By Teknova Matbaacılık Kimya Sanayi ve Ticaret Anonim Şirketi (“Teknova”); customers, suppliers, the Republic of Turkey of the personal data of natural persons, including visitors and staff Constitution and the 6698 numbered Law on the Protection of Personal Data ( “KVKK”) to be processed by the relevant legislation, especially and principles to be applied in the protection are determined.

In this direction, Teknova carries out the processes regarding the processing, storage, and transfer of all personal data of real persons whose data is processed by the KVKK, other relevant legislation, and Teknova Personal Data Policy (“Policy”).

Teknova takes administrative and technical protection measures required by the nature of the data by the relevant legislation and technology for the protection of personal data.

Real persons whose personal data are processed within the scope of the Law can obtain information about the personal data that can be processed as a data controller by Teknova and their processing purposes, the recipient groups to which they can be transferred, the method of collection, deletion or anonymization and the rights of the persons by examining the following text.

1) INFORMATION OF THE DATA CONTROLLER

Title: Teknova Matbaacılık Chemical Industry and Trade Corporation

Address: Akçaburgaz Mahallesi 3101 sok. No 6 Kıraç Esenyurt / İstanbul

Tax Number: 836 043 6904

Mersis Number: 0836043690400014

KEP address: hs01@teknovamatbaacilik.kep.tr

Website: www.teknova.com.tr

2) SCOPE

Protection of personal data is only related to natural persons; Data belonging to legal persons and not containing information about real persons are not covered by the Policy. All personal data acquired and processed during Teknova activities of personnel, visitors, customers, prospective customers, suppliers, website visitors, and other real persons whose personal data are processed are covered by this Policy.

3) DEFINITIONS

Explicit consent; Consent on a specific subject, based on the information and expressed with free will,

Anonymization; making personal data unidentified or identifiable in any way, even by matching other data,

Related person; the real person whose personal data is processed,

Personal data; any information regarding an identified or identifiable natural person

Data processor; the natural or legal person who processes personal data on his behalf based on the authority given by the data controller,

Data recording system; the recording system in which personal data are structured and processed according to certain criteria,

Data controller; The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system,

KVKK; Law No. 6698 on the Protection of Personal Data,

Policy; Teknova Personal Data Protection Policy,

Registered Electronic Mail (KEP); refers to the secure e-mail service where the sender and recipient identities are known, the delivery time and content cannot be changed, and have legal validity in case of conflict.

4) PRINCIPLES ON THE PROCESSING OF PERSONAL DATA

In the processing of personal data, Teknova acts by the following principles by the general principles stipulated in the legislation, the Constitution, and KVKK.

a) Compliance with the law and good faith:

Teknova acts by the law and honesty within the scope of the processing of personal data; By applying the principles of proportionality and necessity in the processing of personal data, it processes only the necessary amount of personal data at a level that is suitable for data processing purposes.

b) Being accurate and up-to-date when necessary:

Teknova takes the necessary measures to ensure that the personal data they are processing is accurate and up to date.

c) Processing for specific, explicit, and legitimate purposes:

Teknova processes personal data for specific, clear, and legal reasons. Teknov determines the purpose for which personal data will be processed and presents these purposes to the data owners before the personal data is processed. It does not process legitimate and unlawful personal data.

d) Being connected, limited, and measured for processing:

Teknova avoids the processing of personal data that is not relevant or needed for processing.

e) Keeping for the period stipulated in the relevant legislation or required for the purpose for which they are processed:

Teknova preserves it only for the periods stipulated in the laws or for the purpose for which they are processed.

5) PURPOSE OF PROCESSING PERSONAL DATA

Teknova, personal data within the personal data processing conditions specified in articles 5 and 6 of KVKK; It is clearly stipulated in the Laws in Article 5 of the KVKK, the data controller must fulfill its legal obligations, It is necessary to process personal data belonging to the parties of the contract, provided that it is directly related to the establishment or execution of a contract, The fact that data processing is mandatory is processed within the scope of legal reasons.

