Visitor-Website Information Notice

VISITOR CLARIFICATION TEXT ON THE PROTECTION OF PERSONAL DATA

This clarification text has been prepared in accordance with Article 10 of the Law No. 6698 on the Protection of Personal Data (“Law”) and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform. It aims to determine the terms and conditions regarding the processing and transfer of personal data by Taç Palet Orman Ürünleri Sanayi ve Ticaret Anonim Şirketi (“Company”), acting as the data controller, for personal data produced by or shared with the Company by visitors/suppliers/customers and other persons (“User or Related Person”) physically present at the Company’s operational facilities, as well as personal data produced or shared during the use of content on the Company’s official website “tacpalet.com” (“Website”) by users/visitors/members/customers and other persons (“User or Related Person”).

Our Company does not evaluate the protection and processing of personal data, which is the basis of the privacy of private life, merely within the scope of compliance with the legislation; it places the value it gives to people at the core of its approach. Acting with this awareness, our company takes all necessary administrative and technical measures for the protection and processing of personal data in accordance with the law.

Personal data is processed by our Company in the capacity of data controller in accordance with the Law on the Protection of Personal Data, in line with the explanations provided below:

DATA CONTROLLER

In accordance with the Law No. 6698 on the Protection of Personal Data (“Law”), your personal data is collected and processed by Taç Palet Orman Ürünleri Sanayi ve Ticaret Anonim Şirketi (“Company”) as the data controller within the scope described below.

PROCESSED PERSONAL DATA

• Identity (name, surname, T.R. Identity number, signature, vehicle license plate information),
• Communication (address, e-mail address, phone number),
• Finance (Tax identification number, IBAN number information),
• Physical Space Security (camera recordings),
• Transaction Security Information (username, IP address),
• In-site Navigation/Transaction Information (if relevant forms are filled out),
• Request/Complaint Management Information.
• Marketing (Cookie Records).

METHOD AND LEGAL BASIS FOR PERSONAL DATA COLLECTION

Your personal data is collected through various channels such as documents submitted to the data controller verbally, in writing, or electronically, service procurement contracts, visitor logs, mail and e-mails; call center; data controller's website; social media tools; corporate communication accounts and devices; data controller's information systems and devices; security cameras; business partners served by or receiving service from the data controller, companies providing services/products, and third parties, through fully or partially automated or non-automated methods.

Personal data is processed based on the user's explicit consent. However, personal data may also be processed without explicit consent based on one of the following legal grounds set forth in Article 5, Paragraph 2 of the Law: (ii) it has been made public by the personal data subject themselves, (iv) processing is necessary for the establishment or performance of a contract, provided that it is directly related to the parties of the contract, (v) it is mandatory for the Company to fulfill its legal obligation, (vi) processing is mandatory for the establishment, exercise, or protection of a right, (vii) processing is mandatory for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the personal data subjects.

PURPOSES OF PROCESSING PERSONAL DATA

Your personal data is processed for the purposes of fulfilling professional and legal requirements and obligations explicitly stipulated in the laws in case of the presence of one or more of the legal grounds listed in Article 5/2 of the Law; conducting goods/service procurement processes; conducting finance and accounting affairs; contract execution and proposal preparation; ensuring the legal, commercial, and physical security of the data controller; ensuring the corporate functioning of the data controller; conducting communication activities; conducting storage and archiving activities; creating visitor records; and providing information to authorized persons/institutions/organizations.

If you declare your explicit consent, your personal data may be processed by the Company to ensure you benefit from products and services in the best way (performing statistics, analysis, profiling, and preference reporting) and to keep you informed (performing promotions, advertisements, campaigns, announcements, and information); planning, developing, and executing corporate communication activities, and analyzing your financial profile.

TRANSFER OF PERSONAL DATA

In the presence of one or more of the conditions set forth in Article 5/2 of the Law, your personal data may be transferred to our business partners, companies from which we receive external services (health, occupational safety, law) to fulfill our contractual or legal obligations, and authorized persons/institutions/organizations without the need for explicit consent, limited to the legal grounds specified in article (c) and purposes specified in article (d) of this text, within the framework of the conditions specified in Articles 8 and 9 of the Law and provided that necessary security measures are taken.

DATA SECURITY

The Company has taken all necessary technical and administrative measures to prevent the unlawful processing of personal data, to prevent unlawful access to personal data, to ensure the preservation of personal data, and to provide the appropriate level of security.

RIGHTS OF THE PERSONAL DATA SUBJECT UNDER THE LAW ON THE PROTECTION OF PERSONAL DATA

The Company informs the Related Person of their rights in accordance with Article 10 of the Law; provides guidance on how to use these rights and performs the necessary internal procedures, administrative and technical arrangements for all these. The Company explains to the persons whose personal data is collected that they have the right to:

• Learn whether personal data is processed,
• Request information if personal data has been processed,
• Learn the purpose of processing personal data and whether they are used in accordance with their purpose,
• Know the third parties to whom personal data is transferred domestically or abroad,
• Request correction of personal data if it is incomplete or incorrectly processed,
• Request deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the Law,
• Request notification of the transactions made (correction and destruction) in accordance with subparagraphs (d) and (e) of Article 11 of the Law to third parties to whom personal data has been transferred,
• Object to the occurrence of a result against the person himself by analyzing the processed data exclusively through automated systems,
• Claim compensation for the damage in case of loss due to unlawful processing of personal data.

Requests and applications regarding the implementation of the Law can be personally submitted in writing by filling out the application form available on the website or provided upon request to the address “Muradiye Mahallesi 9 Sk. No: 7 Yunusemre/MANİSA”, or sent through a notary public, or transmitted electronically to the registered electronic mail (KEP) address (tacpalet@hs01.kep.tr) using a secure electronic signature or mobile signature.

Our Company concludes the requests in the application free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, the fee in the tariff determined by the Board may be charged.

Our Company may accept the request or reject it by explaining the reason and notifies the related person of the response in writing or electronically. If the request in the application is accepted, our Company fulfills the requirement as soon as possible and informs the related person. If the application is due to our Company's fault, the fee collected shall be returned to the data subject. In cases where the application is rejected, the response is found insufficient, or the application is not responded to in time; the data subject has the right to file a complaint with the Board within thirty days from the date they learn the response and in any case within sixty days from the date of application. The Company reserves the right to change the clarification provisions without prior notice due to legislation or organizational reasons.