SHAH SULTAN PERSONAL DATA PROTECTION AND PROCESSING POLICY

1. PURPOSE AND SCOPE
Maximum sensitivity is shown to the security of personal data in each of all our enterprises located within the structure of SHAH SULTAN. With this awareness, we attach great importance to the processing, recording, transfer, sharing and storage of all kinds of personal data belonging to all persons associated with our Companies, including the people who benefit from our products and services, in accordance with the Law on the Protection of Personal Data numbered 6698 (“KVK Law”). In line with the importance SHAH SULTAN attaches to the protection of personal data, the basic principles related to the compliance of the activities carried out by SHAH SULTAN with the regulations contained in the “KVK Law” are determined by the SHAH SULTAN KVK Policy. With the implementation of SHAH SULTAN KVK Policy regulations, the data security principles adopted by SHAH SULTAN will be made sustainable.
SHAH SULTAN KVK Policy is aimed at real persons and SHAH SULTAN employees, whose personal data are processed by SHAH SULTAN through automatic and non-automatic means, provided that they are part of any data system.

2. TARGET
With the Policy of SHAH SULTAN KVK, it is aimed to establish the necessary order to create the necessary systems and ensure compliance with the legislation in line with the goal of creating awareness about the processing and protection of personal data in accordance with the law within SHAH SULTAN Jul. In this context, SHAH SULTAN aims to guide the implementation of the KVK Policy, KVK Law and the regulations set out by the relevant legislation.

3. DEFINITIONS
The definitions used in the SHAH SULTAN KVK Policy and which are important are listed below:
Explicit Consent: Consent related to a specific topic, based on information and explained by free will. Anonymization: Making personal data unable to be associated with an identified or identifiable real person under any circumstances, even by matching it with other data.
Communiqué on the Procedures and Principles to be Followed in Fulfilling the Lighting Obligation: Communiqué on the Procedures and Principles to be Followed in Fulfilling the Lighting Obligation, which entered into force through publication in the Official Gazette dated March 10, 2018 and numbered 30356. Employee(s) SHAH SULTAN employee(s). Customer(s) who benefit from the services of SHAH SULTAN(s).
Regulation on the Processing of Personal Health Data: Regulation on the Processing of Personal Health Data and Ensuring Its Privacy, published in the Official Gazette dated October 20, 2016 and numbered 29863.
Personal Health Data: All kinds of information about the physical and mental health of an identified or identifiable natural person, as well as information about the health service provided to the person.
Personal Data: Any kind of information related to an identified or identifiable real person.
Personal Data Owner: The real person whose personal data is processed. For example; customers and employees
Personal Data Protection Unit: The unit that will provide the necessary coordination within the Company by SHAH SULTAN within the scope of ensuring, storing and maintaining compliance with the legislation on the protection of personal data.
Processing of Personal Data: All kinds of operations performed on the data, such as obtaining, saving, storing, storing, changing, rearranging, disclosing, transferring, inheriting, making available, classifying or preventing the use of personal data by means that are fully or partially automatic or non-automatic, provided that they are part of any data recording system.
Marches April 7, 2016 Law No. 6698, published in the Official Gazette No. 29677, dated March 24, 2016.
KVK Board: Personal Data Protection Board.
KVK Institution: Personal Data Protection Institution. KVK Compliance
Program: The program for ensuring compliance with the legislation on the protection of personal data, put into effect by SHAH SULTAN.
Special Categories of Personal Data: Race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, disguise, association, foundation or union membership, health, sexual life, criminal conviction and security measures related data, as well as biometric and genetic data.
SHAH SULTAN : All companies included in the structure of SHAH SULTAN.
SHAH SULTAN Business Partners: The parties with which SHAH SULTAN establishes business partnerships for various purposes while conducting his commercial activities.
SHAH SULTAN Personal Data Storage and Destruction Policy: According to the Regulation on the Deletion, Destruction, Anonymization of Personal Data, the “SHAH SULTAN Personal Data Storage and Destruction Policy”, which has been made the basis for the process of deletion, destruction and anonymization by SHAH SULTAN by determining the maximum period necessary for the purpose for which personal data are processed. SHAH SULTAN Suppliers are the parties that provide services to SHAH SULTAN on a contractual basis.
SHAH SULTAN Data Owner Application Form : Data owners, KVK Law 11. the application form that they will use when applying for their rights contained in the article.
Data Processor: A natural and legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.
Data Controller: The person who determines the purposes and means of processing personal data, manages the place where the data is stored in a systematic manner.
Register of Data Controllers: The Register of Data Controllers, which is kept under the supervision of the KVK Board, under the supervision of the Presidency of the Personal Data Protection Authority and is open to the public.
Communiqué on the Procedures and Principles of Application to the Data Controller: Communiqué on the Procedures and Principles of Application to the Data Controller, which entered into force through publication in the Official Gazette dated March 10, 2018 and numbered 30356.