PDPL Notice

SİSKON ENDÜSTRİYEL OTOMASYON SİSTEMLERİ
SANAYİ VE TİCARET ANONİM ŞİRKETİ

NOTICE ON THE PROTECTION OF PERSONAL DATA
PURSUANT TO LAW NO. 6698

SİSKON ENDÜSTRİYEL OTOMASYON SİSTEMLERİ SANAYİ VE TİCARET A.Ş. (hereinafter referred to as the "Company") processes your personal data as the data controller within the scope described below and within the limits mandated by Law No. 6698 on the Protection of Personal Data (hereinafter "KVKK") and other applicable legislation.

Tax Office / No.: Konak Tax Office, 7710337656
MERSIS No.: 0771033765600027
Registered Office: Çankaya Mahallesi, 153 Sokak No:23/A, Hatay 35250 Konak/İzmir
Place of Business: Adatepe Mahallesi, Doğuş Caddesi No:207/AG, Dokuz Eylül University Tınaztepe Campus, DEPARK Beta Building, Floor 2, No:202, 35390 Buca/İzmir

Your personal data may be obtained, recorded, stored, preserved, altered, reorganised, disclosed, transferred, taken over, made available, classified, and transferred to third parties to the extent permitted by applicable law, by fully or partially automated means or by non-automated means that form part of a data recording system.

Your personal data are processed within the conditions set out in Articles 5 and 6 of the KVKK for the following purposes:

• Carrying out the necessary activities to enable you to benefit from our products and services,
• Planning and executing sales, marketing, and after-sales support activities,
• Following up contractual processes and legal claims,
• Ensuring the legal, technical, and commercial business security of related parties,
• Managing human resources processes; evaluating job applications; fulfilling statutory and contractual obligations for employees,
• Ensuring quality and compliance monitoring for our products and services,
• Managing supply chain and supplier relationships,
• Ensuring physical premises and information security, identity verification, and guest wireless network access management during visits to our premises,
• Contacting you when you request information from the Company,
• Planning, auditing, and executing information security processes,
• Establishing and managing information technology infrastructure,
• Monitoring finance, accounting, and legal affairs,
• Planning and executing Company activities, corporate communications, and logistics,
• Determining and implementing the Company's commercial and business strategies.

Your personal data may be transferred, limited to the fulfilment of the purposes stated in section (b) above and within the conditions for processing personal data set out in Article 8 of the KVKK, to:

• Our business partners, suppliers, shareholders, and affiliates,
• Legally authorised public institutions and organisations (TÜBİTAK, SGK, Tax Offices, Ministry of Labour, etc.),
• Legally authorised private law persons (auditors, legal advisors, financial advisors, insurance companies, banks, etc.),
• Cloud service providers and hosting service providers within the scope of information technology services we use.

Your personal data may be transferred abroad under Article 9 of the KVKK (as amended by Law No. 7499 dated 12.03.2024) where one of the following conditions is met:

• An adequacy decision has been issued by the Personal Data Protection Board regarding the destination country, sectors within that country, or international organisations,
• In the absence of an adequacy decision, one of the appropriate safeguards (binding corporate rules, standard contractual clauses, written undertakings) has been provided subject to the written commitment of the parties and the Board's approval,
• One of the incidental grounds under Article 9/6 of the KVKK applies (explicit consent, performance of a contract, superior public interest, protection of vital interests, etc.).

Within this framework, personal data may be transferred to our subsidiary in Romania (Siskon Software & Automation S.R.L., Brașov) and our subsidiary in Estonia for HR, joint customer/project management, and intra-group reporting purposes, as well as to technology providers hosting server and cloud infrastructure in EU or other overseas regions (e-mail, file storage, enterprise software services), to the extent necessary and subject to the legal safeguards stated above.

Your personal data are collected through communications and contractual relationships established with the Company, during your visits to our premises, via contact forms or user accounts on our website (www.siskon.com.tr), through information provided by third parties for commercial relationship purposes, through information shared at fairs, training sessions, conferences, and similar events, and through similar channels by automated or non-automated means.

These personal data are processed based on the legal grounds set out in Articles 5 and 6 of the KVKK, including "performance or conclusion of a contract", "fulfilment of a legal obligation", "legitimate interest", "explicit consent", and other applicable grounds, and may also be processed and transferred for the purposes stated in sections (b) and (c) of this Notice.

Your personal data processed in accordance with the KVKK will be deleted, destroyed, or anonymised, either automatically or upon your request, within the periods determined in the Company's Retention and Disposal Policy once the purposes requiring their processing cease to exist.

When determining retention periods, applicable statutory limitation periods and retention obligations are taken into account, including those under Turkish Commercial Code No. 6102, Turkish Code of Obligations No. 6098, Labour Law No. 4857, Occupational Health and Safety Law No. 6331, Tax Procedure Law No. 213, Social Insurance and General Health Insurance Law No. 5510, and Law No. 5651 on the Regulation of Publications on the Internet.

As a data subject, you may exercise the following rights by applying to the Company under Article 11 of the KVKK:

• To learn whether your personal data are being processed,
• To request information if your personal data have been processed,
• To learn the purpose of processing your personal data and whether they are being used in accordance with that purpose,
• To know the third parties to whom your personal data have been transferred, domestically or abroad,
• To request rectification of incomplete or inaccurate personal data and to request notification of the correction to the third parties to whom such data have been transferred,
• To request deletion or destruction of personal data in cases where the reasons requiring processing have ceased to exist, and to request notification thereof to third parties,
• To object to a result that arises against you through the analysis of processed data exclusively by automated systems,
• To claim compensation for damages arising from unlawful processing of your personal data.

Pursuant to Article 13(1) of the KVKK and the Communiqué on the Procedures and Principles for Application to the Data Controller, you may submit your request to exercise the above rights using one of the methods below:

Your application must include: name, surname and signature (if written), Turkish ID number (for foreign nationals: nationality, passport number or ID number if available), residential or business address for service, e-mail address, phone and fax number (if any), and the subject of the request. Supporting documents and information must also be attached.

The Company will respond to your request free of charge within thirty days at the latest. If a processing fee is applicable, the tariff set by the Personal Data Protection Board may be charged.

Company Name: SİSKON ENDÜSTRİYEL OTOMASYON SİSTEMLERİ SANAYİ VE TİCARET A.Ş.
Address: Adatepe Mahallesi Doğuş Caddesi D.E.Ü. Tınaztepe Yerleşkesi No:207/AG K:2 No:202 DEPARK Beta Binası Buca / İzmir
E-Mail: [email protected]
Data Controller Registry (VERBİS): https://verbis.kvkk.gov.tr