FOREWORD

Within the scope of the Personal Data Protection Law, we, MVD MAKİNA SAN. AŞ attach value to the protection of your personal data and/or private personal data. We are sensitive to the storage of all personal data and/or private personal data of you, which sent to our company through various means. In this regard, MVD MAKİNA SAN. AŞ has taken all technical and administrative measures in order to comply with the provisions of the Turkish Constitution and other legislation, particularly the Law No. 6698 on the Protection of Personal Data. We would also like to emphasize that we will protect your rights guaranteed by the law. In this regard, you can share your personal data with our company confidently and send us your suggestions, complaints and concerns.

We share with you our Privacy policy, which has been put into effect in our company, which is particularly significant for the protection of your personal data.

MVD Makina Sanayi A.Ş.

1. THE AIM OF THE PRIVACY POLICY

Protecting the personal data and complying with laws is our fundamental principle. Our company has always shown the necessary sensitivity to the protection of personal data and/or private personal data. MVD MAKİNA SAN. AŞ (hereinafter referred to as “MVD” or “Company”) has kept confidential the personal data and/or private personal data obtained from you and has not been shared with third parties. In accordance with the Law No. 6698 on the Protection of Personal Data, our internal regulations have been amended and all technical and administrative measures have been taken. In the ongoing process, MVD agrees, declares and undertakes to comply with all the responsibilities arising from the Laws.

2. THE SCOPE OF THE PRIVACY POLICY

This Privacy Policy is prepared in accordance with the Law No. 6698 on the Protection of Personal Data.

Your personal data and/or private personal data are obtained with your consent or in your accordance with the law. Your aforementioned data is used to;

– Ensuring company security,

– Providing you with full service,

– Carrying out our commercial activities,

– Abrubtly resolve your issues,

– and improve our quality.

Certain personal data and/or private personal data received from you are excluded from personal data and made anonymous in accordance with the Law. Data used for statistical purposes is not currently included in the regulation of the Law and the scope of our policy. As MVD, we are entitled to change in order to protect personal data in accordance with our data policy, regulation and directive within the scope of compliance with the Law.

The privacy policy aims to protect the customers, employees and all other persons data obtained by any means of real and legal persons with whom MVD is a solution partner.

3. BASIC PRINCIPLES FOR PROCESSING PERSONAL DATA AND/OR PRIVATE PERSONAL DATA

The main principle regarding the processing of personal data and/or private personal data are as follows: In this context, these principles shall apply to the data that MVD collects or processes based on consent or in accordance with the Law.

– Legal Compliance: MVD queries the source and legal compliance of personal data and/or private personal data received from real and legal persons through various means. Accordingly, it is important for MVD to obtain the data legally.

– Compliance with the Rules of Integrity: MVD queries the source of personal data and/or private personal data received from real and legal persons through various means. Accordingly, it is important for MVD to obtain data in accordance with the principles of integrity.

– Being Limited Measured and Connected with the Purpose of Processing: MVD uses the personal and/or private personal data obtained through various means to the extent required by the performance of the service, in limited, quantitative form for the purpose of processing.

– Accuracy of Personal Data and/or Private Personal Data: MVD attaches importance to the lack of incorrect information and to the accuracy of personal data and/or private personal data received from real and legal persons through various means.

– Being Up-to-Date when required: If the personal data and/or private personal data obtained by MVD in various ways have been modified, MVD attaches importance to the communication of the aforementioned change to the company and updating the data if communicated.

– Processing for Specific and Legitimate Purposes: MVD processes the data in accordance with the data subject’s approval in order to carry out the commercial activity and perform the business. It does not process or use personal data other than for the purpose of conducting business and performing the work. It does not allow third parties to use and process.

