CHEMPLAST Packaging Protects with Safety

………………………………………. COMPANY
PRIVACY NOTICE REGARDING THE PROCESSING OF PERSONAL DATA

This Privacy Notice has been prepared by ……………………………….. Company (“Company”) to inform the Company’s customers about the processing of their personal data by the Company within the scope of the Personal Data Protection Law No. 6698 (“Law”).

Detailed information regarding the processing of your personal data within the scope of this Privacy Notice can be accessed at [www…………………….com] under the …………………………….. Company Personal Data Protection and Processing Policy.

a) Methods of Obtaining Personal Data and Legal Basis
Your personal data may be collected electronically or physically. Personal data collected for the legal reasons stated in this Privacy Notice may be processed and shared in accordance with the personal data processing conditions set forth in Articles 5 and 6 of the Law.

b) Purposes of Processing Personal Data
Your personal data is processed by the Company for the following purposes within the scope of Articles 5 and 6 of the Law:

• Planning and executing activities necessary for offering and promoting the Company’s products and services tailored to the preferences, usage habits, and needs of the relevant individuals,

• Conducting necessary operations and business processes to enable the relevant individuals to benefit from the products and services offered by the Company,

• Carrying out commercial activities conducted by the Company and executing associated business processes,

• Planning and executing the Company’s commercial and/or business strategies, and

• Ensuring the legal, technical, and commercial-business security of the Company and the relevant individuals who have a business relationship with the Company.

c) Parties with Whom Personal Data May Be Shared and Purpose of Sharing
Your personal data may be shared within the framework of Articles 8 and 9 of the Law and for the purposes stated above with:

• The Company’s business partners and suppliers,

• Legally authorized public institutions and organizations, and

• Legally authorized private law entities.

The purpose of such sharing is to plan and execute activities necessary for offering and promoting the Company’s products and services tailored to the relevant individuals’ preferences, usage habits, and needs; to conduct business processes; and to ensure the legal, technical, and commercial-business security of the Company and the individuals involved in business relationships with the Company.

d) Rights of Data Subjects and Exercising These Rights
As a data subject, you have the following rights under Article 11 of the Law:

• To learn whether your personal data is being processed,

• To request information if your personal data has been processed,

• To learn the purpose of processing your personal data and whether it is used in accordance with its purpose,

• To know the third parties in Turkey or abroad to whom your personal data has been transferred,

• To request the correction of your personal data if it has been processed incompletely or inaccurately, and to request that the correction be communicated to third parties to whom your personal data has been transferred,

• To request the deletion or destruction of your personal data in accordance with the Law and related legislation when the reasons requiring its processing no longer exist, and to request that this action be communicated to third parties to whom your personal data has been transferred,

• To object to the emergence of a result against the person by analyzing processed data exclusively through automated systems, and

• To request compensation for damages in case of unlawful processing of your personal data.

According to Article 28(2) of the Law, the rights mentioned above cannot be exercised in cases including:

• Processing of personal data is necessary for the prevention of a crime or investigation of an offense,

• Processing of personal data has been made public by the relevant person,

• Processing of personal data is necessary for public institutions and organizations or professional organizations with public institution status to carry out audit or regulatory duties, or to conduct disciplinary investigations or proceedings,

• Processing of personal data is necessary for the protection of the State’s economic and financial interests regarding budget, tax, and financial matters.

According to Article 28(1) of the Law, the rights of data subjects do not apply to the following personal data, and requests will not be processed for these data:

• Personal data processed entirely by individuals concerning themselves or their family members living in the same household, provided it is not shared with third parties and complies with data security obligations,

• Personal data processed for research, planning, and statistical purposes by making it anonymous,

• Personal data processed for artistic, historical, literary, scientific, or freedom of expression purposes without violating national defense, national security, public safety, public order, economic security, privacy, or personal rights,

• Personal data processed for preventive, protective, or intelligence activities by public institutions authorized by law to ensure national defense, national security, public safety, public order, or economic security,

• Personal data processed by judicial authorities or enforcement offices regarding investigation, prosecution, trial, or execution procedures.

Exercising Rights by Data Subjects
Data subjects can exercise their rights using the “Application Form for Requests to the Data Controller by the Data Subject” available at [ww……………..………..com].

Applications must be submitted along with documents verifying the applicant’s identity through one of the following methods:

• Sending the signed hard copy of the form by hand, via notary, or by registered mail to [………………………………………………………..-Turkey],

• Sending the form signed with a secure electronic signature under Law No. 5070 to [……………………..@hs02].kep.tr,

• Following another method prescribed by the Personal Data Protection Board.

The Company responds to requests within thirty (30) days as prescribed by the Law. Third parties may apply on behalf of data subjects only if a special power of attorney issued via a notary is provided by the data subject.

While applications are generally free of charge, fees may apply based on the tariff determined by the Personal Data Protection Board.

The Company may request additional information from the applicant to verify the identity of the data subject and may ask questions to clarify the details of the application.

[Reference: Official Gazette dated 10.03.2018 and No. 30356, “Communiqué on Procedures and Principles Regarding Applications to Data Controllers.”]