1. DEFINITIONS

Explicit Consent: Freely given, informed, and specific consent.

Anonymization: Rendering personal data permanently unidentifiable with a natural person.

Personal Data: Any information relating to an identified or identifiable natural person.

Special Categories of Data: Data concerning race, ethnicity, political opinion, religion, health, biometric, or criminal records.

Data Processing: Any operation performed on data such as collection, recording, storage, adaptation, or transfer.

Board / Policy / Data Processor: Personal Data Protection Board, Dereli Graphic Policy, and natural/legal person processing data on behalf of controller.

Data Controller: Real or legal entity determining purposes and means of processing personal data (Dereli Graphic A.S.).

2. PURPOSE

This Policy is established to set the core principles for compliance with obligations imposed on data controllers under 6698 Personal Data Protection Law (KVKK).

3. SCOPE & AMENDMENTS

This Policy covers personal data of customers, employees, suppliers, and third parties processed automatically or non-automatically. Dereli Graphic reserves the right to amend this policy.

4. CORE PRINCIPLES OF DATA PROCESSING

Dereli Graphic adopts the following principles when collecting and processing data:

• a. Compliance with Law and Fairness: Proportionality and necessity principles are prioritized.
• b. Purpose Limitation: Data is processed solely for specified, explicit, and legitimate purposes.
• c. Transparency & Notice: Data subjects are informed regarding identity, purpose, and rights.
• d. Data Minimization: Only necessary data is processed for the intended purpose.
• e. Erasure of Data: Data is destroyed or anonymized once statutory retention periods expire.
• f & g. Accuracy, Confidentiality & Security: Technical and administrative measures are taken against cyber threats.

5. DATA PROCESSING CONTEXTS

a. Customer & Partner Data: Data processed without consent for contract performance. Sensitive data processed with explicit consent or under health confidentiality.

b. Employee Data: Necessary for employment contract performance. Unsuccessful job applicant data is destroyed at end of retention period. Corporate phones and emails are filtered for cyber security.

c. Access Restrictions: Unauthorized employee access is strictly prohibited. Violations subject employees to disciplinary and legal liability.

6. TRANSFER OF PERSONAL DATA

Data may be transferred to partners, suppliers, shareholders, and public authorities under KVKK Articles 8 and 9. International transfers require Board approval and written commitments.

7. DATA SUBJECT RIGHTS & APPLICATION PROCEDURES

Data subjects hold rights to inquire, access, rectify, delete, and object to automated processing. Exceptions include judicial operations and official statistics.

You may submit requests via our website form, notary, or via secure signature to dereligrafik@hs05.kep.tr. Applications are concluded free of charge within 30 days.

8. CONFIDENTIALITY

Personal data is strictly confidential. Employees may only access data required for their duties. Commercial or unauthorized use is prohibited and binding post-employment.

9 & 10. SECURITY & INCIDENT MANAGEMENT

Dereli Graphic conducts continuous technical and organizational security audits on its IT infrastructure. Data breaches will be reported immediately to affected individuals and the Board.

11. VERBIS REGISTRATION OBLIGATION

Our company fully complies with Data Controllers Registry (VERBIS) registration obligations under Article 16. Submitted parameters include:

• Dereli Graphic A.S. identity and contact info,
• Legal processing purposes of personal data,
• Data subject groups and corresponding data categories,
• Recipient groups and international transfer forecasts,
• Technical data security measures and maximum retention periods.