– Preserving for the Period Stipulated by the Law and/or Required for the Purpose of Processing: MVD stores the personal data and/or private personal data obtained during the periods stipulated by the relevant laws. Accordingly, it keeps the contractual personal data as timely-out and conflict-over periods stipulated by the Laws as per the requirements of the Trade, Payables and Tax Law. When these objectives are over, the Company anonymizes, destroys or deletes the data. These data are deleted and destroyed in accordance with “THE PERSONAL DATA STORAGE, TRANSFER, DELETION AND ANOYNMIZATION POLICY”.

– Being Up-to-Date when required: If the personal data and/or private personal data obtained by MVD in various ways have been modified, MVD attaches importance to the communication of the aforementioned change to the company and updating the data if communicated.

– Processing for Specific and Legitimate Purposes: MVD processes the data in accordance with the data subject’s approval in order to carry out the commercial activity and perform the business. It does not process or use personal data other than for the purpose of conducting business and performing the work. It does not allow third parties to use and process.

– Preserving for the Period Stipulated by the Law and/or Required for the Purpose of Processing: MVD stores the personal data and/or private personal data obtained during the periods stipulated by the relevant laws. Accordingly, it keeps the contractual personal data as timely-out and conflict-over periods stipulated by the Laws as per the requirements of the Trade, Payables and Tax Law. When these objectives are over, the Company anonymizes, destroys or deletes the data. These data are deleted and destroyed in accordance with “THE PERSONAL DATA STORAGE, TRANSFER, DELETION AND ANOYNMIZATION POLICY”.

4. RIGHTS OF THE RELEVANT WHO REQUESTS INFORMATION PURSUANT TO ARTICLE 11 OF THE LAW ON PROTECTION OF PERSONAL DATA

The rights of the data subject have been vested in Article 11 of the Law No. 6698 on the Protection of Personal Data. In the law, the data subject is considered the relevant person; the right to make certain requests regarding the processing of data is foreseen. The rights of the person concerned in accordance with this article are as follows:

a) Finding out if the personal data has been processed,

b) Requesting information if the personal data has been processed,

c) Learning the purpose of processing the personal data and whether it has been used in accordance with its purpose,

d) Knowing the third parties to whom personal data is transferred, whether in Turkey or abroad,

e) Requesting correction of the personal data if it has been processed incompletely or incorrectly,

f) Requesting the deletion or destruction of the personal data in accordance with the requirements laid down in Article 7 of the Law titled “Deletion, destruction or anonymization of personal data”.

g) Requesting notification of the third parties to whom the personal data is transferred to the information that the missing or incorrectly processed data has been corrected or that the data has been deleted or destroyed upon the request of the relevant person,

h) Objection to the occurrence of an outcome against the person by analysing the processed data exclusively through automated systems,

i) Requesting compensation for damages if the personal data is incurred due to illegal processing.

The “Information Request Form”, which is prepared pursuant to Law No. 6698, regarding the application process that allows you to exercise your rights, has been uploaded to the website by MVD. You, whose personal data is processed, may exercise the aforementioned rights by following the application procedures and principles on our website.

5. DELETION, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATAYour personal data and/or private personal data are deleted, destroyed or anonymized by the expiration of the statute of limitations and storage periods stipulated by the Law, completion of judicial proceedings or the end of other requirements that are suitable for purpose. These data are deleted and destroyed in accordance with the “POLICY OF STORAGE, TRANSFER, DELETION AND ANONYMIZATION”. Deletion, destruction and anonymization are performed ex officio (automatically) upon request of the data subject or by MVD.

6. THE STINGINESS PRINCIPLE

Maximum Savings Policy or also known as the Stinginess Principle. The personal data and/or private personal data obtained through various means are transferred to the Company’s system. As per this principle, the data is entered into the system as needed.

The data collected by MVD is determined according to the purpose and varies. In this regard, the data are parallel with the purpose are collected and the data are non-parallel with the purpose are not collected. Any excess data other than its purpose are not recorded in the company system, they are deleted or anonymized. But the data in question can be used for statistical purposes.

