TDPL - GENERAL PRIVACY NOTICE

1. PURPOSE and SCOPE

BODE Araç Kapı Sistemleri Sanayi ve Ticaret A.Ş. (“COMPANY”), attaches importance to the protection of personal data and the privacy of data subjects; it processes personal data within the scope of Turkish Personal Data Protection Law No. 6698 (“KVKK”) and the relevant legislation in its capacity as Data Controller.

This “General Information Notice” has been prepared in order to inform the customers, prospective customers, suppliers and business partners of the COMPANY and their employees/representatives, visitors, website visitors, persons who contact the COMPANY and persons communicating with the COMPANY, as well as other natural persons whose personal data is processed within the scope of the COMPANY’s activities, about the processing of their personal data pursuant to Article 10 of the KVKK.

Information regarding the processing of employees’ personal data is provided separately in the “Employee Privacy Notice”; information regarding employee candidates is provided in the “Employee Candidate Privacy Notice”; and information regarding image processing activities carried out by means of security cameras is provided separately in the “CCTV Privacy Notice”.

2. PERSONAL DATA PROCESSED, PURPOSES OF PROCESSING and LEGAL BASES

DATA CATEGORY: IDENTITY
MAIN PERSONAL DATA PROCESSED: NAME-SURNAME; IDENTITY/REPRESENTATION INFORMATION WHERE NECESSARY
MAIN PURPOSES OF PROCESSING: COMMUNICATION; CUSTOMER/SUPPLIER/BUSINESS PARTNER RELATIONS; CONTRACT AND REQUEST PROCESSES; VISITOR PROCEDURES
LEGAL BASIS: ESTABLISHMENT/PERFORMANCE OF A CONTRACT; LEGAL OBLIGATION; ESTABLISHMENT/EXERCISE/PROTECTION OF A RIGHT; LEGITIMATE INTEREST

DATA CATEGORY: CONTACT
MAIN PERSONAL DATA PROCESSED: E-MAIL, TELEPHONE, ADDRESS, KEP, COMPANY/INSTITUTION INFORMATION
MAIN PURPOSES OF PROCESSING: ESTABLISHING COMMUNICATION; RESPONDING TO REQUESTS; CONDUCTING COMMERCIAL AND CONTRACTUAL PROCESSES
LEGAL BASIS: ESTABLISHMENT/PERFORMANCE OF A CONTRACT; LEGAL OBLIGATION; LEGITIMATE INTEREST

DATA CATEGORY: CUSTOMER / TRANSACTION
MAIN PERSONAL DATA PROCESSED: REQUEST, QUOTATION, ORDER, CONTRACT, PRODUCT/SERVICE, COMPLAINT, AFTER-SALES TRANSACTION INFORMATION
MAIN PURPOSES OF PROCESSING: SALES, QUOTATIONS, ORDERS, CUSTOMER RELATIONS, AFTER-SALES SUPPORT, COMPLAINT AND CUSTOMER SATISFACTION PROCESSES
LEGAL BASIS: ESTABLISHMENT/PERFORMANCE OF A CONTRACT; LEGAL OBLIGATION; ESTABLISHMENT/EXERCISE/PROTECTION OF A RIGHT

DATA CATEGORY: FINANCE
MAIN PERSONAL DATA PROCESSED: INVOICE, PAYMENT, BANK/IBAN AND TRANSACTION INFORMATION — TO THE EXTENT REQUIRED BY THE TRANSACTION
MAIN PURPOSES OF PROCESSING: FINANCE AND ACCOUNTING; COLLECTION/PAYMENT AND STATUTORY RECORD-KEEPING OBLIGATIONS
LEGAL BASIS: ESTABLISHMENT/PERFORMANCE OF A CONTRACT; LEGAL OBLIGATION

DATA CATEGORY: LEGAL TRANSACTION
MAIN PERSONAL DATA PROCESSED: OFFICIAL CORRESPONDENCE, LITIGATION/DISPUTE, REQUEST AND APPLICATION INFORMATION
MAIN PURPOSES OF PROCESSING: CONDUCTING LEGAL PROCEEDINGS; PROTECTING RIGHTS; PROVIDING INFORMATION TO COMPETENT AUTHORITIES
LEGAL BASIS: LEGAL OBLIGATION; ESTABLISHMENT/EXERCISE/PROTECTION OF A RIGHT

