Our KVKK Policy

WEBSITE CLARIFICATION TEXT ON THE PROTECTION OF PERSONAL DATA IN ACCORDANCE WITH THE PERSONAL DATA PROTECTION LAW NO. 6698 ERS

Elektronik Otomasyon Makine Elektrik San. And Trade. Ltd. Şti PERSONAL DATA PROTECTION AND PROCESSING POLICY

SECTION 1 – INTRODUCTION

INTRODUCTION
Protection of personal data ERS Elektronik Otomasyon Makine Elektrik San. And Trade. Ltd. As Şti ("ERS Elektronik Otomasyon" or "Company"), we attach great importance to the security of personal data. With this awareness, we attach great importance to the processing and preservation of information deemed to be personal data belonging to all persons associated with ERS Elektronik Otomasyon in accordance with the Personal Data Protection Law No. 6698 (" Law "). The principles adopted in the execution of personal data processing activities carried out by our Company within the framework of this " ERS Elektronik Otomasyon Makine Elektrik San. Ve Tic. Ltd. Şti Personal Data Protection and Processing Policy ("Policy")" and the principles adopted in terms of compliance of our Company's data processing activities with the regulations in the Law. The basic principles are explained. The activities carried out by our Company regarding the protection of the personal data of our employees are regulated under the " ERS Elektronik Otomasyon Makine Elektrik San. Ve Tic. Ltd. Şti. Employees Personal Data Protection and Processing Policy

" , which is written in parallel with the principles set out in this Policy . SCOPE We would like to inform you about the processing of your personal data that we have obtained in the ways specified in this Policy within the scope of our activities, including but not limited to collection, storage and transfer, in accordance with the Law, and the purpose of such processing. This Policy; It relates to all personal data of persons other than our company's employees processed automatically or non-automatically as part of any data recording system. Detailed information about the personal data owners in question can be accessed in ANNEX 2 (" ANNEX 2 - Personal Data Owners ") of this Policy. APPLICATION OF THE POLICY AND RELEVANT LEGISLATION The relevant legal regulations in force regarding the processing and protection of personal data will primarily be implemented. In case of incompatibility between the current legislation and the Policy, our Company accepts that the current legislation will apply. The Policy concretizes and regulates the rules set forth by the relevant legislation within the scope of Company practices. ENFORCEMENT OF THE POLICY

This Policy issued by our Company is dated November 2020. If the entire Policy or certain articles are renewed, the effective date of the Policy will be updated. The Policy is published on our Company's website https://www.erscheckweigher.com/ .

CHAPTER 2 - ISSUES RELATED TO THE

PROTECTION OF
PERSONAL DATA ENSURING THE SECURITY OF PERSONAL DATA In accordance with Article 12 of the Law, our Company takes the necessary measures, depending on the nature of the data to be protected, in order to prevent unlawful disclosure, access, transfer of personal data or security deficiencies that may occur in other ways. . In this context, our Company takes administrative measures and carries out inspections or has them carried out to ensure the necessary security level in accordance with the documents published by the Personal Data Protection Board (" Board ").

PROTECTION OF SPECIAL PERSONAL DATA
Sensitive personal data is given special importance within the scope of the Law due to the risk of causing victimization or discrimination when processed unlawfully. This "special category" personal data; Data regarding race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, appearance and clothing, association, foundation or union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data.

In this context, the technical and administrative measures taken by our Company to protect personal data are carefully implemented in terms of special personal data and the necessary inspections are provided within our Company.

Detailed information regarding the processing of special categories of personal data can be found in Article 3.3 of this Policy. are included in the section.

INCREASING THE AWARENESS AND AUDIT OF BUSINESS UNITS REGARDING THE PROTECTION AND PROCESSING OF
PERSONAL DATA Our company provides necessary training to business units to increase awareness on preventing unlawful processing of personal data, unlawful access to data and ensuring the preservation of data.

Our company establishes the necessary systems to raise awareness of its current employees and newly recruited employees about the protection of personal data, and works with consultants if necessary.

CHAPTER 3 - ISSUES RELATED TO THE PROCESSING OF PERSONAL DATA PROCESSING

OF PERSONAL DATA IN ACCORDANCE WITH THE PRINCIPLES PROVIDED IN THE LEGISLATION
Processing in accordance with the law and the rule of honesty: Personal data is processed in accordance with the general rule of trust and honesty, without harming the fundamental rights and freedoms of individuals. Within this framework, personal data is processed to the extent and limited to the extent required by our Company's business activities.

Ensuring Personal Data is Accurate and Up-to-Date When Necessary: ​​Our company takes the necessary precautions to ensure that personal data is accurate and up-to-date throughout the period it is processed, and establishes the necessary mechanisms to ensure the accuracy and up-to-dateness of personal data for certain periods.

