PDPA

Purpose

As Smartpro Technology, our priority is to ensure that the personal data of all individuals, including our customers, visitors, suppliers, and employees, are processed in accordance with the relevant legislation, primarily the Constitution of the Republic of Turkey, international treaties on human rights to which our country is a party, and Law No. 6698 on the Protection of Personal Data (“KVKK”), and to ensure the effective use of the rights of individuals whose data is processed. This policy will be followed to discipline the processes related to the processing, storage, and transfer of all personal data acquired during our activities, to protect fundamental rights and freedoms, especially privacy, and to define the obligations, procedures, and rules that real and legal persons who process personal data will comply with.

Scope

This policy covers all personal data or sensitive personal data processed by Smartpro Technology. It applies to any information related to an identified or identifiable natural person obtained during the operations carried out by Smartpro Technology, regardless of whether the information is processed in whole or in part by automatic means or as part of any data recording system. This policy applies to personal data processed by Smartpro Technology, including those of our customers, visitors, business partners, employees, suppliers, and third parties.

Our policy is applied to all personal data processing activities conducted by Smartpro Technology, considering the relevant legislation, including KVKK and other related regulations, and international standards in this area.

DEFINITIONS AND ABBREVIATIONS

3.1. KVKK: Law on the Protection of Personal Data (published in the Official Gazette dated April 7, 2016, and numbered 29677).

3.2. Personal Data: Data that can be recorded and processed individually related to an identified or identifiable natural person (e.g., TCKN, IP address, name, contact information – mobile phone, home phone, address, etc.), as well as reports (e.g., customer complaint reports, employee performance evaluation reports, interview evaluation reports), records (voice or video recordings, pictures, user transaction records), documents (e.g., resumes, payroll, invoices, bank receipts, credit card statements, copies of identity cards), and writings (e.g., letters, invitation letters).

3.3. Sensitive Personal Data: Data that carries the risk of discrimination if processed. These must be protected more stringently than other personal data. According to Article 6 of KVKK, sensitive personal data includes “data on individuals’ race, ethnic origin, political opinions, philosophical beliefs, religion, sect, or other beliefs, attire, association, foundation or union memberships, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data.”

3.4. Personal Health Data: Any health data related to an identified or identifiable natural person. For example, test results, diseases the person has had, medications used, etc., are considered personal health data. Personal health data is considered sensitive personal data.

3.5. Processing of Personal Data: Any operation performed on personal data such as obtaining, recording, storing, preserving, changing, reorganizing, disclosing, transferring, taking over, making available, classifying, or preventing the use of data by wholly or partly automated means or as part of any data recording system.

3.6. Employee: This policy refers to Smartpro Technology personnel.

3.7. Data Processor: A natural or legal person who processes personal data on behalf of the data controller based on the authority given by the data controller.

3.8. Data Controller: A natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system. Under the Law No. 6698 on the Protection of Personal Data (“KVK Law”), personal data may be processed by Smartpro Technology as the “Data Controller.”

3.9. Service Provider: This policy refers to the personnel of the company (Supplier, subcontractor, customer, etc.) that Smartpro Technology receives or provides services.

3.10. Data Subject (Personal Data Owner): The natural person whose personal data is processed.

ROLES AND RESPONSIBILITIES

Board of Directors:

The Board of Directors is responsible for overseeing the notification, investigation, and sanction mechanisms in case of non-compliance with the policy, rules, and regulations. It is authorized to ensure the creation, publication, updating when necessary, and annulment of this policy.

Employee:

• To adhere to Smartpro Technology’s policies, regulations, and procedures.
• To work in accordance with current legislation.
• To notify the Human Resources Department in case of encountering any behavior, activity, or practice that contradicts this document.

4.3. External Service Providers and Business Partners:

External service providers and business partners must comply with the principles of the Policy and other related regulations, and working relationships with those who do not comply will be terminated. Respect for human rights is expected while doing business with subcontractors, suppliers, customers, joint ventures, and other partners. The principles and procedures of implementing this Policy and compliance with related legislation must be audited.