DATA CATEGORY: PHYSICAL PREMISES / VISITOR
MAIN PERSONAL DATA PROCESSED: VISITOR RECORDS, ENTRY-EXIT AND NECESSARY VEHICLE INFORMATION
MAIN PURPOSES OF PROCESSING: FACILITY SECURITY; MANAGEMENT OF VISITOR AND PHYSICAL ACCESS PROCESSES
LEGAL BASIS: LEGITIMATE INTEREST; APPLICABLE LEGAL OBLIGATIONS

DATA CATEGORY: TRANSACTION SECURITY / WEB
MAIN PERSONAL DATA PROCESSED: IP ADDRESS, ACCESS AND TECHNICAL LOG INFORMATION, TECHNICAL DEVICE/BROWSER INFORMATION
MAIN PURPOSES OF PROCESSING: OPERATION AND SECURITY OF THE WEBSITE; DETECTION OF ERRORS AND SECURITY INCIDENTS
LEGAL BASIS: LEGITIMATE INTEREST AND APPLICABLE LEGAL OBLIGATIONS

DATA CATEGORY: WEB USAGE / ANALYTICS
MAIN PERSONAL DATA PROCESSED: COOKIES AND SIMILAR ONLINE IDENTIFIERS, IP ADDRESS, TECHNICAL INFORMATION RELATING TO THE DEVICE / BROWSER, AND USAGE / SESSION / STATISTICAL INFORMATION
MAIN PURPOSES OF PROCESSING: MEASUREMENT OF WEBSITE USAGE, PERFORMANCE OF STATISTICAL ANALYSES AND EVALUATION OF WEBSITE PERFORMANCE
LEGAL BASIS: EXPLICIT CONSENT OF THE DATA SUBJECT

DATA CATEGORY: WEB / EXTERNAL CONTENT – GOOGLE MAPS
MAIN PERSONAL DATA PROCESSED: IP ADDRESS, DEVICE / BROWSER INFORMATION, AND CONNECTION AND TECHNICAL USAGE INFORMATION GENERATED DURING USE OF THE MAP SERVICE
MAIN PURPOSES OF PROCESSING: DISPLAYING THE EMBEDDED LOCATION MAP UPON THE USER’S REQUEST AND TECHNICALLY PROVIDING THE MAP SERVICE
LEGAL BASIS: EXPLICIT CONSENT OF THE DATA SUBJECT

3. METHODS OF COLLECTING PERSONAL DATA

Your personal data may be collected through written, verbal or electronic communications conducted directly with the COMPANY; communication and relevant request forms on the website; e-mail, Registered Electronic Mail (KEP) and telephone channels; customer, supplier, business partner and contractual processes; visitor and physical access records; laboratory service and communication processes; technical records generated within the scope of the operation of the website and information systems; and information and documents lawfully obtained from authorized persons, institutions and organizations, by wholly or partly automated means or by non-automated means, provided that the processing forms part of a data recording system.

4. TRANSFER OF PERSONAL DATA

Your personal data may, to the extent required by the relevant data processing activity and in accordance with Articles 8 and, where applicable, 9 of the KVKK, be shared with authorized public institutions and organizations and judicial/administrative authorities, suppliers/service providers that provide services to the COMPANY and need access to personal data for the performance of the relevant activity, consultants, and relevant business partners where transfer is necessary for the performance of a contractual or commercial relationship, in a manner that is relevant, limited and proportionate to the purpose.

5. TRANSFER ABROAD

Where personal data are transferred abroad, or where a new system, service, platform or technology gives rise to the possibility of such a transfer, the relevant transfer shall be carried out only where an applicable condition provided under Article 9 of the KVKK and the relevant legislation has been satisfied.

Where the use of service providers established abroad, information systems, cloud services, hosting, analytics, external content or similar infrastructures may result in the transfer of personal data abroad, the parties to the transfer, relevant groups of data subjects, categories of personal data, scope and purpose of the transfer, applicable legal transfer mechanism, and necessary technical and administrative measures shall be assessed together. The relevant transfer shall not be carried out unless the necessary legal mechanism has been established.

Under the current technical configuration of the COMPANY’s website, personal data such as IP address, online identifiers, device / browser information and usage and session information may be transferred to Google’s service infrastructures located abroad where the user consents to the activation of Google Analytics / Google Tag Manager services and where the user separately activates the Google Maps service by selecting the “Show Map” option.

For such transfers of personal data abroad, the applicable legal transfer mechanism shall be determined in accordance with Article 9 of the KVKK and the Regulation on the Procedures and Principles Regarding the Transfer of Personal Data Abroad, and the necessary appropriate safeguard and/or other applicable legal mechanism shall be established.

Transfers of personal data abroad are reviewed by the COMPANY in light of changes to the services and technologies used; the relevant Personal Data Processing Inventory, privacy notices, agreements and other KVKK records are updated together where necessary.