• Processing data for a business relationship

It is clearly stipulated in the Laws in Article 5 of the KVKK, the data controller must fulfill its legal obligations, It is necessary to process personal data belonging to the parties of the contract, provided that it is directly related to the establishment or execution of a contract, The legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms. Personal data of the personnel are collected and processed in line with legal reasons that data processing is mandatory.

Establishing, arranging, and executing employment contracts with personnel, planning the human resources process, documenting the entry and exit of work, fulfilling legal obligations, arranging the information and documents that will be the basis of the works and transactions to be carried out on paper or in an electronic environment, making the reporting and examinations that are required by law, Personal data are processed to ensure order and security.

Information provided by the personnel (identity information, name, surname, TR identity number, gender, date of birth, contact data, e-mail address, address and telephone information, signature and similar information on signed documents) in personal files and computers; Records and information are collected and processed by manual or fully automated methods by the security cameras in the workplace and the execution of the necessary transactions.

Persons and organizations to which personal data can be transferred to the extent permitted by legislation and required by business processes are public legal entities and judicial bodies. The personal data in question may be transferred to judicial authorities or relevant law enforcement officers to resolve legal disputes or upon request by the relevant legislation. Also, personal data may be shared with public institutions and other organizations due to legal obligations, as required by legislation, due to transactions such as insurance transactions within the scope of social security.

• Processing of personal data of customers, prospective customers, representatives of legal entities that are customers, authorities and contacts, suppliers and visitors, website visitors

Your personal data are clearly stipulated in the Laws specified in Article 5 of the KVKK, the data controller must fulfill its legal obligations, It is necessary to process personal data belonging to the parties of the contract, provided that it is directly related to the establishment or execution of a contract, provided that your fundamental rights and freedoms are not damaged, In line with the legal reasons that data processing is mandatory for legitimate interests, to establish, regulate, executing and fulfilling legal obligations within the scope of commercial activities in terms of customers, potential customers, representatives of legal entities that are customers, officials and contacts, suppliers, visitors. arranging the information and documents that will be the basis of the works and transactions to be carried out on paper or electronically, issuing invoices, preparing price offers, provided that they are limited. Personal data are processed within the scope of the purposes of presenting it by giving it and ensuring order and security in the workplace.

Your personal data within the personal data processing conditions specified in articles 5 and 6 of the KVKK; By visiting the website, visiting the company headquarters, sharing in telephone and e-mail correspondence, sending your personal data electronically with the request for the offer, submitting it in print form by mail, including your information in the text of the offer and also transferring the information by you; Also, if you enter into a commercial or legal relationship with TEKNOVA, your contact data (e-mail address, address, and telephone information, IP address), especially your identity information (name, surname, Turkish identity number, gender, date of birth), Your signature and other information in your signature circular is collected and processed by TEKNOVA manually or by fully automatic methods within the scope of TEKNOVA’s field of activity.

Your personal data processed by TEKNOVA, to fulfill legal responsibilities and to ensure the performance of the contract, to provide the requested product and/or service, to submit a product and/or price offer, with real and legal entities working together within the scope of the activity permitted by the legislation and required by business processes, shareholders, suppliers, public institutions and organizations authorized to request this data, and judicial bodies.

• Data Processing for Workplace Safety

Provided that it does not harm the fundamental rights and freedoms of the data subject in Article 5 of the KVKK, data processing is mandatory for the legitimate interests of the data controller and data processing is mandatory for the establishment, use, or protection of a right, based on the legal grounds of the relevant person’s fundamental rights and freedoms. the entrance doors, the exterior of the building, dining hall, cafeteria, visitor waiting room, parking lot, security cabin, and floor corridors in the service area of ​​Teknovais place, provided that they do not harm their freedoms, and the sign and the letters indicating the registration (including the letter directing to this Policy) Images are recorded 24/7 to ensure safety in the workplace using 13 security cameras. Records and data are collected and processed to ensure the safety of the building, workplace, staff, visitors, and other persons, and these records are kept for 35 days. Camera recordings are collected and processed automatically. Records kept to ensure workplace safety may be shared with judicial bodies in case of violation of workplace safety or case of doubt regarding security, to protect the right and legitimate interests, if necessary; may be transferred to judicial authorities or relevant law enforcement agencies.

