1.  Introduction

1.1 Purpose of the Policy

Within the scope of Law No. 6698 on the Protection of Personal Data (“Law” or “LPPD”), as the Firm FOL YAZILIM A.Ş. (“Firm” or “Company”), the processing and protection of personal data in accordance with the law is among our most important priorities. We follow the same priority in all our planning and business activities. In this context, in accordance with Article 10 of the Law, we hereby present this Policy on Processing and Protection of Personal Data (“Policy”) for your information in order to enlighten you and to inform you of all administrative and technical measures we will implement within the scope of processing and protection of personal data.

1.2  Scope

This Policy determines the conditions for processing personal data and sets out the principles adopted by the Company in the processing of personal data. In this context, the Policy covers all personal data processing activities carried out by the Company within the scope of the Law, all personal data processed and the owners of this data.

1.3  Definitions

1.4 Entry into Force of the Policy

This Policy issued by the Company entered into force on 10.01.2023 and was presented to the public. In case of conflict between the legislation in force, especially the Law, and the regulations in this Policy, the

provisions of the legislation shall apply.

The Company reserves the right to make changes to the Policy in parallel with legal regulations. The current version of the Policy can be accessed from the Company (https://www.river.com.tr/eng) website.

2. Information on Personal Data Processing Activities Conducted by the Company

2.1 Data Subjects

Data subjects within the scope of the Policy are all natural persons, other than the Company’s employees, whose personal data are processed by the Company. In general, data subjects can be listed as follows:

The categories of data subjects described in the table above are indicated for general information sharing purposes. The fact that the data subject does not fall within the scope of any of these categories does not eliminate the nature of the data subject as stated in the Law.

2.2  Purposes of Processing Personal Data

2.2.1 Carrying out the necessary work by the relevant units and executing business processes to ensure that the relevant people benefit from the products and services offered by the Company:

1. 1. Planning and execution of sales processes of products and/or services,
   2. Planning and/or execution of after sales support services activities,
   3. Planning and execution of customer relationship management processes,
   4. Follow-up of contract processes and/or legal requests,
   5. Follow-up of customer requests and/or

2.2.2  Planning and execution of company human resources policies and processes:

1. Planning and execution of talent and career development activities,
2. Fulfillment of obligations arising from the employment contract and/or legislation for Company employees,
3. Planning and execution of side benefits and social benefits for employees,
4. Planning and execution of internal orientation activities,
5. Planning and execution of personnel exit procedures,
6. Remuneration management
7. Planning of human resources processes,
8. Managing personnel recruitment processes,
9. Planning and execution of appointment, promotion and termination processes for the company,
10. Planning and execution of employee performance evaluation processes,
11. Monitoring and/or supervision of employees’ work activities,
12. Planning and/or execution of in-house training activities,
13. Planning and execution of employee satisfaction and/or engagement processes,
14. Planning and execution of the processes of receiving and evaluating suggestions for the improvement of employees’ work and/or production processes,
15. Planning and/or execution of intern and/or student recruitment, placement and operation

2.2.3  Carrying out the necessary work by the relevant business units for the realization of the commercial activities carried out by the company and carrying out the related business processes:

1. Event management,
2. Planning and execution of business activities,
3. Planning and execution of corporate communication activities,
4. Planning and execution of supply chain management processes,
5. Planning and execution of production and/or operation processes,
6. Planning, auditing and execution of information security processes,
7. Establishment and management of information technology infrastructure,
8. Planning and execution of business partners’ authorizations to access information,
9. Follow-up of financial and/or accounting affairs,
10. Planning and execution of corporate sustainability activities,
11. Planning and execution of corporate governance activities,
12. Planning and/or execution of business continuity activities,
13. Planning and execution of logistics

2.2.4  Planning and execution of the activities necessary to recommend and promote the products and services offered by the company to the relevant persons by customizing them according to their tastes, usage habits and needs:

1. Identification and/or evaluation of people to be subject to marketing activities in line with consumer behavior criteria,
2. Design and/or execution of customized marketing and/or promotional activities,
3. Design and/or execution of advertising and/or promotion and/or marketing activities in digital and/or other media,
4. Design and/or execution of activities to be developed on customer acquisition and/or value creation in existing customers in digital and/or other channels,
5. Planning and/or execution of data analytics activities for marketing purposes,
6. Planning and execution of marketing processes of products and/or services,
7. Planning and/or execution of the processes of creating and/or increasing loyalty to the products and/or services offered by the Company.