LEGAL OBLIGATIONS

5.1. Our Obligation to Inform

As a data controller, while collecting personal data, we have an obligation to inform the Data Subject about:

• The purposes for which personal data will be processed.
• The identity of our company and our representative, if any.
• The recipients to whom personal data can be transferred and the purposes of such transfer.
• Our data collection methods and the legal basis.
• The rights arising from the law.

5.2. Our Obligation to Ensure Data Security

As a data controller, we take administrative and technical measures as required by the legislation to ensure the security of personal data. The obligations and measures related to data security are detailed in sections 9 and 10 of this Policy.

CLASSIFICATION OF PERSONAL DATA

6.1. Personal Data

Personal data is any information relating to an identified or identifiable natural person. The protection of personal data applies only to natural persons, and data related to legal entities that do not contain information about natural persons is excluded from personal data protection. Therefore, this Policy does not apply to data related to legal entities.

6.2. Sensitive Personal Data

Sensitive personal data includes information about individuals’ race, ethnic origin, political opinions, philosophical beliefs, religion, sect, or other beliefs, attire, association, foundation or union memberships, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data.

PROCESSING OF PERSONAL DATA

7.1. Our Principles for Processing Personal Data

We process personal data in accordance with the following principles:

7.1.1. Processing in Compliance with Law and Honesty

We process personal data in accordance with the principles of honesty, transparency, and our obligation to inform.

7.1.2. Ensuring Personal Data is Accurate and Up-to-Date When Necessary

We take necessary measures to ensure that the processed data is accurate and up-to-date. We also provide the Data Subject with the opportunity to update their data and correct any errors in the processed data.

7.1.3. Processing for Specific, Explicit, and Legitimate Purposes

We process personal data within the scope of clearly defined, legitimate purposes in line with our business operations and legal obligations.

7.1.4. Processing Personal Data Relevant, Limited, and Proportionate to the Purpose

We process personal data relevant, limited, and proportionate to the purposes for which they are processed. We avoid processing unrelated or unnecessary personal data and obtain explicit consent when processing sensitive personal data unless legally required.

7.1.5. Storing Personal Data for the Period Required by Legal Regulations and for Legitimate Business Purposes

We retain personal data for the period required by relevant legislation or as necessary for the purposes for which they are processed. When the retention period expires or the processing purpose no longer exists, we delete, destroy, or anonymize the personal data. Our principles and procedures for retention periods are detailed in section 9.1 of this Policy.

7.2. Methods of Collecting Personal Data

Personal data can be collected by our Company through various channels (Smartpro Technology’s headquarters, branches, agencies, sales offices, or other subcontractors or business partners, office and other physical environments where you can contact us, call centers, websites, mobile applications, and similar electronic transaction platforms, social media, or other public media, participation in training, conferences, and similar environments organized, or through other group companies or other persons and organizations we have agreements with, in written, verbal, audio, or video recording or other physical or electronic environments, etc.).

In accordance with KVKK, we collect and process your Personal Data through the channels listed below and other channels that may be added later, automatically or non-automatically, in written, verbal, audio, or electronic form, and process them according to the purposes specified in KVKK Articles 5.1, 5.2, 6.2, and 6.3, and the purposes specified in Article 7.3 of this document:

• Through the sales and marketing network established or operated by Smartpro Technology and managed under the Smartpro Technology name (Smartpro Technology Offices) within the scope of sales and marketing.
• Through accounts operated under the name of Smartpro Technology Brands on various social media channels (“Social Media”).
• Through correspondence conducted via our email addresses (“Email”), short messages (“SMS”), or multimedia messages (“MMS”) sent for various purposes related to Smartpro Technology and Smartpro Technology Brands, and through all kinds of communication methods (“Communication Tools”).
• Through our call centers (“Call Center”) managed by Smartpro Technology or the companies from which Smartpro Technology receives services.
• Through third parties such as group companies, business partners, manufacturers, or companies from which Smartpro Technology provides services or products.