Processing for Specific, Clear and Legitimate Purposes : Our company clearly states the purposes of processing personal data and processes it within the scope of purposes related to these activities in line with its business activities.

Being Relevant, Limited and Proportionate to the Purpose for which they are Processed : Our company collects personal data only to the extent and extent required by its business activities and processes it limited to the specified purposes.

Preservation for the Period Envisaged in the Relevant Legislation or Necessary for the Purpose of Processing: Our company retains personal data for the period necessary for the purpose for which they are processed and the minimum period stipulated in the relevant legal legislation. In this context, our Company first determines whether a period of time is stipulated in the relevant legislation for the storage of personal data, and if a period is determined, it acts in accordance with this period. If there is no legal period, personal data is stored for the period necessary for the purpose for which they are processed. At the end of the specified storage periods, personal data is destroyed in accordance with the periodic destruction periods or the data owner's application and with the specified destruction methods (deletion and/or destruction and/or anonymization).

CONDITIONS FOR PROCESSING PERSONAL DATA
Except for the express consent of the personal data owner, the basis for personal data processing may be only one of the conditions specified below, or more than one condition may be the basis for the same personal data processing activity. If the data processed is personal data of special nature, the terms set out in title 3.3 of this Policy ("Processing of Personal Data of a Special Category") will apply.

Having Explicit Consent of the Personal Data Owner
One of the conditions for processing personal data is the explicit consent of the data owner. Explicit consent of the personal data owner must be expressed on a specific subject, based on informed consent and free will.

If the following personal data processing conditions are met, personal data may be processed without the need for the data owner's explicit consent.

Clearly Provided in Laws
If the personal data of the data owner is clearly foreseen by the law, in other words, if there is a clear provision in the relevant law regarding the processing of personal data, it can be said that this data processing condition exists.

Failure to Obtain the Explicit Consent of the Data Subject Due to Actual Impossibility.
If it is necessary to process the personal data of a person who is unable to express his/her consent due to actual impossibility or whose consent cannot be recognized as valid, in order to protect his or her own life or physical integrity of another person, the personal data of the data owner may be processed.

Directly Relevant to the Establishment or Performance of a Contract:
This condition may be deemed to be fulfilled if the processing of personal data is necessary, provided that it is directly related to the establishment or performance of a contract to which the data owner is a party.

Fulfillment of the Company's Legal Obligations:
If processing is mandatory for our Company to fulfill its legal obligations, the personal data of the data owner may be processed.

Publicization of Personal Data by the Personal Data Owner
If the data owner has made his/her personal data public, the relevant personal data may be processed on a limited basis for the purpose of publicization.

Data Processing Is Necessary for the Establishment or Protection of a Right
If data processing is mandatory for the establishment, exercise or protection of a right, the personal data of the data owner may be processed.

Data Processing Is Necessary for Our Company's Legitimate Interests:
Personal data of the data owner may be processed if data processing is mandatory for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the personal data owner.

PROCESSING OF SPECIAL QUALIFIED PERSONAL DATA
Special categories of personal data are processed by our Company in accordance with the principles specified in this Policy and by taking all necessary administrative and technical measures, including the methods determined by the Board, and in the presence of the following conditions: Special categories of personal data other than health and sexual life

. If it is clearly provided for in the law, in other words, if there is a clear provision in the relevant law regarding the processing of personal data, it may be processed without the explicit consent of the data owner. Otherwise, explicit consent of the data owner will be obtained.

Special personal data regarding health and sexual life are collected without explicit consent by persons under the obligation of confidentiality or authorized institutions and organizations for the purpose of protecting public health, preventive medicine, medical diagnosis, execution of treatment and care services, planning and management of health services and their financing. can be processed. Otherwise, explicit consent of the data owner will be obtained.

CLARIFICATION OF PERSONAL DATA OWNER
In accordance with Article 10 of the Law and secondary legislation, our Company informs personal data owners who their personal data is processed by, as the data controller, for what purposes, with whom it is shared for what purposes, by what methods it is collected and the legal reason and what the data owners have within the scope of processing their personal data. informs them about their rights.

TRANSFER OF PERSONAL DATA
Our company can transfer the personal data and sensitive personal data of the personal data owner to third parties (third party companies, group companies, third real parties) by taking the necessary security measures in line with the legal personal data processing purposes. In this regard, our company acts in accordance with the regulations stipulated in Article 8 of the Law. Detailed information on this subject can be found in the document titled ANNEX 4 of this Policy (" ANNEX 4- Third Parties to whom Personal Data is Transferred by our Company and Purposes of Transfer ").

Transfer of Personal Data
Even if there is no explicit consent of the personal data owner, personal data may be transferred to third parties by our Company by taking due care and taking all necessary security measures, including the methods prescribed by the Board, if one or more of the conditions stated below are present.

