necessary for the establishment, exercise or protection of a right,
• processing being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Your personal data is processed on the other legal grounds required by the circumstances, excluding ground no. 3 listed above. Explicit consent is also the basic processing condition for special categories of personal data, and the Company does not, in principle, aim to process such data. However, special categories of personal data that we must process due to our activities, or for which you have given explicit consent, are processed proportionately within the legislation.

Under the conditions (legal grounds) listed in the KVKK for special categories of personal data, such data may be processed without the explicit consent of the data subject by persons under a duty of confidentiality or by authorised institutions and organisations. One or more processing conditions that make a processing activity lawful may exist at the same time. Processing the data mentioned above is necessary to achieve these purposes.

When identity information is transferred to our Company, data that is not actually within our processing purposes may also be transferred. Within our administrative and technical measures, we delete or destroy such data at the end of the periods set out in the legislation.

Your personal data is collected by our Company by fully or partly automated means, or by non-automated means provided that it forms part of a data filing system, through all kinds of verbal, written and electronic channels, by technical and other methods, via various channels such as the call centre, website, our social media pages and mobile application, and through queries that may be made in third-party systems using your information. It is processed by our Company or by data processors appointed by the Company because it is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

5. Rights of the Data Subject

Your rights are expressly set out in Article 11 of Law No. 6698 on the Protection of Personal Data, which regulates the rights of the data subject. Accordingly, you have the right to:

• learn whether your personal data is processed,
• request information if your personal data has been processed,
• learn the purpose of processing and whether the data is used in line with that purpose,
• know the third parties in Türkiye or abroad to whom your personal data is transferred,
• request the correction of your personal data if it is incomplete or inaccurate,
• request the deletion or destruction of personal data under the conditions set out in Article 7 of Law No. 6698,
• request that the actions taken under items (e) and (f) above be notified to third parties to whom the personal data has been transferred,
• object to any outcome against you arising from the analysis of your processed data exclusively through automated systems,
• and claim compensation if you suffer damage due to the unlawful processing of your personal data.

The requests in your application will be concluded free of charge within thirty days at the latest, depending on the nature of the request. However, if the action requires an additional cost for the Company, a fee may be charged according to the tariff set by the Personal Data Protection Board in the Communiqué on the Procedures and Principles of Application to the Data Controller.

You must submit your application regarding the processing of your personal data to our Company in writing, or by secure electronic signature, mobile signature or the email address you have previously notified to us and that is in our records, using the addresses given below. Depending on the nature of your request and your application method, the Company may request additional verification (such as sending a message to your registered phone or calling you) to determine whether the application belongs to you and thus to protect your rights.

Contact Details

Title: Revotek Elektronik Sanayi ve Ticaret Anonim Şirketi

Mersis No: 0734200215500001 | Tax No: 734 200 2155

Email: info@revotek.com.tr

Phone: +90 (216) 399 23 47

Address: Birlik Organised Industrial Zone 4.Sk. No:2/2 Tuzla-Istanbul

For a person to apply on behalf of a data subject, a special power of attorney issued through a notary public by the data subject in the name of that person is required.

6. General principles of personal data processing

Article 4 of the KVKK lists the basic principles to be followed when processing personal data. These principles are taken into account and meticulously applied in all personal data processing activities carried out by “REVOTEK”. The principles and related explanations are set out below:

• Compliance with the Law and the Rule of Good Faith: In fulfilling its obligation to process and protect personal data, “REVOTEK” acts in accordance with the general principles of law and the rule of good faith set out in the Turkish Civil Code.
• Ensuring Personal Data Is Accurate and Up to Date: It is very important for the protection of individuals’ rights that personal data provides accurate and current information about them. “REVOTEK” exercises the reasonable care expected of it to ensure that the personal data it processes is accurate and up to date.

Processing Personal Data for Specific, Explicit and Legitimate Purposes: The purposes to be achieved by processing personal data are the most important criterion in determining whether a processing activity is lawful. The KVKK therefore requires processing activities to be carried out for specific, explicit and legitimate purposes. In line with this principle, “REVOTEK” carries out processing activities for the specific, explicit and legitimate purposes required by its activities.

• Being Relevant, Limited and Proportionate to the Purpose of Processing: “REVOTEK” processes personal data only to the extent sufficient to achieve the purposes set within its activities. “REVOTEK” also acts in accordance with the principle of being limited and proportionate by avoiding the processing of personal data that is not needed.

Retaining Data for the Period Set Out in the Relevant Legislation or Required for the Purpose of Processing: Personal data processed by “REVOTEK” is retained until the purposes of processing that can be assessed within the processing conditions cease to exist. When these purposes cease to exist, “REVOTEK” will end the retention of the relevant personal data.

7. Obligation to inform

Pursuant to Article 10 of the KVKK, “REVOTEK” fulfils the obligation to inform set out in the KVKK by providing data subjects with the following information when personal data is obtained:

• the identity of the data controller and, if any, its representative,

the purpose for which the personal data will be processed,

• to whom and for what purpose the processed personal data may be transferred,

the method and legal basis of personal data collection,

• the other rights listed in Article 11.

To fulfil its obligation to inform, “REVOTEK” prepares appropriate privacy notices for use at the points where it comes into contact with data subjects while carrying out its activities, and provides them to the data subjects.

8. Measures for the security of personal data

“REVOTEK” exercises all reasonable care and diligence to ensure the confidentiality and security of the personal data it processes. In addition to the requirements of the relevant legislation, “REVOTEK” takes reasonable technical and administrative measures to ensure data confidentiality and security under Article 12 of the KVKK. These administrative and technical security measures aim to prevent the unlawful processing of personal data, prevent unlawful access to personal data and ensure that personal data is retained at an appropriate level of security. Where personal data is processed on its behalf by another natural or legal person (data processor), “REVOTEK” makes the necessary reminders for the measures below to be taken by the relevant data processors, as appropriate.

If personal data is unlawfully obtained by third parties, notifications will be made to the data subjects, the Board and other relevant public institutions and organisations in accordance with the relevant legislation. When taking measures for the security of personal data, the Personal Data Security Guide (Technical and Administrative Measures) published by the Board is taken into account.

9. Processing of personal data collected through cookies

Our Company uses cookies to ensure the operation and continuity of our web pages or mobile applications, to enable the establishment of contracts and to remember your preferences. For details, you can access our cookie policy at https://www.revotek.com.tr/en/cookie-policy/.