7. PRIVACY AND SECURITY OF DATA

At MVD, we attach importance to the confidentiality of your personal data and/or private personal data. In this regard, your personal data and/or private personal data that have been received by your Company through various means shall be confidential. MVD observes the confidentiality of such data at every stage of its commercial activities. Accordingly, full compliance with this Company’s privacy policy is ensured. Necessary technical and administrative measures are taken to ensure that the personal data and/or private personal data collected through various means are not transferred to unauthorised persons, that the rights of the data subject are not harmed, that there are no victims and that the data is protected. In addition, data protection is requested from the companies with which we share personal data and/or private personal data within the scope of Legal Compliance. Our software programs are also updated and constantly updated. All technological requirements are met and standards are complied with in order to ensure high-level protection.

8. Up-to-dateness of Data

Within MVD, the principle of up-to-dateness is essential. Because personal data and/or special personal data obtained in various ways are processed and updated upon request. MVD shall take the necessary precautions.

9. Accuracy of Data

MVD has adopted the principle of the accuracy of the declared personal data and/or private personal data. MVD does not have to investigate the accuracy of personal data and/or private personal data declared by its customers or real and legal persons in contact with them. Because this is not possible in accordance with our Code and working principles. In this context, all transactions are performed on the grounds that the declared data is correct.

10. PURPOSE OF PROCESSING PERSONAL DATA AND/OR PRIVATE PERSONAL DATA

The processing of personal data and/or private personal data shall be carried out in line with the purposes in the clarification text of the MVD. The clarification text is available on the MVD’s website.

11. PROCESSING PERSONAL DATA AND/OR PRIVATE PERSONAL DATA

MVD may process your personal data and/or private personal data in order to carry out its business activities, to ensure the performance of the service and to fulfil legitimate purposes. The data subject to the discussion shall never be used for Illegal services or for illegitimate reasons. Special care is also taken in the processing of private personal data. The Company respects the “Policy on the Protection and Processing of Private Personal Data” regarding the processing of private personal data. In addition, all necessary and adequate measures determined by the Board are taken when processing private personal data.

12. PROCESSING PERSONAL DATA AND/OR PRIVATE PERSONAL DATA FOR ADVERTISING

Approval must be obtained from the recipient for electronic messages sent for advertising purposes. In this context, only advertising electronic messages can be sent to pre-approved individuals. The subject is also clearly regulated in the “Regulation on the Regulation of Electronic Commerce and on Commercial Communication and Commercial Electronic Messages”.

MVD acts in accordance with the aforementioned Law when sending electronic commercial messages for advertising purposes. It also respects the obtaining of approval in accordance with the Law and the details of the approval. The approval aforementioned; it may be taken in physical form with any electronic communication tool or in writing. The basis for the approval is the presence of a positive declaration of intention that the commercial electronic message receiver accepts the sending of commercial electronic messages, an electronic contact address and a first and last name.

The approval received from the Buyer should encompass all commercial electronic messages sent to electronic communication addresses in order to increase its recognition with contents such as marketing and promoting the Company’s goods and services, acquainting its business, ensuring its recognition, celebrating, wishing and congratulating etc.

13. DATA TRANSACTIONS PERFORMED DUE TO THE COMPANY’S LEGAL OBLIGATION AND THE EXPRESSION OF THE LAW

Personal data may be processed without further approval, but only for the purpose of explicitly indicating data processing in the relevant Law and/or fulfilling a legal obligation set out in the Law. The type and scope of the processed data must be required for the legally permitted data processing activity. In any case, compliance with the provisions of the related Law is essential.

14. COLLECTION AND PROCESSING OF PERSONAL DATA WITHIN THE CONTRACT RELATIONSHIP

If a contractual relationship has been established with customers or prospects, the data collected according to the contract can be used without any permission by……………………….. These personal data are used in accordance with the performance of the service, execution of the contract, execution of the commercial activity and the requirements. These data can be updated by contacting customers.