2.2.5  Planning and execution of the Company’s commercial and/or business strategies:

Managing relationships with business partners.

2.2.6  Ensuring the legal, technical and commercial business security of the Company and the relevant persons who have a business relationship with the Company:

1. Planning and execution of the necessary operational activities to ensure that the Company’s activities are carried out in accordance with Company procedures and/or relevant legislation,
2. Providing information to authorized institutions due to legislation,
3. Creation and follow-up of visitor records,
4. Planning and execution of emergency management processes,
5. Realization of company and partnership law transactions,
6. Planning and execution of company audit activities,
7. Planning and/or execution of occupational health and/or safety processes,
8. Realization of risk management of credit processes,
9. Ensuring the security of company premises and/or facilities,
10. Ensuring the security of company operations,
11. Planning and/or execution of the Company’s financial risk processes,
12. Ensuring the security of company fixtures and/or

2.3  Categories of Personal Data

Personal data categorized by the Company as follows are processed in accordance with the personal data processing conditions in the Law and the relevant legislation:

3. Principles and Conditions Regarding the Processing of Personal Data

In accordance with Article 4 of the Law on the processing of personal data, pursuant to the law and honesty rules, the company carries out personal data processing activities in accordance with the law and honesty rules, in an accurate and, where necessary, up-to-date, specific, clear and legitimate purposes, in connection with the purpose, in a limited and measured manner. The company retains personal data for the period stipulated by law or required by the purpose of personal data processing.

3.1  Principles Regarding the Processing of Personal Data

The company enlightens data subjects in accordance with Article 10 of the LPPD and processes this personal data based on the following principles by requesting consent from data subjects in cases where consent is required.

3.1.1  Processing of Data in Compliance with the Law and Rules of Good Faith

The Company acts in accordance with the principles introduced by legal regulations and the general rule of trust and honesty in the processing of personal data. In accordance with the principle of compliance with the rule of honesty, the Company takes into account the interests and reasonable expectations of the relevant persons while trying to achieve its goals in data processing.

3.1.2  Ensuring that Personal Data is Accurate and Updated When Necessary

Keeping personal data accurate and up-to-date is necessary for the Company to protect the fundamental rights and freedoms of the person concerned. The Company has an active duty of care to ensure that personal data is accurate and up-to-date when necessary. For this reason, all communication channels are open for the Company to keep the information of the data subject accurate and up-to-date.

3.1.3  Processing of Data for Specific, Explicit and Legitimate Purposes

The company clearly and precisely determines the legitimate and lawful purpose of personal data processing. It processes personal data in connection with and necessary for the commercial activity it carries out.

• Data being relevant, limited and proportionate to the purpose for which they are processed The Company processes personal data within the scope of the purposes related to its field of activity and necessary for the execution of its business. For this reason, it processes personal data in a manner suitable for the realization of the specified purposes and avoids the processing of personal data that is not related to the realization of the purpose or is not needed.

3.1.4  Retention of Data for the Period Stipulated in the Relevant Legislation or Required for the Purpose for which they are Processed

The company retains personal data only for the period specified in the relevant legislation or required for the purpose for which they are processed. In this context, First of all, it determines whether a period of time is stipulated for the storage of personal data in the relevant legislation, if a period is determined, it acts in accordance with this period, if a period is not determined, it keeps personal data for the period required for the purpose for which they are processed. Personal data are deleted, destroyed or anonymized by the

Company after the purpose of personal data processing disappears or upon expiration of the period stipulated in the legislation.

3.2  Conditions Regarding the Processing of Personal Data

In the presence of at least one of the personal data processing conditions in Article 5 of the Law, your personal data is processed by the Company.

3.2.1  Explicit consent of the personal data subject

One of the conditions for processing personal data is the explicit consent of the data subject. The explicit consent of the personal data subject must be related to a specific subject, based on information and free will.

In order to process personal data based on the explicit consent of the personal data subject, explicit consent is obtained from customers, potential customers and visitors through relevant methods.

