1. OBJECTIVE

The right of each individual to ask for protection of his/her own personal data is a divine right arising out of the Constitution. As Işık Perde Rayları San. Tic. A. Ş. , we regard fulfilling the requirements of this right as one of our most valuable duties. Therefore, we give importance to legal processing and protection of your personal data.

The Corporate Policy for Protection of Personal Data has been prepared to determine the principles we take as basis and the procedures we apply while processing and protecting personal data as a result of the importance we give to the protection of personal data.

2. SCOPE

This policy includes any and all operations performed on the data such as obtaining through the methods which are completely or partly automatic or non-automatic provided that it is a part of any data recording system, recording, storing, keeping, changing, rearranging, explaining, transferring, taking over, making available, classifying or preventing use of all personal data managed by Işık Perde Rayları San. Tic. A. Ş.

This policy is related to any and all processed personal data of the partners, authorities, customers, employees, supplier authorities and supplier employees of Işık Perde Rayları San. Tic. A. Ş. and third parties.

Işık Perde Rayları San. Tic. A. Ş. can change the Policy for the purposes of compliance with the legislation and the decision of Committee of Protection of Personal Data and better protection of personal data.

DEFINITIONS

4. GENERAL PRINCIPLES

Işık Perde Rayları San. Tic. A. Ş. audits compliance of the data to be processed to the following principles at the preparation stage of every new business flow which requires processing of personal data. The business flows found inconvenient are not put into practice.

While processing personal data, Işık Perde Rayları San. Tic. A. Ş.;

1. Abides by law and good faith.
2. Ensures that the personal data is accurate and updated when necessary.
3. Attends that the purpose for processing is specific, clear and legitimate.
4. Controls that the processed data is connected with the purpose of processing, it is processed limitedly to the necessary extent and it is moderate.
5. Keeps the data only for the period anticipated in the applicable legislation or required by the purpose of processing, disposes the data when the purpose of processing has been removed.

5. PRECAUTIONS FOR DATA SECURITY

Işık Perde Rayları San. Tic. A. Ş. takes any and all necessary technical and administrative precautions for provision of suitable security level (i) to prevent illegal processing of personal data, (ii) to prevent illegal access to personal data, and (iii) to ensure protection of personal.

5.1. Technical Precautions

1. Network security and application security is provided.
2. Security precautions within the scope of provision, development and maintenance of information technologies systems are taken.
3. Access logs are kept regularly.
4. Updated anti-virus systems are used.
5. Firewalls are used.
6. Necessary security precautions related to entry into and exit from physical places containing personal data are taken.
7. Security of physical places containing personal data is provided against external risks (fire, flood, etc.).
8. Security of environments containing personal data is provided.
9. Personal data is backed up and security of backed up personal data is provided.
10. User account management and authority control system is applied and also followed.
11. Log records are kept in a way that no user intervention will be possible.
12. Intrusion detection and prevention systems are used.
13. Encryption is applied.

Administrative Precautions

1. There are disciplinary arrangements containing data security provisions for the employees.
2. Trainings and awareness operations are carried out for the employees about data security at specific intervals.
3. Corporate policies have been prepared and started to be applied about the issues of access, data security, use, storage and disposal.
4. Data masking is applied when necessary.
5. Confidentiality commitments are made.
6. An authority matrix has been created for the employees.
7. Authorities of the employees who have changed duty or quit the job are removed in this area.
8. The signed contracts include data security provisions.
9. Policies and procedures for personal data security have been determined.
10. The problems about personal data security are reported immediately.
11. Personal data security is followed up.
12. Personal data is decreased as much as possible.
13. In-house periodical and/or random audits are performed and made to be performed.
14. The existing risks and threats have been determined.
15. Protocols and procedures for security of sensitive personal data have been determined and are being applied.
16. If sensitive personal data will be sent through electronic mail, it is sent encrypted absolutely and using REM or corporate mail account.
17. Awareness of data processing service providers about data security is provided.

6. RIGHTS OF RELEVANT PERSON RELATING TO PERSONAL DATA

The relevant person can make a request about the following issues by applying to Işık Perde Rayları San. Tic. A. Ş.:

1. To learn whether his/her personal data is processed or not,
2. To demand relevant information if his/her personal data has been processed,
3. To learn the purpose of processing his/her personal data and whether it is used according to this purpose,
4. To learn the third parties to whom his/her personal data is transferred at home and abroad,
5. If his/her personal data has been processed deficiently or wrongly, to ask for correction of it and notification of such corrections to the third persons to whom the personal data has been transferred,
6. Although it has been processed in accordance with KVKK and other applicable law provisions, to ask for deletion, elimination or anonymization of his/her personal data in case the reasons requiring the data processing have been removed and notification of such operations to the third persons to whom the personal data has been transferred,
7. If he/she incurs a loss due to illegal processing of his/her personal data, to ask for indemnification of the loss.
8. To raise an objection to any result against him/her having occurred by analysing his/her processed data exclusively by means of automatic systems,

7. NOTIFICATION OF BREACHES

The employees of Işık Perde Rayları San. Tic. A. Ş. report the business, action or fact which are thought to breach the provisions of KVKK and/or the Policy to the Board. The Board, if it finds necessary, assembles following notification of such breach and prepare an action plan about the breach.

If the breach has occurred through acquisition of personal data by other persons illegally, the Board notifies this situation to the relevant person and the Committee of Protection of Personal Data within 72 hours in accordance with the decision dated 24.01.2019 and numbered 2019/10 of the Committee of Protection of Personal Data.

AMENDMENTS

The amendments on the policy are prepared by the employees authorized by Işık Perde Management and submitted for the approval of the Board of Işık Perde Rayları San. Tic. A. Ş.. The updated Policy is sent to the employees by e-mail or published on the internet site.

9. EFFECTIVE DATE

This version of the Policy entered into force having been approved by the Board on 01.09.2020.