Information notice of ARY Holding A.Ş. and Group companies on the protection and processing of personal data
The main purpose of this notice is to ensure transparency by informing you about the personal data processing activities (personal data and special categories of personal data will hereinafter be referred to as “data”) carried out lawfully by ARY Holding A.S. and Group Companies in their capacity as Data Controller pursuant to the Personal Data Protection Law (“KVKK”), and about the protection of personal data.

Pursuant to the KVKK, the processing by our Company of your personal data and special categories of personal data obtained by ARY Holding A.S. and Group Companies (hereinafter referred to as the “Company”) (that is, obtaining, recording, storing, preserving, altering, reorganizing, disclosing or transferring such data by non-automated means, provided that it forms, wholly or partly, part of a data filing system) will only be possible if you give your explicit consent and share the relevant information with us of your own free will.

Purposes of processing your personal data
Although this may vary depending on the services provided by our Company and our Company’s commercial activities, your personal data may be collected verbally, in writing or electronically, by automated or non-automated methods, through our Company’s units and offices, website, social media channels, mobile applications and similar means.

In addition, your personal data may be created and updated for as long as you benefit from the products and services offered by our Company and our Group Companies, and processed in accordance with the personal data processing conditions set out in Articles 5 and 6 of the KVKK, titled “Conditions for Processing Personal Data” and “Conditions for Processing Special Categories of Personal Data,” respectively.

The purposes for which your personal data is processed include, without limitation, the following:

To enable the Company to provide the necessary products and services and to give the necessary information regarding those services,
To carry out the work needed for you to benefit from other products and services the Company may offer,
To enable the Company to fulfill the activities required by the relevant legislation and by public authorities,
To ensure the legal and commercial security of all natural persons who have a business relationship with the Company,
To determine and implement the Company’s commercial policies,
To carry out the Company’s human resources policies,
Transfer of your personal data
Your personal data may be transferred to the Company, the Company’s shareholders, Company employees, suppliers, dealers, business partners, consultants, outsourced service providers, legally authorized public institutions and organizations, and private persons, within the conditions set out in Articles 8 and 9 of the KVKK, titled “Transfer of Personal Data” and “Transfer of Personal Data Abroad,” respectively.

The purposes for which your personal data is transferred include, without limitation, the following:

To enable the Company to provide the necessary products and services and to give the necessary information regarding those services,
To carry out the work needed for you to benefit from other products and services the Company may offer,
To enable the Company to fulfill the activities required by the relevant legislation and by public authorities,
To ensure the legal and commercial security of all natural persons who have a business relationship with the Company,
To determine and implement the Company’s commercial policies,
To carry out the Company’s human resources policies,
Method and legal grounds for collecting your personal data
Your personal data is collected electronically, verbally or in writing in order to carry out our activities and on the grounds of ensuring compliance with legislation as well as with Company policies. Your collected personal data may also be processed and transferred for the purposes detailed in this Information Notice, within the scope of the personal data processing conditions and purposes set out in Articles 5 and 6 of the KVKK, titled “Conditions for Processing Personal Data” and “Conditions for Processing Special Categories of Personal Data.”

Your rights under the personal data protection law
Your rights under Article 11 of the KVKK are as follows:

To learn whether your personal data is being processed,
To request information if your personal data has been processed,
To learn the purpose for which your personal data is processed and whether it is used in accordance with that purpose,
To know the third parties, in Türkiye or abroad, to whom your personal data is transferred,
To request the correction of your personal data if it has been processed incompletely or inaccurately, and to request that the operations carried out in this context be notified to the third parties to whom your personal data has been transferred,
To request the deletion or destruction of your personal data within the framework of the conditions set out in the KVKK and other relevant laws, and to request that the operations carried out in this context be notified to the third parties to whom your personal data has been transferred,
To object to any outcome to your detriment arising from the analysis of the processed data exclusively through automated systems,
To claim compensation for damages if you suffer harm due to the unlawful processing of your personal data.
Should you wish to exercise your rights under Article 11 of the KVKK, you may submit your application in writing, together with documents verifying your identity, by hand to “ARY A.S. Legal Department, Maslak Mahallesi, Sögütözü Sokak, Maslak 1453 Sitesi, No:20C /B2 Blok Sariyer/Istanbul”, or send it through a notary public or by registered mail with return receipt.

Requests in your application will be concluded free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request, and the outcome will be communicated to you in writing or electronically. However, if the process entails an additional cost, you will be charged the fee set out in the tariff determined by the Personal Data Protection Board.

Security
In accordance with Article 12 of the KVKK, the Company takes the necessary technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of the personal data it processes, to prevent unlawful access to the data and to ensure the safekeeping of the data, and it carries out, or has others carry out, the necessary audits in this regard. Accordingly, the Company takes reasonable measures to protect data against loss, misuse, unauthorized access, disclosure, alteration and deletion. Likewise, your data may be stored in secure physical locations and/or on servers in America (including the United States of America), Europe, Asia and/or other locations to which it may be transferred.

Retention period of personal data
The Company retains personal data only for as long as specified in the relevant legislation or as necessary for the purpose for which it is processed. In this context, the Company first determines whether the relevant legislation prescribes a retention period for personal data; if a period has been set, it complies with that period, and if not, it retains the personal data for as long as necessary for the purpose for which it is processed. Upon expiry of the period, or once the reasons requiring the processing of the data no longer exist, personal data is deleted, destroyed or anonymized by the Company. The Company does not retain personal data on the grounds that it might be used in the future.

Respectfully submitted for your information.

ARY HOLDING A.S. AND GROUP COMPANIES
Personal Data Protection Law No. 6698

http://www.mevzuat.gov.tr/MevzuatMetin/1.5.6698.pdf