Privacy Notice on the Law of the Protection of Personal Data

We, Taşyapı İnşaat Taahhüt Sanayi ve Ticaret A.Ş. (“Taşyapı” or “Company”), disclose the below information under our obligation to apprise you of our processing of personal data as a data controller according to the Law No. 6698 on the Protection of Personal Data (“LPPD” or “Law”) and secondary regulations:

1) What Information We Process and Why

Taşyapı processes data pertaining to natural persons and/or employees/officials representing legal persons who receive our goods and services, particularly in real estate. This personal data may include identity information, contact information, financial performance, credit and risk status, financial data including any assets, bank account information, invoices and valuable papers, and customer transaction data including product request information. Processing is limited to the purposes of providing goods and services; carrying out operations, sales, and after-sales support services; establishing contractual relations; managing any legal, financial, and/or accounting matters; following up requests and complaints; managing customer relations; and, if the data subject expresses explicit consent, running campaigns and promotional events on Taşyapı products and services;

Taşyapı also processes data pertaining to natural persons and/or employees/officials representing contractor/supplier companies offering services to the Company as part of any commercial relations. This personal data may include identity information, contact information, professional experience, and any personal data present in the personnel file. Processing is limited to the purposes of managing contract processes as part of our commercial activities; monitoring any operations, production activities, sales activities, and after-sales services related to our products and services; conducting any procurement, financial, and accounting procedures; and fulfilling our obligations under the Turkish Labor Law, the Law on Occupational Health and Safety, other applicable regulations, and labor contracts; and carrying out any auditing/ethics procedures.

Finally, Taşyapı processes data pertaining to natural persons visiting our website and contacting Taşyapı online. This personal data may include identity information, contact information, and transaction security data. Processing is limited to the purposes of managing corporate communication activities and tracking customer requests/complaints. In the cases of personal visits to our Company’s facilities, any security footage and license plate images of our visitors captured by our facilities’ security camera systems will only be processed to implement physical security at the Company, manage emergency management procedures, and create and track a visitor’s log.

If the reasons for processing any of these data are no longer valid, then the said data is destroyed either by erasure/wiping or by anonymization as per the LPPD, the relevant legislation, and our Company’s data storage and destruction policy.

2) With Whom and Why We May Share Your Information

The personal data described in Article 1 of this privacy notice may be transferred to authorized public organizations and institutions, any business partner/contractor/supplier companies cooperating with and providing services to the Company, and the group companies/subsidiaries of Taşyapı İnşaat Taahhüt Sanayi ve Ticaret A.Ş. Data transfer is done within the fundamental security and privacy principles outlined in the LPPD and is limited to the purposes described in the same Article on the condition that appropriate security precautions are observed.

3) How We Collect Your Personal Data and the Legal Justification

Taşyapı processes personal data in compliance with Article 5 of the Law stipulating that “Processing of personal data belonging to the Parties of a contract is necessary provided that it is directly related to the conclusion or fulfillment of that contract,” “It is mandatory for the legitimate interests of the controller, provided that such processing does not violate the fundamental rights and freedoms of the data subjects,” “It is stipulated in the law,” and “It is mandatory for the controller to fulfill its legal obligations.” Personal data is collected automatically or manually through the information systems of our Company upon verbal or written notice by data subjects or companies with which they enjoy a contractual relationship.

4) Rights of Data Subjects on the Protection of Personal Data

Under Article 11 of the LPPD, data subjects have the right to:

• Learn whether their personal data is being processed;
• Request further information if their personal data has been processed;
• Learn why their personal data is being processed and whether it is being used in line with the specified purpose;
• Learn the local or international third parties to whom their personal data is transferred;
• Request the correction of incompletely or inaccurately processed personal data;
• Request the deletion or destruction of personal data once the reasons for data processing cease to apply and request the notification of the third-party recipients of the data about such actions;
• Request compensation for any loss incurred because of unlawful processing of their personal data.

Data subjects may submit their requests involving their rights to our Company at Acıbadem Mahallesi, Çeçen Sokak, Almondhill Sitesi D Blok No.:19Z-1, Üsküdar/Istanbul by post, in person, or through notary by registered post with return notice, to our Company’s registered email address [email protected], or to our Company’s email address [email protected] on the condition of using a secure electronic signature, mobile signature, or an email address previously submitted to and saved by our Company. Our Company will conclude any such requests in compliance with the Communiqué on the Principles and Procedures for the Request to Data Controller within thirty days at the latest.