PDPA

At Kumsan, we prioritize the privacy and security of your personal data. In this context, we would like to inform you about how we process the personal data we obtain from our customers, suppliers, business partners, their employees, officials, and all other third parties, and for what purposes we use and protect this information while conducting our business relationships.

All terms and expressions used in this notification will have the meanings assigned to them by Law No. 6698 on the Protection of Personal Data (“PDPA”) and other relevant legislation. The term “you” in this Notification refers to you personally. The term “personal data” is used to include special categories of personal data.

We would like to remind you that ensuring the accuracy, completeness, and timeliness of the personal data you provide to our company is your responsibility. Furthermore, if you share the data of other individuals with us, it will be your responsibility to collect such data in compliance with local legal requirements. In this case, your obtaining all necessary permissions from the respective third party for us to collect, process, use, and disclose their information will imply that we are not held responsible by our company.

ABOUT KUMSAN

Kumsan Casting Materials Industry and Trade Inc. (“Kumsan”, “We” or “Company”) is the Data Controller, operating at Istanbul Tuzla OSB 3rd Street No:1 34959 Tepeören address.

Within this scope, we present our policy regarding the personal data processing activities carried out.

OUR PRINCIPLES FOR PROCESSING PERSONAL DATA

All personal data processed by our company is processed in accordance with the Law on the Protection of Personal Data (“PDPA”) and relevant legislation. The fundamental principles and principles we adhere to when processing your personal data, in accordance with Article 4 of the PDPA, are explained below:

• Processing in Compliance with the Law and the Principle of Honesty: Our company acts in compliance with the principles set by legal regulations in the processing of personal data and the general principles of trust and honesty. In this context, our company takes into account the principles of proportionality in the processing of personal data, and does not use personal data beyond what is required by the purpose.
• Ensuring the Accuracy and Timeliness of Personal Data: Our company ensures that the personal data it processes is accurate and up-to-date, taking into account the basic rights of the data subjects and their legitimate interests.
• Processing for Specific, Clear, and Legitimate Purposes: Our company clearly and precisely determines the specific and legitimate purpose of processing personal data. Our company processes personal data only to the extent necessary for the products and services it provides.
• Relevance, Limitation, and Proportionality in Processing: Our company processes personal data in a form suitable for the realization of the specified purposes and avoids the processing of personal data that is not related to or necessary for the achievement of the purpose.
• Retention for the Duration Required by the Relevant Legislation or the Purpose of Processing: Our company retains personal data only for the period specified in the relevant legislation or as long as necessary for the purpose for which they are processed. Our company keeps personal data for the duration necessary for the purpose of processing. When the period expires or the reasons requiring processing cease, the personal data is destroyed by our company.

DATA SUBJECT CATEGORIES

Our company processes personal data related to the following data subjects:

Data Subject Category	Description
Customer	Individuals or legal entities who purchase our products and services
Potential Customer	Individuals or legal entities who have expressed interest in purchasing our products or benefiting from our services, or who may have such interest, evaluated in accordance with customary and fair business practices
Visitor	Individuals who have entered the physical facilities (offices, etc.) owned by our company or participated in an event organized by the company, or individuals who have visited our websites for various purposes
Third Party	Third-party individuals associated with the parties mentioned above to ensure the security of commercial transactions between our company and these parties, or individuals who are processing personal data of our company for a specific purpose even though not explicitly stated within the scope of the Policy (e.g., guarantors, companions, family members, and relatives) or all individuals for whom our company is required to process personal data for a specific purpose (e.g., former employees)
Job Applicant / Intern Applicant	Individuals who have applied for a job or internship with our company through any means or have opened their resumes and relevant information for review by our company

WHEN DO WE COLLECT PERSONAL DATA ABOUT YOU?

We collect your personal data primarily in the following cases:

• When you purchase or use our products or services,
• When you sell goods or provide services to us,
• When you contact us via means such as email or phone to submit a complaint or feedback,
• When you apply to our company for a job,
• When you attend our company’s events, seminars, conferences, and organizations,
• When you contact us for any purpose as a potential customer/supplier/business partner.

WHAT PERSONAL DATA DO WE PROCESS ABOUT YOU?