The personal data obtained can be collected, processed, transferred, and stored within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVKK, for the purposes specified in Article 7.3 of this document.

7.3. Our Purposes for Processing Personal Data

As a rule, we process your Personal Data based on your explicit consent. However, in exceptional cases allowed by KVKK, your Personal Data may be processed without your explicit consent (KVKK Art. 5.2 and Art. 6.3). In this context, we process your Personal Data to fulfill our legal obligations, establish or perform a contract, protect a right, or for our legitimate interests without harming your fundamental rights and freedoms; for example, to reduce costs, use resources efficiently, monitor the service quality of call centers, etc. We also process your Personal Data that you have made public through competitions and social media channels without requiring further consent to the extent permitted by KVKK.

With your explicit consent, we process personal data for the following purposes:

• Conducting our activities.
• Providing support services within the scope of the contract and service standards.
• Determining and updating the preferences and needs of our customers/visitors and shaping and updating our services accordingly.
• Ensuring the fulfillment of our legal obligations as required or mandated by legal regulations.
• Advertising and marketing activities.
• Offering opportunities for products and services specific to customers, such as internet advertising, targeting, re-targeting (retargeting and re-targeting), cross-selling, campaigns, opportunities, and product/service advertisements, and using cookies for these purposes.
• Making commercial offers by considering customer preferences and recent purchases.
• Determining how our customers learned about our websites, creating non-anonymous traffic statistics through single user registration.
• Recognizing the customer during visits to our websites and providing personalized browsing opportunities and customized content tailored to their interests and preferences, using cookies for these purposes.
• Monitoring usage habits based on previous customer records during visits to Smartpro Technology sales offices and offering special products, conducting advertising, campaign, advantage, and other marketing activities for customers, using cookies for these purposes.
• Creating new product and service models, using cookies for these purposes.
• Conducting market research and statistical studies.
• Conducting surveys, competitions, promotions, and sponsorships.
• Identifying suitable products, projects, and services for our customers, personalizing and developing them, providing effective customer service.
• Notifying customers, employees, suppliers, and business partners about changes in legislation and internal policies, or making other notifications.
• Conducting activities such as celebrating birthdays, including customers in sweepstakes or competitions, giving gifts, and conducting similar events, promotions, and campaigns for their benefit.
• Informing and notifying about campaigns via electronic mail, SMS, and fax.
• Sending electronic commercial messages (campaigns, newsletters, customer satisfaction surveys, product and service advertisements, etc.), sending magazines/periodicals, conducting corporate communication, organizing events and invitations, and making notifications about them.
• Identifying visitor profiles, evaluating requests, demands, and complaints.
• Evaluating job applications.
• Establishing contact with people in business relationships with the company.
• Conducting compliance management.
• Managing supplier/vendor relations.
• Making legal reports.
• Invoicing.
• Communicating with customers specifically regarding Smartpro Technology.
• Managing central processes.
• Ensuring corporate communication.
• Customizing and managing job postings based on search criteria.
• Offering personalized job postings and information related to employment.
• Sending newsletters or notifications via electronic mail.

7.4. Processing of Sensitive Personal Data

Sensitive personal data is processed by taking administrative and technical measures specified by law and KVKK Board and if there is explicit consent or in cases where required by legislation.

Sensitive personal data related to health and sexual life may be processed by persons or authorized institutions bound by confidentiality obligations for purposes such as public health protection, preventive medicine, medical diagnosis, treatment, and care services, health services, and financing planning and management. Such data outside our employees’ data is not processed by us. Health-related data of our employees can only be processed by persons specified by law.

7.5. Processing Personal Data for Human Resources and Employment Purposes

Personal data you share with us during the application process, such as resumes, diplomas, etc., are processed, stored, and transferred for job application evaluation purposes. The processing, transfer, and storage of personal data shared as a job candidate are covered by this Policy.

Identity and contact information; is processed for job and labor finding purposes, resume creation, communication, business development, and information purposes. Social network information is processed to carry out and develop operational activities such as business development and marketing with current social information collected from social network accounts and to enhance user experience.

