SAVES ENERGY JOINT STOCK COMPANY
PERSONAL DATA PROTECTION AND PROCESSING POLICY

1. PURPOSE

As Saves Enerji Anonim Şirketi (“Saves Enerji” or “Company”); Processing the personal data of real persons, including our customers, suppliers, users visiting our website and employees, in accordance with the relevant legislation, especially the Constitution of the Republic of Turkey and the Personal Data Protection Law No. 6698 (“KVKK”) regarding human rights, and effectively protecting the rights of the relevant persons whose data are processed. Ensuring its use is our priority.

For this reason, but not limited to the following; Saves Energy Joint Stock Company Personal We carry out this process in accordance with the Data Protection and Processing Policy (“Policy”).

Protection of personal data and respect for the fundamental rights and freedoms of natural persons whose personal data are collected are the basic principles of our policy regarding the processing of personal data. For this reason, we continue all our activities in which personal data is processed, taking into account the rights to protect the privacy of private life, confidentiality of communications, freedom of thought and belief, and the use of effective legal remedies. To protect personal data, we take all administrative and technical protection measures required by the nature of the relevant data in accordance with the legislation and current technology.

2. SCOPE

All personal data processed by the Company, including our customers, business contacts, business partners, employees, suppliers, potential customers, users visiting our website and other third parties are within the scope of this Policy.

Our policy is applied in activities related to the processing of all personal data owned or managed by the Company, and has been handled and prepared by taking into consideration the KVKK and other relevant legislation regarding personal data and international standards in this field.

3. DEFINITION AND ABBREVIATIONS

• Company:Saves Energy Joint Stock Company
• Explicit Consent:Consent regarding a specific subject, based on information and free will, given in a clear manner that leaves no room for hesitation, and limited only to that transaction.
• Employee:Company personnel
• Personal Data Owner (Relevant Person):The real person whose personal data is processed.
• Personal Data: Any information regarding an identified or identifiable natural person.
• Special Personal Data:Persons’ race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, appearance and dress, association, foundation or union membership, health, sexual data regarding his life, criminal convictions, and security measures, as well as biometric and genetic data.
• Processing of Personal Data:Obtaining, recording, storing, preserving, changing, rearranging, disclosing personal data by fully or partially automatic or non-automatic means provided that it is part of any data recording system, Any operation performed on data such as transferring, taking over, making available, classifying or preventing its use.
• Data Processor:A natural or legal person who processes personal data on behalf of the data controller, based on the authority given by the data controller.
• Data Controller:The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.
• KVK Board:Personal Data Protection Board.
• KVK Authority:Personal Data Protection Authority.
• KVKK:Personal Data Protection Law published in the Official Gazette No. 29677 dated April 7, 2016.
• Policy:Saves Enerji A.Ş. Personal Data Protection and Processing Policy.

4. OBLIGATIONS REGARDING THE PROTECTION AND PROCESSING OF PERSONAL DATA

4.1. Our obligation to inform

• When collecting personal data as a data controller
• For what purposes your personal data will be processed
• Our identity, information regarding the identity of our representative, if any
• To whom and for what purpose your processed personal data may be transferred
• Our method of collecting data and its legal reason
• Rights arising from the law,

We have an obligation to inform the Relevant Person regarding the matters.

As a company, we take care to ensure that this Policy, which is open to the public, is clear, understandable and easily accessible.

4.2. Obligation to Comply with the Requests of the Personal Data Owner

Personal data owners have the right to request information regarding their own data within the scope of Article 11 of the Law, if necessary, by applying in writing or by other methods determined by the Personal Data Protection Board.

In this context, personal data owners;

• Learning whether personal data is being processed,
• Requesting information if personal data has been processed,
• Learning the purpose of processing personal data and whether they are used for their intended purpose,
• Knowing the third parties to whom personal data are transferred at home or abroad,
• Requesting correction of personal data in case their personal data has been processed incompletely or incorrectly and requesting that the action taken in this context be notified to third parties to whom personal data has been transferred,
• To object to the situation if a result is found to be unfavorable to the person by analyzing the processed personal data,
• They have the right to demand compensation for the damage if they suffer damage due to unlawful processing of their personal data.

4.3. Obligation to Ensure the Security of Personal Data

Saves Energy; In accordance with Article 12 of the Law, it takes the necessary technical and administrative measures to ensure the appropriate level of security to prevent the personal data they process from being processed unlawfully, to prevent unlawful access to personal data, and to ensure that the data in question is stored in accordance with the law.

5. CLASSIFICATION OF PERSONAL DATA

5.1. Personal data

Personal data; It is all kinds of information regarding an identified or identifiable natural person. Protection of personal data only concerns real persons, and information belonging to legal entities that does not contain information about a natural person is excluded from personal data protection. Therefore, this Policy does not apply to data belonging to legal entities.

5.2. Special categories of personal data

Personal data of individuals regarding their race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, appearance, association, foundation or union memberships, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data are qualified personal data.