15. PERSONAL DATA SHARED WITH SOLUTION PARTNERS AND COMMERCIAL PARTNERS

MVD has made it a principle to act in accordance with the Law on sharing personal data. Accordingly, the Company complies with the provisions of the related Law when sharing data with its business-solution partners and commercial partners.

With its data confidentiality commitment, MVD only shares the necessary personal data with its business-solution partners and commercial partners for the performance of the service, the operation of the business and the continuity of the commercial activity. With shared data, business-solution partners and commercial partners are required to take the necessary administrative and technical measures to ensure data security.

16. PERSONAL DATA AND/OR PRIVATE PERSONAL DATA PROCESSED THROUGH AUTOMATIC SYSTEMS

Data acquired from the information obtained through automatic systems without the express consent of persons cannot be used against individuals. MVD can make decisions only with the persons to perform transactions using the data in its system. On the basis of all these, MVD acts in accordance with all relevant legislation provisions regarding personal data processed through automatic systems and/or private personal data.

17. PERSONAL DATA AND/OR PRIVATE PERSONAL DATA OF MVD MAKİNA SAN. AŞ EMPLOYEES

PROCEDURES CARRIED OUT UNDER LEGAL OBLIGATIONS: Personal data belonging to employees may be processed by MVD without prior approval in order to have a clear provision in the relevant Law on data processing or to fulfil the obligations stipulated by the Law. Processing of such data is limited to the fulfilment of obligations under the Law.

PROCESSING OF PERSONAL DATA IN ACCORDANCE WITH EMPLOYMENT AGREEMENT AND BUSINESS RELATIONSHIP: Personal data of employees can be processed as much as necessary to ensure the employment relationship between the company and the employees without the approval of the employees. MVD undertakes to protect and confidentially the data belonging to the employees in all circumstances and to take all kinds of precautions in this regard.

PROCESSING PRIVATE PERSONAL DATA OF EMPLOYEES: Pursuant to the Law No. 6698 on the Protection of Personal Data, the approval of the person whose data is to be processed and the necessary measures required by the Board are to be taken. In accordance with the Law and the principles of the Board, MVD processes private personal data, obtaining the approval of the relevant person and taking the necessary measures as determined by the Board. However, private personal data may be processed in exceptional cases stipulated by the Law without the consent of the relevant person, provided that it is limited and measured.

PERSONAL DATA PROCESSED THROUGH AUTOMATIC SYSTEMS: Employees can process some personal data in automatic systems. These data are used in the performance evaluation of employees, in the retention of statistical data, in promotions and ratings for the Company. Employees have the right to object to the consequences of the violation. The objection should be carried out in accordance with the internal rules and procedure. This objection is subject to internal evaluation.

PROCESSING PERSONAL DATA FOR THE BENEFIT OF EMPLOYEES: Personal data belonging to employees can be processed by MVD without obtaining approval for transactions related to the employee’s benefit. The Company may process the personal data of its employees in disputes related to the business relationship of the MVD.

INTERNAL TELECOMMUNICATION, INTERNET AND COMMUNICATION: In order to facilitate the execution of the work, MVD may provide computers, phones, vehicles, applications, software and email to employees within the Company. MVD can control and inspect personal data on the vehicles it allocates.Employees cannot use the vehicles allocated to them for special purposes. It is mandatory to use it only for the purpose of fulfilling the work. Furthermore, the employee accepts, declares and undertakes that he/she shall not keep any data, information, other than the necessity of the job, in the vehicles allocated from the start of the working relationship with MVD.

18. TRANSFER OF PERSONAL DATA DOMESTIC AND ABROAD

MVD may share personal data with its business-solution partners, commercial partners and controlling shareholders in order to perform the service and carry out the commercial activity. Furthermore, MVD will be able to transfer personal data that outsourced from the supplier to its suppliers in a limited and measured manner in order to provide the necessary service for the execution of the commercial activity.