Smartpro Technology stores the identity, education, and professional information of candidates under the relevant legislation and can transfer the data to the manager of the department the candidate will work with upon request.

Within this platform, the deletion, destruction, or anonymization of personal data is within the scope of Article 9 of this Policy. In the event of a negative outcome of the job application process, the processing and data security of the personal data shared with the employer are the employer’s responsibility.

7.6. Personal Data of Employees

Personal data collected, processed, and stored under Smartpro Technology Human Resources Policy outside of this Policy.

7.7. Processing Job Applications via Smartpro Technology Website

Information provided by candidates by filling out a form to apply for a job through our website is recorded.

Candidates create resumes by sharing identity information (name, surname, date of birth, T.C. identity number), contact information (address, email address, phone number, etc.), education information (schools graduated, etc.), job experiences, foreign language proficiency, certificates, and references. Based on the nature of the application, additional health data may be requested to assess whether the candidate is qualified for the job. The requested health information is processed only for employment purposes under the relevant legislation.

7.8. Exceptional Cases Where Explicit Consent is Not Required for Personal Data Processing

In the following exceptional cases and those arising from the law, we may process personal data without explicit consent.

• Where it is explicitly provided for by law.
• Where it is necessary for the establishment or performance of a contract directly related to the data subject.
• Where it is necessary for the establishment, exercise, or protection of a right.
• Where it is necessary for our legitimate interests as a data controller, provided that it does not harm fundamental rights and freedoms.

Exceptions where sensitive personal data can be processed without explicit consent are specified in Article 7.3 of this Policy.

TRANSFER OF PERSONAL DATA

8.1. Transfer of Personal Data

As Smartpro Technology, we act in compliance with the regulations specified in KVKK and decisions and regulations made by the KVKK Board when transferring personal data.

Except for exceptional cases provided in the legislation, personal data and sensitive personal data will not be transferred to other real or legal persons without the explicit consent of the Data Subject.

In exceptional cases specified by KVKK and other relevant legislation, data can be transferred to authorized administrative or judicial institutions or organizations without the explicit consent of the Data Subject, provided that the necessary measures specified in the relevant legislation are taken and the limits specified in the legislation are adhered to.

Sensitive personal data related to the health and sexual life of the Data Subject can only be transferred to persons or authorized institutions and organizations bound by confidentiality obligations, without explicit consent, for purposes such as protecting public health, preventive medicine, medical diagnosis, treatment and care services, health services and financing planning, and management.

8.3. Institutions and Organizations to Which Personal Data is Transferred

Personal data may be transferred to:

• Our suppliers.
• Our business partners and business connections.
• Community companies.
• Authorized public institutions and organizations.
• Authorized private law persons.
• Our shareholders, following the principles and rules specified above.

8.4. Measures Taken to Ensure Lawful Transfer of Personal Data

As Smartpro Technology, in all our activities, we adopt and emphasize the human rights articles specified in the Constitution, international declarations, principles, treaties, and principles our country is a party to, ensuring that the rights of our employees are respected.

Protecting personal data and respecting the fundamental rights and freedoms of individuals whose personal data is collected are the main principles of our personal data processing policy. Therefore, we conduct all our activities related to personal data processing by protecting privacy, communication confidentiality, freedom of thought and belief, and the right to effective legal remedies.

We take all necessary administrative and technical protection measures in accordance with the legislation and current technology, considering the nature of the data.

Our company reserves the right to make changes to this notification due to possible changes in the KVK Law and methods to be determined by the Personal Data Protection Board.

COOKIE POLICY

9.1. What are Cookies?

Cookies are small text files stored on your devices with network access through browsers when you visit websites over the internet. Cookies are used on Internet Sites as described in this text.