Saves Enerji also attaches importance to the processing and protection of sensitive personal data. When processing special personal data, it is first determined whether the data processing conditions exist, and data processing activities are carried out after ensuring that the legal compliance conditions exist. Special categories of personal data are processed directly in cases required by the legislation, in accordance with the administrative/technical measures prescribed by the Personal Data Protection Board, and in other cases, with the explicit consent of the special personal data owner.

6. PRINCIPLES ON THE PROCESSING OF PERSONAL DATA

Saves Enerji processes personal data in accordance with the principles stated below.

6.1. Processing in Compliance with Law and Honesty

Saves Energy processes personal data in accordance with the law and the rules of honesty. In this context, personal data is processed by our Companies with limited information to the extent required by business activities.

6.2. Ensuring Personal Data is Accurate and Up to Date When Necessary

Saves Enerji has taken the necessary technical and administrative measures to ensure the accuracy and up-to-dateness of personal data throughout the period of processing. It ensures that the data is corrected upon the application of the data owner or in case of detection.

6.3. Processing for Specific, Clear and Legitimate Purposes

Saves Enerji clearly and specifically sets out the purposes of processing personal data and processes it for legitimate purposes in connection with its business activities.

6.4. Personal Data Must Be Related to the Purpose for Processing, Limited and Proportionate

Saves Enerji processes personal data to the extent necessary to achieve the data processing purposes, in connection with the data processing conditions.

6.5. Storage of Personal Data as Envisaged by Legal Regulations and for Our Commercial Legitimate Interests

Saves Enerji complies with the period stipulated in the relevant legislation or required by the purpose of data processing. If such a period is determined, personal data is deleted, destroyed or anonymized if the period expires or the reasons requiring the processing of personal data disappear.

7. PURPOSES OF PROCESSING PERSONAL DATA

As a company, we process personal data for purposes similar to, but not limited to, the following:

• Our Company and the group companies to which our Company is affiliated, real person merchants or legal entity customers, suppliers, and third parties whose services we benefit from,If you are an employee/contact person/partner/authorized person, identity, communication, physical location security, finance (IBAN/bank account information, execution of contract processes within the scope of our Company’s activities, follow-up of legal accounting works, goods and services procurement processes, goods and services production and operations) carrying out business processes, carrying out and auditing business activities, carrying out business continuity activities, carrying out financial and accounting affairs, carrying out communication activities, carrying out logistics activities, carrying out internal audit / investigation / intelligence activities, providing information to authorized persons, institutions and organizations upon request, access execution of authorities, execution of information security processes,
• If you are an employee/contact person/partner/official of the group companies to which our company is affiliated, or an employee/contact person/partner/official of the real person trader or legal entity customers of the group companies to which our company is affiliated, identity, contact, finance (IBAN/account information) Your customer transaction and legal transaction data can be processed through financial and accounting activities, access authorizations, business activities, follow-up and audit, legal affairs, audit/ethics activities and internal audit/investigation/intelligence activities, authorized persons, institutions and organizations upon request. Providing information to organizations, carrying out information security processes,
• If you visit our company’s workplaces, provide your ID, provide physical location security, ensure physical location security, create visitor records,
• Owned by Saves Enerji https://saves.com.tr/ internet site online visitor, processing of user data in accordance with the relevant legislation, creating and tracking visitor records, keeping log records created electronically, carrying out information security processes,
• Communicating with the data owner and carrying out administrative operations regarding the communication carried out by Saves Enerji,
• Enabling the data owner to benefit from the services provided through the site, detecting system errors, monitoring performance and improving the functioning of the site,
• Carrying out the necessary work by the relevant business units for the realization of the commercial activities carried out by Saves Enerji and carrying out the related business processes, ensuring the legal, technical and commercial/occupational security of Saves Enerji and the people with whom it has business relations, and ensuring the commercial and/or occupational safety of Saves Enerji. or planning and execution of business strategies,
• Determining and implementing Saves Enerji’s commercial and business strategies, carrying out work on business development and planning activities,
• Establishment of possible rights and receivables of the relevant parties,
• Corporate reputation management, execution of company human resources process and media communication,
• Following up and auditing finance and/or accounting affairs and carrying out activities aimed at detecting customers’ financial risks,
• Making necessary arrangements to ensure that the processed data is up-to-date and accurate.

8. EXCEPTIONAL CASES WHERE EXPRESS CONSENT IS NOT REQUIRED FOR THE PROCESSING OF PERSONAL DATA

We may process personal data without explicit consent in the following exceptional cases arising from the law:

• Clearly prescribed by law
• It is necessary to process personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract
• Data processing is mandatory for the establishment, exercise or protection of a right
• It is mandatory for us to process your data for our legitimate interests as the data controller, provided that fundamental rights and freedoms are not harmed
• It is mandatory to fulfill any of our legal obligations as the data controller
• It is necessary for the protection of the life or physical integrity of the person or someone else who is unable to express his/her consent due to actual impossibility or whose consent is not given legal validity
• It has been made public by the person concerned

9. TRANSFER OF PERSONAL DATA

9.1. Transfer of personal data domestically

In accordance with Article 8 of the Law, Saves Enerji acts in accordance with the data processing conditions in data transfer activities carried out domestically. Therefore, no transfer is made to third parties without the explicit consent of the data owner. However, if one of the situations specified in Article 4 of the Law, where the explicit consent of the data owner is not required, exists, it is possible to transfer personal data to third parties within the country without the explicit consent of the data owner.

