Data Protection

ASİL GROUP PERSONAL DATA PROTECTION, PROCESSING AND DESTRUCTION POLICY

This Personal Data Protection Policy ("Policy") sets out the principles to be followed within and/or by ASİL GROUP KOZMETİK İMALAT SANAYİ VE TİCARET LİMİTED ŞİRKETİ ("COMPANY") while fulfilling its obligations regarding the protection of personal data and processing personal data in accordance with the Personal Data Protection Law No. 6698 and the relevant legislation.

The Company undertakes to act in accordance with this Policy and the procedures to be implemented pursuant to this Policy with respect to the personal data processed within its organization.

2. PURPOSE

The main purpose of this Policy is to provide explanations regarding the systems established for the processing and protection of personal data in compliance with the law and the purpose of the Law, and to inform the Company's stakeholders, authorized persons, business partners, job applicants, visitors, customers, prospective customers, and third parties accordingly.

Accordingly, it is aimed to ensure full compliance with the applicable legislation in all personal data processing and protection activities carried out by the Company and to safeguard all rights of personal data subjects arising from the legislation.

3. SCOPE

3.1. This Policy applies to all activities in which ASİL GROUP processes personal data.
3.2. It does not apply to data that does not qualify as personal data.
3.3. It may be updated in line with personal data protection regulations or the decision of the data controller's representative.

4. DEFINITIONS

The definitions used within the scope of this Policy are set out in Annex-1 in accordance with the applicable legislation.

5. PRINCIPLES OBSERVED IN THE PROCESSING OF PERSONAL DATA

5.1 Processing in accordance with the law and the principles of good faith
5.2 Ensuring accuracy and keeping data up to date
5.3 Processing for specific, explicit, and legitimate purposes
5.4 Processing in a manner that is relevant, limited, and proportionate to the purpose
5.5 Retaining data for the period required by the relevant legislation or the purpose for which it is processed

6. MATTERS RELATING TO THE PROCESSING OF PERSONAL DATA

Personal data may be processed based on explicit consent or within the scope of the exceptions provided under personal data protection legislation.

6.1 Explicit Consent

Obtained after providing the necessary information
Rights are communicated in advance
Stored in a verifiable manner

6.2 Circumstances Where Personal Data May Be Processed Without Explicit Consent

Protection of life or physical integrity
Conclusion or performance of a contract
Compliance with a legal obligation
Data made public by the data subject
Legitimate interest

7. PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA

Data relating to health and sexual life may only be processed for reasons such as the protection of public health and similar purposes. Other special categories of personal data require either explicit consent or a legal basis.

8. DELETION, DESTRUCTION, AND ANONYMIZATION OF PERSONAL DATA

8.1 Deletion: Making personal data inaccessible and unusable
8.2 Destruction: Physical disposal of personal data
8.3 Anonymization: Rendering personal data incapable of being associated with an identifiable individual

9. TRANSFER OF PERSONAL DATA

Transfers of personal data to third parties within Türkiye and abroad are carried out in accordance with personal data protection legislation. Necessary security measures and contractual safeguards are ensured.

9.1 Transfers Within Türkiye

Transfers are carried out without explicit consent where permitted under Articles 5/2 and 6/3 of the Personal Data Protection Law, or otherwise based on explicit consent.

9.2 Transfers Abroad

The Board's list of safe countries
Commitment to provide adequate protection and approval of the Board

10. RIGHTS OF DATA SUBJECTS

10.1 Rights

To learn whether personal data is being processed
To request information if personal data has been processed
To learn whether personal data is processed in accordance with its intended purpose
To learn the third parties to whom personal data has been transferred
To request the correction of incomplete or inaccurate personal data
To request the deletion of personal data if the reasons requiring its processing no longer exist
To object to decisions based solely on automated processing
To claim compensation if damage is suffered

10.1.2 Circumstances Where Rights Cannot Be Exercised

Certain circumstances are excluded pursuant to Article 28 of the Personal Data Protection Law.

10.1.3 Application Procedure

Data subjects may submit the application form to muhasebe@asilgroup.com.tr. If the application is submitted through an attorney, a special power of attorney is required.

10.1.4 Complaint to the Board

If the application is rejected, the response is deemed insufficient, or no response is provided within the legal period, an application may be filed with the Personal Data Protection Board.

10.2 Company's Obligation to Respond

The request shall be finalized within thirty (30) days at the latest. If a fee has been determined by the Board, the relevant amount may be requested.

11. DATA MANAGEMENT AND SECURITY

All employees are responsible for the protection and security of personal data. Access is restricted according to authorization levels, and appropriate security software and hardware measures have been implemented. The confidentiality obligation continues even after the termination of the business relationship.

Any amendments to this Policy shall be reflected by updating the text.

ANNEX-1 DEFINITIONS

Explicit Consent: Consent given freely based on prior information.
Relevant User: Authorized persons processing personal data.
Destruction: Deletion, destruction, or anonymization of personal data.
Recording Environment: Any environment in which personal data is processed.
Personal Data: Any information relating to an identified or identifiable natural person.
Anonymization: Rendering personal data incapable of being associated with an identifiable person.
Board: Personal Data Protection Board.
Special Categories of Personal Data: Health data, criminal records, biometric data, etc.
Periodic Destruction: Deletion or destruction carried out at specified intervals.