9.2. Why Do We Use Cookies?

Depending on your device, we use cookies primarily for the following purposes:

• To make your visit to our Internet Sites more enjoyable and to increase the usability and functionality of the Internet Sites.
• To recognize you on your next visit to our Internet Sites and to offer content and personalized browsing options tailored to your expectations and interests.
• To offer opportunities for products and services specific to you, such as internet advertising, targeting, re-targeting (retargeting and re-targeting), cross-selling, campaigns, opportunities, and product/service advertisements, and making commercial offers by considering your preferences and recent purchases.
• To create traffic statistics.
• To determine how you learned about our Internet Sites.

9.3. What Cookies Do We Use?

For more information about the cookies used on this Internet Site, please click here.

9.4. How Can You Adjust Cookie Settings on Your Internet Browser?

Although internet browsers are generally programmed to accept cookies by default, you can easily change this setting by changing the settings on your browser. However, if you choose to disable cookies on your browser, you may not be able to take advantage of all the functional features offered on our Internet Sites.

For more information about cookie settings, please refer to the following links:

• http://www.aboutcookies.org/
• For Internet Explorer™: http://windows.microsoft.com/en-us/windows7/how-to-manage-cookies-in-int…
• For Safari™: http://support.apple.com/kb/HT1677?viewlocale=en_US
• For Chrome™: https://support.google.com/chrome/answer/95647?hl=en
• For Firefox™: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-…
• For Opera™: http://help.opera.com/Windows/10.20/en/cookies.html

As a reminder, by disabling cookies on your internet browser, you will also disable all cookies, including those necessary for the proper functioning of our websites.

9.5. Do We Accept Cookies from Third Parties?

While visiting our Internet Sites, cookies from the third-party websites listed below may be stored on your device to personalize and improve the content presented to you, including advertising:

• Social Network Content: We may publish content from social networks on our support pages. Therefore, by referring to this content on our support pages, a cookie from the relevant social network may be stored on your device. For more detailed information, we recommend reading the cookie policies of these social networks.
• Flash Cookies: Files stored by Flash software. This tool is mostly installed as an extension of internet browsers to display dynamic objects such as animated graphics or video directories. Therefore, Flash cookies may be installed due to the use of this application. For more information, we recommend reading the cookie policy on adobe.com.
• Google Analytics
• Doubleclick.net
• Google Tag Manager
• Google Ads
• Google Dynamic Remarketing
• Facebook Custom Audience

9.6. Do We Place Cookies on Third-Party Support Pages?

We may place our cookies on the websites of our business partners who publish advertisements for our brands and/or products. These cookies are used to provide you with relevant content that appeals to your interests and to evaluate how long our content (including advertising) is displayed.

9.7. What Cookies Are Placed on This Site?

The following cookies are used on this Internet Site, and this table may be updated from time to time:

Status

• Cookie Name: Google Analytics

  • Purpose: Site Participation and Use
  • Feature: Performance
  • Description: Each visitor is given a single identifier with the UTM cookie so that the same visitor is not recorded twice.

• Cookie Name: Doubleclick.net

  • Purpose: Evaluation of Advertising Effectiveness
  • Feature: Advertising
  • Description: This cookie is used to understand how internet users respond to advertising campaigns. It helps us understand and evaluate ad clicks to improve our offers.

• Cookie Name: Google Tag Manager

  • Purpose: Tags
  • Feature: Functional
  • Description: A set of codes that allows you to track visitor movements and determine whether user behaviors have been achieved based on your selection.

• Cookie Name: Google Ads

  • Purpose: Evaluation of Advertising Effectiveness
  • Feature: Advertising
  • Description: Google AdWords associates users’ advertisements with the searched keyword.

• Cookie Name: Google Dynamic Remarketing

  • Purpose: Site Participation and Use
  • Feature: Advertising
  • Description: Displays advertisements to users who have visited our website or used your mobile application. For example, remarketing helps you reconnect with users by showing relevant ads on their different devices after they leave your website without making a purchase.

• Cookie Name: Facebook Custom Audience

  • Purpose: Target Audience Identification
  • Feature: Performance
  • Description: Processing social media-connected codes to identify target audiences.