6) CLASSIFICATION OF PERSONAL DATA

6.1. Personal data

Personal data; all kinds of information regarding an identified or identifiable natural person. Personal data cannot be processed without the express consent of the data subject.

However, in the event of one of the following conditions, it is possible to process personal data without seeking the explicit consent of the person concerned; It does not seem possible to process personal data without express consent, except in these cases:

1. It is clearly prescribed in the laws,
2. It is mandatory for the protection of the life or physical integrity of the person who is unable to disclose his consent due to the actual impossibility or whose consent is not legally valid,
3. Provided that it is directly related to the establishment or performance of a contract, it is necessary to process personal data belonging to the parties to the contract,
4. The data controller must fulfill his legal obligation.
5. It is made public by the person concerned,
6. Data processing is mandatory for the establishment, use, or protection of a right,
7. It is mandatory for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed.

6.2. Special quality personal data

Individuals’ race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress and dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures, and biometric and genetic data are qualified personal data.

7) TEKNOVA’S LIABILITIES

• Obligation to Disclose Personal Data Owner

Teknova enlightens the persons whose data will be processed during the acquisition of personal data on how their data will be processed. In the lighting text

1. Identity of the data controller and its representative, if any,
2. For what purpose personal data will be processed,
3. To whom and for what purpose the processed personal data can be transferred,
4. The method and legal reason for collecting personal data,
5. In Article 11 of the Law, the rights of the person concerned should be included.

• Obligation to ensure data security

Teknova takes administrative and technical measures and updates its measures to prevent unlawful disclosure of personal data. If it detects that personal data has been disclosed unauthorized, it creates infrastructures to notify the Related Person and the Personal Data Protection Board.

Technova takes technological, administrative, and technical measures to prevent unlawful processing and access of data and to ensure that they are stored by the law.

Teknova,

• Educates and supervises its personnel about the legal processing of personal data,
• Processes personal data limited to the commercial activities it carries out,
• It takes measures to inform the Personal Data Protection Board in case of unlawful disclosure of personal data/data leakage.

To prevent unlawful access to personal data;

• Establishing security systems,
• Taking technical measures, updating and renewing,
• Creates and controls data recording systems by the legislation,
• It determines possible risks and develops systems against them.

8) EXPRESS CONSENT

Written or verbal consent, which is related to a specific subject, is based on the information and that reveals the will to process data about it with free will, is express consent. Explicit consent can always be revoked by the data owner.

Explicit consent can be obtained by having the explicit consent form signed by the data owner or by including these necessary elements in the contract or electronic form with the data owner.

9) RIGHTS OF PERSONAL DATA OWNERS AND ANSWERING APPLICATIONS

Personal data owners can use their rights stated in the KVKK regarding their data by applying in writing or by other methods to be determined by the Board. In this context, Teknova should take the necessary administrative and technical measures to fulfill its obligations under article 13 of the KVKK.

Personal data owners have the following rights within the scope of KVKK:

• Learning whether personal data is processed,
• If personal data has been processed, to request information regarding this,
• Learning the purpose of processing personal data and whether they are used by their purpose,
• To know the third parties to whom personal data are transferred domestically or abroad,
• To request correction of personal data in case of incomplete or incorrect processing,
• Although it has been processed by the provisions of KVKK and other related laws, to request its deletion or destruction in case the reasons requiring its processing disappear,
• In case of correction, deletion, or destruction of personal data, requesting that these transactions be notified to third parties to whom personal data is transferred,
• Object to the occurrence of a result against the person himself by analyzing the processed data exclusively through automated systems,
• You have the right to demand compensation for the damage in case of damage due to the unlawful processing of your personal data.