6. RETENTION and DESTRUCTION OF PERSONAL DATA

Personal data is retained for the periods prescribed under the relevant legislation and for as long as the purposes requiring its processing continue to exist, limited to the periods determined within the COMPANY’S “Personal Data Processing Inventory” and “Personal Data Retention and Destruction Policy”. Where the conditions requiring processing cease to exist, personal data is deleted, destroyed or anonymized in accordance with Article 7 of the KVKK and the relevant legislation.

7. SECURITY OF PERSONAL DATA and MEASURES TAKEN

The COMPANY, within the scope of Article 12 of the KVKK, implements the necessary administrative and technical measures appropriate to the nature of the personal data processed and the level of risk in order to prevent the unlawful processing of and unlawful access to personal data and to ensure its secure retention.

8. RIGHTS UNDER THE KVKK

You may submit requests concerning your rights under Article 11 of the KVKK to the COMPANY by using the “Data Subject Application Form” available on the COMPANY’s website and in accordance with the applicable application procedures and principles. KVKK Article 11 provides you with the following rights in relation to your personal data:

to learn whether your personal data is being processed
to request information if your personal data has been processed
to learn the purpose of processing your personal data and whether it is used in accordance with that purpose
to know the third parties to whom your personal data has been transferred in Türkiye or abroad
to request the correction of your personal data if it has been processed incompletely or inaccurately, and to request that the action taken in this respect be notified to third parties to whom the personal data has been transferred
to request the deletion or destruction of your personal data where the reasons requiring its processing cease to exist, even though it has been processed in accordance with the KVKK and other relevant laws, and to request that the action taken in this respect be notified to third parties to whom the personal data has been transferred
to object to any result arising against you as a result of the analysis of processed data exclusively by automated systems
to claim compensation for damages where you suffer loss as a result of the unlawful processing of your personal data

9. APPLICATION METHODS

As personal data subjects, you may submit your requests arising from your statutory rights under the relevant law and other legislation by completing application form / petition that can be found under the link https://www.bode-global.com.tr/en/kvkk:

✓ “Kale Mahallesi Burçak Sokak No: 3 | PK: 16450 | Kestel / BURSA” to our address, together with documents verifying your identity and bearing a wet-ink signature, in person or through a notary public,

✓ “Communiqué on the Procedures and Principles of Application to the Data Controller”, pursuant to Article 5, by using a registered electronic mail (KEP) address, secure electronic signature or mobile signature; electronically to our KEP e-mail address [email protected] electronically,

✓ Using the e-mail address previously notified to the COMPANY and registered in the COMPANY systems, you may submit your application to our official e-mail address [email protected] together with documents verifying your identity and a wet-ink signed copy, electronically.

If you submit your request to us using one of these methods, pursuant to Article 13 of the KVKK, it will be evaluated and concluded as soon as possible depending on the nature of the request and, in any event, no later than 30 days, and you will be informed accordingly. If your request is accepted, the necessary actions will be carried out without delay by the data controller COMPANY.

NOTE: APPLICATIONS ARE, AS A RULE, CONCLUDED FREE OF CHARGE; HOWEVER, WHERE PROCESSING OF THE APPLICATION ENTAILS AN ADDITIONAL COST, THE FEE SPECIFIED IN THE TARIFF DETERMINED BY THE BOARD UNDER THE “COMMUNIQUÉ ON THE PROCEDURES AND PRINCIPLES OF APPLICATION TO THE DATA CONTROLLER” MAY BE CHARGED.

10. DATA CONTROLLER AND CONTACT

DATA CONTROLLER: BODE ARAÇ KAPI SİSTEMLERİ SANAYİ ve TİCARET A.Ş.

ADDRESS: Kale Mahallesi Burçak Sokak No:3 | PK:16450 | Kestel / BURSA

WEBSITE: www.bode-global.com.tr

E-MAIL: [email protected]

KEP ADDRESS: [email protected]

TELEPHONE: +90 (224) 373 20 00

CONTACT PERSON: Enver Bayrak

11. UPDATES TO THIS INFORMATION NOTICE

This “General Information Notice” may be updated in line with changes in legislation, decisions of the Personal Data Protection Board, changes in the COMPANY’S personal data processing activities, or other legal and operational requirements. The current version of this Information Notice is published on the COMPANY’S website in the KVKK section. Where a change in personal data processing activities is of such a nature that separate notification to data subjects is required, the necessary information shall additionally be provided in accordance with the KVKK and the relevant legislation.