1. Data Controller's Identity
As CEYTAŞ Construction Industry and Trade Joint Stock Company ("CEYTAŞ YAPI" or "the Company"), within the scope of the Law No. 6698 on the Protection of Personal Data ("Law") and as the data controller, we present our information text regarding the personal data we obtain to your information:

2. Processing of Personal Data and Purposes of Processing
Personal data belonging to the data subjects listed below may be processed by our Company in order to ensure the best possible provision of services by our Company. In this context;

• If you are an employee/contact person/partner/authorized person of individual trader or legal entity suppliers/subcontractors/business partners/third parties benefiting from our Company's services, your identity, contact, personal (CV), legal transaction information, physical space security, risk management, finance (IBAN/bank account information), professional experience, visual and auditory records, and in addition to these, health and criminal conviction data including your health and blood group information in your identity documents (indirectly obtained through identity/driving license copies.) These personal data may be processed within the scope of contract processes, procurement processes of goods and services, execution of business activities and supervision, conducting activities to ensure business continuity, conducting finance and accounting affairs, conducting assignment processes, conducting audit activities, conducting access authorization processes, conducting legal affairs, conducting performance evaluation processes, conducting sponsorship/aid activities, conducting occupational health and safety activities, work and residence permit procedures for foreign supplier personnel, conducting communication activities, creating press releases within the scope of corporate communication processes, organization and event management including hotel, flight reservations, logistics and cargo activities, conducting risk management processes, conducting internal audit/investigation/intelligence activities, providing information to authorized individuals, institutions, and organizations upon request, ensuring the continuity of information systems, conducting storage and archive processes

• If you are an employee/contact person/partner/authorized person of group companies of our Company or employees/contact persons/partners/authorized persons of individual trader or legal entity customers of our group companies, your identity, contact, finance (IBAN/bank account information), customer transaction, legal transaction data are contract processes, finance and accounting affairs, customer relationship management processes, execution of access authorization processes, execution of legal affairs, execution of business activities and supervision, execution of audit/ethical activities and internal audit/investigation/intelligence activities, participation in domestic/international tenders, provision of information to authorized individuals, institutions, and organizations upon request, ensuring the continuity of information systems, conducting storage and archive processes

• If you visit our workplace, your identity, physical space security data for creating and tracking visitor records, ensuring physical space security, conducting occupational health and safety processes in case of work accident, providing information to authorized individuals, institutions, and organizations upon request

• If you visit our website, your transaction security data when visiting our website and your identity, contact, transaction security data when using our Company's wireless network may be processed for the purposes of fulfilling the obligations arising from the legislation under Law No. 5651, keeping electronic log records, conducting information security processes, processing activities limited to the purpose of compliance with the legislation and Company policies and procedures. Your personal data may also be transferred to digital and physical environments by being transferred to physical archives and information systems.

3. To Whom and For What Purposes the Processed Personal Data May Be Transferred
Your collected personal data may be transferred to the group companies and databases used jointly with them, national and international technologies service companies abroad for the purposes of compliance with the Company's and the Company's affiliated CEYTAŞ YAPI policies and procedures, operational processes and support, participation in domestic/international tenders.

4. Method of Personal Data Collection and Legal Reason
Your personal data can be collected by methods of automatic or non-automatic methods, directly or indirectly by you or your employer through oral or written information transmitted through our e-mail address, applications and software used in Company activities, and camera records, based on the legal reasons of the data controller's legal obligation, establishment, use or protection of a right, establishment or execution of a contract, legitimate interests of the data controller, and limited to these, in accordance with the basic principles stipulated in Article 5 of the Law.

5. Your Rights Regarding the Protection of Personal Data
Within the framework of the legislation on the protection of personal data, you have the rights to learn whether your personal data are processed, request information if your personal data have been processed, learn the purpose of the processing of personal data and whether they are used appropriately for their purpose, know the third parties to whom personal data are transferred domestically or abroad, request correction of personal data in case of incomplete or incorrect processing and notification of the transaction made within this scope to third parties to whom personal data are transferred, request the deletion or destruction of personal data in case the reasons for processing disappear and notification of the transaction made within this scope to third parties to whom personal data are transferred, object to the occurrence of a result against the person by analyzing the processed data exclusively through automated systems, request the compensation of the damage in case of suffering a damage due to unlawful processing.

You can send your requests within the scope of Article 11 of the Law regulating the rights of the relevant person to info@ceytasyapi.com.tr address.

Our Company will conclude the requests within the framework of the Law No. 6698 within the period determined by the nature of the request and at the latest within 30 (thirty) days. In case the transaction requires a cost, the tariff determined by the Personal Data Protection Board will be applied. In case of rejection of the request, the reason/reasons for rejection will be explained in writing or electronically.