In this regard, MVD is authorized to transfer personal data both domestically and abroad in accordance with the requirements stipulated by the Law and in accordance with the principles set by the Board and with the approval of the relevant person.

19. RIGHTS OF THE RELATED PERSON REQUESTING INFORMATION

The rights of the data subject have been vested in Article 11 of the Law No. 6698 on the Protection of Personal Data. MVD agrees that the approval of the relevant person must be obtained before the data is processed in accordance with the Law, and that it has the right to request, update, delete, destroy and anonymize information about the data of the related person after the data has been processed. Relevant persons can access “Information Request Form Pursuant to Law No. 6698” from the website of MVD and regarding their personal data;

a) They have to right of to find out if personal data has been processed,

b) They have the right of to request information if personal data has been processed,

c) They have the right of to learn the purpose of processing personal data and whether it has been used in accordance with its purpose,

d) They have the right of to know the third parties to whom personal data is transferred, whether in Turkey or abroad,

e) They have the right of to request correction of personal data if it has been processed incompletely or incorrectly,

f) They have the right of to request the deletion or destruction of personal data in accordance with the requirements laid down in Article 7 of the Law titled “Deletion, destruction or anonymization of personal data”,

g) They have the right of to request that incomplete or incorrectly processed data have been corrected, or that the data has been deleted or destroyed upon the request of the relevant person, or that the personal data be notified to the third parties to whom it has been transferred,

h) They have the right of objection to the occurrence of an outcome against the person by analysing the processed data exclusively through automated systems,

i) They have the right of to request compensation for damages in the event of a loss due to illegal processing of personal data

Applications for the above-mentioned requests are made by completing the application form obtained from the Company’s website or from the Company. The application form shall be signed with a wet-ink signature (along with a copy of the identification) and sent by a notary public to the REM address registered at our company address or to [info@ corporate extension]. Applications must belong to the person concerned. No application can be made for information requests regarding the personal data of another person. In addition, the Company will not answer any information requests made on behalf of another person. f the MVD determines that the information request has been submitted on behalf of another person; MVD reserves the right to all lawsuits and requests. Requests of the relevant person shall be answered within thirty (30) days at the latest after receipt of the MVD. If MVD deems necessary, the applicant may request other information and documents. The person concerned with the personal data anonymized within the company does not have a right.

20. PRIVACY POLICY

All personal data and/or private personal data belonging to employees and persons who have received MVD from various means are confidential. No one may use, reproduce, transfer or copy personal data and/or private personal data outside the scope of the Contract, outside of the scope of the work and without any legal reasons.

21. CONTROL AND PROCESSING SECURITY

Necessary technical and administrative measures are taken to ensure that the personal data and/or private personal data collected through various means are not transferred to unauthorized persons, that the rights of the data subject are not harmed, that there are no victims and that the data is protected. In addition, data protection is requested from the companies with which we share personal data and/or private personal data within the scope of Legal Compliance. Our software programs are updated, constantly renewed and improved. All technological requirements are met and standards are complied with in order to ensure high-level protection. In parallel with all of these, MVD has performed all internal and external audits necessary to protect personal data and/or private personal data.

22. NOTIFICATION OF PERSONAL DATA VIOLATIONS

In the event of any breach of personal data, MVD shall take immediate action to do its part to remedy any breaches reported to it. Takes all necessary measures to minimize the loss of the relevant person. In this context, it compensates for the loss by minimizing the loss.

In the event that unauthorized third parties obtain personal data and/or private personal data, the Company notifies the subject directly to the Personal Data Protection Board. You may apply in accordance with the procedures set forth on the Company website for the notification of violations. Please also click on the “Information Request Form in accordance with Law No. 6698” to request information about the data.

23. UPDATE

Changes to this Privacy Policy are listed and shown in the table below.