9.2. Transfer of Personal Data Abroadma

In accordance with Article 9 of the Law, Saves Enerji does not transfer data abroad without the explicit consent of the data owner.
However, if one of the following situations exists, it is possible to transfer personal data to third parties abroad without seeking the explicit consent of the data owner:

• Adequate protection exists in the foreign country to which personal data will be transferred,
• In case there is no adequate protection, Saves Enerji and the data controllers in the relevant foreign country must undertake in writing to provide adequate protection and have the permission of the Personal Data Protection Board

9.3. Third Parties to whom Personal Data May Be Transferred

Saves Enerji may transfer the personal data of data owners to the following categories of persons in accordance with Articles 8 and 9 of the Law:

• To Our Suppliers
• To our business partners and business contacts
• To our company’s subsidiaries and group companies
• To legally authorized public institutions and organizations
• To legally authorized private legal persons
• To the service recipient or third parties or collaborating consultants, organizations or authorities
• To our shareholders

It can be transferred within the conditions and purposes listed in Articles 8 and 9 of the Law, in accordance with the principles and rules explained above.

10. RIGHTS OF PERSONAL DATA OWNER

Within the scope of our obligation to inform, we inform the Personal Data Owner and establish systems and infrastructures for this information. We make the necessary technical and administrative arrangements for the Personal Data Owner to exercise his rights regarding your personal data.

• • – Learning whether your personal data is being processed

,

• – Requesting information if your personal data has been processed,
• – Learning the purpose of processing your personal data and whether they are used for their intended purpose,
• – Knowing the third parties to whom your personal data is transferred at home or abroad,
• – Requesting correction of your personal data if it is incomplete or incorrectly processed,
• – Requesting the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the Law,
• – Requesting that the transactions carried out in accordance with paragraphs (d) and (e) of Article 11 of the Law be notified to third parties to whom your personal data has been transferred,
• – Object to the emergence of a result that is unfavorable to you by analyzing your processed data exclusively through automatic systems,
• – In case you suffer damage due to unlawful processing of your personal data, you have the right to request compensation for the damage.

10.1. Exercise of rights regarding personal data

The Personal Data Owner may submit your requests regarding the implementation of the Law by filling out the application form in the link, with a wet signature, to the company address “Kuzguncuk Mah. Gümüşyolu Çokmazı Sok. No: 5/8 Üsküdar / İstanbul”, through a notary, by registered mail, by personal application or electronically. After signing the completed application form with your mobile signature and secure electronic signature, you can send it to savesenerji@hs03.kep.tr.

In the application that the Personal Data Owner will make to exercise the above-mentioned rights and includes explanations about the right he/she requests to use; The requested matter must be clear and understandable, the requested subject must be related to the applicant personally, or if acting on behalf of someone else, he must be specifically authorized in this matter and this authority must be documented, and the application must include identity and address information and documents proving his identity must be attached to the application. These requests will be made on an individual basis and requests made by unauthorized third parties regarding personal data will not be taken into consideration.

10.2. Evaluation of the application

10.2.1. Application response time

Requests regarding personal data are concluded as soon as possible, depending on their nature, and in any case within 30 (thirty) days at the latest, free of charge, or against a fee in the tariff, if the conditions in the tariff to be published by the KVK Board are met.
Additional information and documents may be requested during the application or while the application is being evaluated.

10.2.2. Procedure for evaluating the application

10.2.1 of this Policy. In order for the response period specified in the article to start, you must send the requests in writing and with wet signature, or with electronic signature and via KEP, or with information and documents proving the identity of the applicant by other methods determined by the KVK Board.

If the request is accepted, the relevant action is taken and notification is made in writing or electronically. If the request is rejected,e, the reason is explained and notified to the applicant in writing or electronically.

11. RIGHT TO COMPLAIN TO THE PERSONAL DATA PROTECTION BOARD

In cases where the application is rejected, our response is found insufficient or we do not respond in time; The applicant has the right to complain to the KVK Board within 30 (thirty) days from the date of learning the answer and in any case within 60 (sixty) days from the date of application.

12. COMPLIANCE OF SAVES ENERJİ WITH THE PROTECTION AND PROCESSING OF PERSONAL DATA POLICY

• Systems regarding deletion, destruction and anonymization of personal data are being updated.
• Necessary security systems have been established to protect personal data. The system is kept up to date.
• Personal data owners are informed during the collection of the data, and the necessary information is provided if they request information.
• When creating policies for the protection and processing of personal data, we comply with the regulations stipulated in the Law and relevant legislation.

13. PUBLISHING AND STORAGE OF THE POLICY

This Policy is stored in two different media: printed paper and electronic media.

14. UPDATING THE POLICY

This Policy is reviewed at periods to be determined by the Company and, when necessary, is updated within the laws and regulations and the principles determined within the Company.

15. ENFORCEMENT

This Policy comes into force from the date of publication.