The personal data we process about you varies based on the type of business relationship between us (e.g., customer, supplier, business partner, etc.) and the method of communication you use to contact us (e.g., phone, email, printed documents, etc.). In general, we process your personal data through phone or email. The categories of personal data we process about you may be explained under the following:

Data Categories	Data Types
Identity information	Name, surname, Turkish ID/passport number, title, date of birth, and other information found on identification documents
Contact information	Email, phone number, address
Visual and auditory data	Visual and auditory data processed for security reasons when you visit our company
Financial data	Bank account information, invoice details
Any other information voluntarily shared with Kumsan	Personal data voluntarily shared by you, feedback, opinions, requests, and complaints submitted to us, evaluations, comments, and our assessments related to them
Automatically collected electronic data	We may collect electronic data sent to us by your computer, mobile phone, or other access devices when you visit or use our website, subscribe to newsletters, interact with us through other electronic channels. This may include device hardware model, IP address, operating system version and settings, the time and duration of your use of our digital channel or product, your real location that may be collected when you activate location-based products or features, links clicked, motion sensor data, etc.
Legal action and compliance information	Your personal data processed for the determination, pursuit of our legal rights, performance of our obligations, and compliance with our company’s policies and legal obligations, including audit and inspection data

It may involve the transmission of some personal data belonging to third parties to us by you (e.g., Guarantor, etc.). In order to manage our technical and administrative risks, we may process your personal data in these areas through methods commonly used in accordance with legal, commercial customs, and fairness principles.

FOR WHAT PURPOSES DO WE USE YOUR PERSONAL DATA?

The purposes for which we use your personal data may vary depending on the type of business relationship between us. In general, our purposes for processing your personal data are outlined below.

For any questions, you can contact us through the form on our website. In this case, to direct your question to the relevant person and provide an answer, you must fill in the required fields by marking them as mandatory and submit the relevant data to us. You can also provide additional information and data if you wish. In this case, your personal data will be processed within the scope of our legitimate interest, based on your consent under PDPA Article 5/1, and/or in accordance with PDPA Article 5/2/(f) to respond to your request.

Your personal data may be processed for the purpose of implementing measures taken before entering into a contractually regulated business relationship and fulfilling obligations arising from a contract concluded with you. For example, processing purchase orders, deliveries, or payments; preparing and presenting price quotes according to requests from individuals; and establishing or determining the terms of a relationship based on a contract. When it is necessary to process personal data of the parties to a contract directly related to the establishment or performance of a contract in accordance with PDPA Article 5/2/(c), personal data is processed based on the legal ground that the processing of personal data is necessary for the conclusion or performance of a contract.

In addition, as Kumsan, we are subject to various legal obligations that require the processing of your personal data. These legal obligations may arise from tax laws, commercial laws, or criminal laws, among other laws and regulations. In this context, we process your personal data based on the legal ground explicitly foreseen in the laws, particularly PDPA Article 5/2/(a).

Furthermore, we may need to process your personal data to protect our legitimate interests. Examples of these legitimate interests may include the establishment and performance of contracts with our business partners, suppliers, or parties you represent or work for. These legitimate interests may also include internal administrative purposes (e.g., accounting processes) or ensuring the security and functionality of Information Technologies, completing our company’s audit and reporting processes, ensuring building and facility security, as well as handling legal claims or defenses. In this context, we process your personal data based on the legal ground that processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject, according to PDPA Article 5/2/(f).

Additionally, we process your personal data for the purpose of defending the rights and interests of our company, concluding legal processes such as lawsuits filed against or by the company, based on the legal ground that processing is mandatory for the establishment, exercise, or protection of a right, according to PDPA Article 5/2/(e).

In the context of our business relationships, to establish, perform, terminate a proper business relationship, and fulfill our obligations related to these as prescribed by laws or within the framework of our legitimate interests, you need to provide us with the personal data we need to collect. Without this data, we generally cannot contact you and/or enter into a business relationship with you. If you voluntarily provide us with the data in these cases, we will specify this when collecting the data.

SHARING OF YOUR PERSONAL DATA

Our company is responsible for acting in accordance with the legislation, primarily PDPA Article 8, regarding the transfer of personal data. As a rule, personal data belonging to data subjects is kept confidential by our company.

While conducting our commercial activities, our company has established partnerships with third parties for purposes such as the sale, promotion, and marketing of our products, as well as after-sales support. Like many businesses, we may work with reliable third parties such as information and communication technology providers, consultancy service providers, lawyers, cargo companies, banks, insurance companies, and travel agencies to carry out functions and services in the most efficient way and in accordance with current technologies. Within this scope, we may share data to operate our activities.

We share your personal data with service providers that support us in running our websites and Information Technology systems. Our service providers act entirely according to the instructions we provide and are contractually responsible in this regard. This includes hosting service providers for our websites and organizations responsible for hosting, supporting, and maintaining other Information Technology systems.