Only requests of personal data owners submitted to Teknova in writing are processed. Depending on the nature of the request, the relevant request should be answered as soon as possible and within 30 (thirty) days at the latest.

In cases where the application is rejected, the response given to the application is insufficient or the response is not given in time; the applicant has the right to make a complaint to the Personal Data Protection Board within 30 (thirty) days from the date of learning the answer and in any case within 60 (sixty) days from the date of application.

10) EVALUATION PROCEDURE OF THE APPLICATION OF PERSONAL DATA OWNERS

Requests made to start the response period specified in the 9th article of the Policy, in writing and with wet signature, in Akçaburgaz Mahallesi 3101 street. No 6 Kıraç Esenyurt / İstanbul by hand or via a notary public or electronically signed and sent to the address “hp01@teknovamatbaacilik.kep.tr” or by other methods determined by the Personal Data Protection Board, together with the information and documents proving the identity of the applicant.

If the request is accepted, the relevant process is applied, and written or electronic notification is made. If the request is rejected, the reason is explained to the applicant in writing or electronically.

11) STORAGE OF PERSONAL DATA

Teknova stores personal data for the period required by the purpose of processing, except for the periods stipulated by the legislation.

The purposes of processing personal data are explained in Article 5; are kept for the same purposes.

Although it has been processed by the provisions of the KVKK and other relevant laws, personal data are deleted, destroyed, or anonymized by the data controller, ex officio, or upon the request of the person concerned, if the reasons for its processing disappear. The provisions of other laws regarding the deletion, destruction, or anonymization of personal data are reserved. Technical infrastructure systems are established and used by Teknova; The provisions of the legislation and the decisions of the Personal Data Protection Board are complied with in terms of destruction, deletion or anonymization.

12) DATA SHARING CONDITIONS

For personal data to be shared, one of the following conditions is sought:

1. Obtaining the explicit consent of the data owner,
2. It is clearly stipulated in the laws,
3. It is mandatory for the protection of the life or physical integrity of the person who is unable to disclose his consent due to the actual impossibility or whose consent is not legally valid,
4. Provided that it is directly related to the establishment or performance of a contract, it is necessary to process personal data belonging to the parties to the contract,
5. The data controller must fulfill his legal obligation,
6. It is made public by the person concerned,
7. Data processing is mandatory for the establishment, use, or protection of a right,
8. It is mandatory for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed.

Teknova personal data is explicitly stipulated in the laws, the data controller must fulfill its legal obligations, It is necessary to process personal data belonging to the parties of the agreement, provided that it is directly related to the establishment or performance of a contract, For the legitimate interests of the data controller, provided that it does not harm your fundamental rights and freedoms. Mandatory data processing can be transferred based on legal reasons. In this direction, to act by the law, to fulfill legal obligations, to ensure the establishment or performance of a contract and to provide legitimate interests provided that fundamental rights and freedoms are not harmed, to fulfill the requirements of employment contracts, to fulfill legal obligations, to make reports and examinations that are required by law, in a limited and proportionate manner within the scope of the purposes of making, giving price offers, fulfilling tax liabilities, ensuring order and safety in the workplace. Personal data for these purposes,

• To our business partners,
• Public institutions and organizations,
• Legally authorized private legal persons,
• Our suppliers
• It is shared with judicial authorities, law enforcement agencies, and judicial bodies if required/requested.

Teknova takes technical measures, not limited to the following:

• It takes in-house technical measures for the processing and storage of personal data by the legislation, and creates a technical infrastructure that will ensure security,
• It periodically updates and renews technical measures,
• Virus protection systems, firewalls, and similar security applications.

Teknova takes administrative measures, but are not limited to:

• Establishes policies and procedures for access to personal data within the company,
• Informing and educating personnel about the legal processing, storage, and protection of personal data,
• It determines the measures to be taken in cases of unlawful processing of personal data.

13) UPDATE

Teknova reviews and updates this Policy at least once a year, whenever necessary, and when required by legislative changes.