The relevant activities regarding the transfer of personal data are clearly foreseen by law,
The transfer of personal data by the Company is directly related and necessary to the establishment or performance of a contract,
The transfer of personal data is mandatory for our Company to fulfill its legal obligation,
Provided that the personal data has been made public by the data owner, for the purpose of publicization. Transfer of personal data by our Company in a limited way,
Transfer of personal data by the Company is mandatory for the establishment, use or protection of the rights of the Company or the data owner or third parties, It is mandatory to
carry out personal data transfer activities for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the data owner. It
is mandatory for the person who is unable to express his/her consent due to actual impossibility or whose consent is not given legal validity, to protect his or someone else's life or physical integrity.

In addition to the above, personal data may be transferred to foreign countries declared by the Board to have adequate protection (" Foreign Country with Adequate Protection"") may be transferred in case of the existence of any of the above conditions. In case there is not sufficient protection, it can be transferred to foreign countries where the data controllers in Turkey and the relevant foreign country have committed in writing to adequate protection and the Board has permission, in line with the data transfer conditions stipulated in the legislation ("Commitment to Adequate Protection) . Transfer of

Special Personal Data Special categories of personal data are processed by
our Company in accordance with the principles set out in this Policy and by taking all necessary administrative and technical measures, including the methods to be determined by the Board, and as stated above. It can be transferred within the framework of the conditions specified under Article 3.3.

Additionally, as stated in Article 3.5.1 of our Policy, transfer to a Foreign Country with Adequate Protection can be made in case of the existence of any of the above-mentioned conditions. In case there is no adequate protection, transfer can be made within the scope specified in Article 3.5.1. .

CHAPTER 4 - CATEGORIZATION OF PERSONAL DATA PROCESSED BY OUR COMPANY AND THE PURPOSES OF PROCESSING
Before our Company, the relevant persons are informed in accordance with Article 10 of the Law and secondary legislation, in line with the personal data processing purposes of our Company, based on at least one of the personal data processing conditions specified in Articles 5 and 6 of the Law. and, to a limited extent, personal data are processed in accordance with the general principles specified in the Law, especially the principles specified in Article 4 of the Law regarding the processing of personal data. Within the framework of the purposes and conditions specified in this Policy, the categories of personal data processed and detailed information about the categories can be accessed in the ANNEX 3 (" ANNEX 3 - Personal Data Categories ") document of the Policy.

Detailed information regarding the personal data processing purposes in question is included in ANNEX 1 of the Policy (" ANNEX 1 - Personal Data Processing Purposes ").

SECTION 5 - STORAGE AND DESTRUCTION OF PERSONAL DATA
Our company retains personal data for the period necessary for the purpose for which they are processed and the minimum period stipulated in the relevant legal legislation. In this context, our Company first determines whether a period of time is stipulated in the relevant legislation for the storage of personal data, and if a period is determined, it acts in accordance with this period. If there is no legal period, personal data is stored for the period necessary for the purpose for which they are processed. At the end of the specified storage periods, personal data is destroyed in accordance with the periodic destruction periods or the data owner's application and with the specified destruction methods (deletion and/or destruction and/or anonymization).

CHAPTER 6 - RIGHTS OF PERSONAL DATA OWNERS AND THE USE OF THESE RIGHTS

RIGHTS OF PERSONAL DATA OWNER
Personal data owners have the following rights:

Learning whether personal data has been processed,
Requesting information if personal data has been processed, Learning
the purpose of processing personal data and whether they are used in accordance with their purpose. ,
Knowing the third parties to whom personal data is transferred at home or abroad,
Requesting correction of personal data in case of incomplete or incorrect processing and requesting that the transaction carried out in this context be notified to third parties to whom personal data has been transferred,
Even though it has been processed in accordance with the provisions of the Law and other relevant laws, Requesting the deletion or destruction of personal data in case the necessary reasons are eliminated and requesting that the action taken in this context be notified to third parties to whom the personal data has been transferred, Objecting to the emergence of a
result against the person by analyzing the processed data exclusively through automatic systems, Processing of
personal data contrary to the law Requesting the compensation of the damage in case of loss due to it.

6.1 PERSONAL DATA OWNER'S EXERCISE OF THEIR RIGHTS
Personal data owners will be able to submit their requests regarding their rights listed in section 6.1. ("Rights of the Personal Data Owner") to our Company through the methods determined by the Board. In this regard, they will be able to benefit from the " ERS Electronic Automation Data Owner Application Form ", which can be accessed at https://www.erscheckweigher.com/ . OUR COMPANY'S RESPOND TO APPLICATIONS If the personal data owner submits his/her request regarding the rights stated in section 6.1. ("Rights of the Personal Data Owner") to our Company in accordance with the procedure, our Company will respond to the relevant person as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request . The request will be finalized free of charge. However, if the transaction requires an additional cost, a fee may be charged in accordance with the tariff determined by the Board. ANNEX 1 – Personal Data Processing Purposes [To be revised in line with additional information from the Company]