GDPR - GESSAN

CORPORATE

Pipe Annealing Lines

Pipe Painting Lines

Pipe Transfer Lines

Eddy Current Quality Lines

Pipe Grooving Lines

Pipe Machine Equipment

Pipe Packaging Lines

Pipe Welding Inductors

Pipe Galvanizing Systems

GESSAN MAKİNE ELECTRICAL STEEL METAL ASSEMBLY MANUFACTURING CONTRACTING INDUSTRY AND TRADE LTD. CO.
Personal Data Protection and Processing Policy

INTRODUCTION

This Personal Data Protection and Processing Policy (the “Policy”) has been prepared by GESSAN MAKİNE ELECTRICAL STEEL METAL ASSEMBLY MANUFACTURING CONTRACTING INDUSTRY AND TRADE LTD. CO. (the “Company”) to define the principles and rules for conducting personal data processing activities in compliance with the Law No. 6698 on the Protection of Personal Data (the “KVKK”) and related legislation. This Policy explains the fundamental principles adopted by our Company in personal data processing activities and aims to inform data subjects.

Our Company attaches great importance to processing your personal data in accordance with the law and protecting it to a reasonable extent under this Policy.

PURPOSE OF THE POLICY

This Policy aims to set out the principles for the lawful processing and protection of personal data by our Company, to protect the rights of data subjects, and to ensure transparency.

SCOPE OF THE POLICY

This Policy covers the purposes, methods, and legal grounds for processing personal data, data transfers, storage, deletion, and the implementation and principles regarding the rights of data subjects processed within our Company.

ACCESS AND UPDATE

The Policy is published on our Company’s website and is accessible to data subjects. The Policy may be updated if necessary. Updates will be published on the Company’s website and will take effect upon publication.

DEFINITIONS

Personal Data: Any information related to an identified or identifiable natural person.
Processing of Personal Data: Any operation performed on personal data, such as collection, recording, storage, modification, transfer, etc., either by automated means or as part of a data recording system.
Data Controller: The real or legal person who determines the purposes and methods of processing personal data.
Explicit Consent: Consent that is informed and given voluntarily on a specific issue.
Special Categories of Personal Data: Sensitive data such as race, ethnic origin, political opinion, religious beliefs, health information, etc.

PROCESSING OF PERSONAL DATA

Our Company processes your personal data for the following purposes:

Providing our services and fulfilling contracts,
Fulfilling legal obligations,
Protecting our Company’s legitimate interests,
Communication and customer relationship management,
Marketing and promotional activities.

Personal data is processed based on the legal grounds specified in Articles 5 and 6 of the KVKK. Special categories of personal data are processed only with explicit consent or in exceptional cases provided by the law.

TRANSFER OF PERSONAL DATA

Your personal data may be transferred to third parties, either within Turkey or abroad, in accordance with Articles 8 and 9 of the KVKK. Transfers will only be made for the specified purposes and under appropriate security measures.

RETENTION PERIOD OF PERSONAL DATA

Personal data is retained for the period necessary to fulfill the processing purposes. This period is limited by the retention periods specified in the relevant legislation or by legal obligations. Once the retention period expires or the purpose of processing ceases to exist, personal data will be deleted, destroyed, or anonymized.

RIGHTS OF DATA SUBJECTS

In accordance with Article 11 of the KVKK, data subjects have the following rights:

To learn whether personal data is being processed,
To request information about personal data if it has been processed,
To learn the purpose of processing personal data and whether it is used in accordance with the purpose,
To request correction of incomplete or inaccurate personal data,
To request the deletion or destruction of personal data,
To request notification of third parties to whom personal data has been transferred regarding the above actions,
To object to the processing of personal data solely through automated systems that result in an unfavorable conclusion for the data subject,
To request compensation for damages caused by the unlawful processing of personal data.

APPLICATION METHOD

Data subjects may submit a written request to [Company Contact Information] to exercise the above rights. Applications will be responded to within 30 days at the latest.

CONFIDENTIALITY AND SECURITY MEASURES

Our Company takes the necessary technical and administrative measures to ensure the protection of personal data. These measures include data security policies, access controls, encryption, and regular audits.

EFFECTIVE DATE

This Policy has come into effect on [Effective Date]. The Policy may be updated and the updated version will be published on our Company’s website.
This Policy became effective on November 27, 2020, and was updated on March 1, 2025.