Additionally, in cases required by laws or when we need to protect our rights, we may share your personal data with relevant official, judicial, and administrative authorities (e.g., tax offices, law enforcement, courts, and enforcement offices).

DATA RETENTION PERIOD

Your data is stored for the period necessary for the purposes mentioned above or to comply with legal retention periods (e.g., data retention obligations under tax and commercial laws) as long as it is necessary for us, and unless we have any legitimate interests to keep your data for a longer period as Kumsan.

COOKIES AND THIRD-PARTY TOOLS

This site uses technologies such as cookies and third-party tools. Cookies are text files or information stored on your computer that allow the analysis of the website’s usage and automatically recognize you on your next visit. You can prevent the installation of cookies by adjusting your browser settings. However, this may prevent you from using the services to their full extent. For more information on the use of cookies on our website, please review our cookie settings.

If you want to change the settings in our Cookie Policy, you can do so through the cookie settings.

For more information on how we use cookies and other tracking technologies, please read our Cookie Policy.

RECORD KEEPING

Every time you access the website, temporary records are created and processed for statistical purposes and to improve the quality of our website. These data records consist of the following:

• Name and address of the requested content,
• Request time and date,
• Transferred data amount,
• Access status (transferred content, content not found),
• Information about the web browser and operating system used,
• Referral link showing the page you accessed to reach our page,
• IP address of the requesting computer (shortened to avoid personal reference).

These specified data records are processed only in anonymized form.

In addition, for the purpose of detecting, restricting, and eliminating attacks on our websites, we keep the full IP address of your web browsing device for seven (7) days. After this period, we delete or anonymize the IP address. Our legal basis for this is the necessity of data processing for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject, according to PDPA Article 5/2/(f). However, in case of concrete suspicions of illegal use, we reserve the right to retrospectively check this data. This data is deleted immediately or at the latest within 7 days when it is no longer necessary for the stated purpose.

YOUR RIGHTS REGARDING YOUR PERSONAL DATA

According to PDPA Article 11, as data subjects, you have the following rights regarding your personal data:

• Learn whether your personal data is processed by our company,
• Request information if your personal data has been processed,
• Learn the purpose of processing your personal data and whether they are used for their intended purpose,
• Know the third parties to whom your personal data are transferred domestically or abroad,
• Request correction of your personal data if they are incomplete or incorrect and request notification of this correction to third parties to whom your personal data has been transferred,
• Request the deletion or destruction of your personal data in case the reasons requiring processing disappear, even if your personal data is processed in accordance with PDPA and other relevant laws, and request notification of this to third parties to whom your personal data has been transferred,
• Object to the occurrence of a result against you by analyzing the processed data solely through automated systems,
• If you suffer damage due to the processing of your personal data unlawfully, request the compensation of the damage you have suffered.

You can submit your requests regarding these rights to our company through the methods specified in the Regulation on the Procedures and Principles of Application to the Data Controller:

• By personally submitting the Data Subject Application Form, filled out and wet-signed, to the address “Istanbul Tuzla OSB 3.Cadde No:1 34959 Tepeören, Tuzla/Istanbul.”
• By sending the wet-signed Data Subject Application Form by notary to the address “Istanbul Tuzla OSB 3.Cadde No:1 34959 Tepeören, Tuzla/Istanbul.”
• By sending it to the email address kumsandokum@hs1.kep.tr with a registered electronic mail (KEP) address.
• By sending the Data Subject Application Form, filled out, to our company through your previously notified and electronically registered email address in our company’s system.

In the application; the name, surname, and if the application is in writing, the signature; for Turkish Republic citizens, T.C. Identification number, nationality for foreigners, passport number or, if any, identification number; residential or business address for notification; if any, the e-mail address for notification; phone and fax number; must be included. Information and documents related to the subject of the application should also be attached to the application.

In your application as a data subject, it is obligatory that the requested matter is clear and understandable, the subject you request is related to yourself, or if you are acting on behalf of someone else, you must be authorized in this regard, and your authorization must be documented with a wet signature. Your application must include your identity and address information and include the identity verification documents.

Our company resolves the relevant request as soon as possible and at the latest within thirty days according to the nature of the request, and communicates the result to the applicant.

Our company may request information/documents from the data subject to determine whether the applicant is the data subject. Our company may ask the data subject questions about the content of the application to clarify the issues in the application.

OTHER MATTERS

We would like to remind you that we may make updates to this Policy due to changing legal provisions and possible changes in our company policies over time. We will publish the most up-to-date version of the Policy