3.2.2  Personal data processing activities being explicitly prescribed by law

The personal data of the data subject may be processed in accordance with the law without the explicit consent of the data subject, if expressly provided for in the law.

3.2.3  Failure to obtain the explicit consent of the person due to actual impossibility

The personal data of the data subject may be processed if it is mandatory to process the personal data of the person who is unable to disclose his/her consent due to actual impossibility or whose consent will not be recognized as valid, in order to protect his/her or another person’s life or physical integrity.

3.2.4  The personal data being directly related to the establishment or performance of a contract

Provided that it is directly related to the establishment or performance of a contract, it is possible to process personal data if it is necessary to process personal data belonging to the parties to the contract.

3.2.5  Fulfillment of legal obligations by the Company

Personal data of the data subject may be processed if processing is mandatory for the Company to fulfill its legal obligations as the data controller.

3.2.6 Publicization of personal data of the data subject

If the data subject has made his/her personal data public by himself/herself, the relevant personal data may be processed.

3.2.7  Data processing being mandatory for the establishment or protection of a right

If data processing is mandatory for the establishment, exercise or protection of a right, the personal data of the data subject may be processed.

3.2.8  Data processing being mandatory for the legitimate interest of the Company

Provided that it does not harm the fundamental rights and freedoms of the personal data subject, the personal data of the data subject may be processed if data processing is mandatory for the legitimate interests of the Company.

3.3  Processing of Special Categories of Personal Data

In the processing of personal data determined as “special quality” by the LPPD, the Company acts in strict compliance with the regulations stipulated in the LPPD.

Special categories of personal data are processed in the following cases by the Company provided that adequate measures to be determined by the PPD Board are taken:

• If the personal data subject has explicit consent or
• If the personal data subject does not have explicit consent;
• Special categories of personal data other than the health and sexual life of the personal data subject, in cases stipulated by law,
• Special categories of personal data relating to the health and sexual life of the personal data subject are processed only for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, by persons or authorized institutions and organizations under the obligation of

4.  Transfer of Personal Data

The company may transfer the personal data and special categories of personal data of the data subject to domestic or foreign third parties by taking the necessary security measures in line with the lawful personal

data processing purposes. In this direction, the company acts in accordance with the regulations stipulated in Article 8 of the LPPD.

4.1  Transfer of personal data to domestic third parties

Your personal data may be transferred by the Company in the presence of at least one of the data processing conditions specified in Articles 5 and 6 of the Law and explained under Title 3 of this Policy and provided that the basic principles regarding the data processing conditions are complied with.

4.2  Transfer of personal data to third parties abroad

The Company may transfer the personal data and special categories of personal data of the personal data subject to third parties abroad in the presence of at least one of the data processing conditions described under Title 3 of this Policy and by taking the necessary security measures. Personal data is transferred by the company to foreign countries declared by the PPD Board to have adequate protection (“Foreign Country with Adequate Protection”) or, in the absence of adequate protection, to foreign countries where the data controllers in Turkey and the relevant foreign country undertake adequate protection in writing and where the PPD Board has permission (“Foreign Country Where the Data Controller Undertakes Adequate Protection”). In this direction, the company acts in accordance with the regulations stipulated in Article 9 of the LPPD.

4.3  Third parties to whom personal data are transferred and the purposes of transfer

Within the general principles of the Law and the data processing conditions in Articles 8 and 9, the Company may transfer data to the parties categorized in the table below:

5. Rights of the Data Subject and Exercise of Related Rights

5.1 Rights of the personal data subject:

1. 1. Learn whether their personal data is being processed,
   2. Request information if their personal data has been processed,
   3. Learn the purpose of processing personal data and whether they are used for their intended purpose,
   4. Know the third parties to whom personal data are transferred domestically or abroad,
   5. Request correction of personal data in case of incomplete or incorrect processing and to request notification of the transaction made within this scope to third parties to whom personal data is transferred,
   6. Although it has been processed in accordance with the provisions of the LPPD and other relevant laws, to request the deletion or destruction of personal data in the event that the reasons requiring its processing disappear and to request notification of the transaction made within this scope to third parties to whom personal data is transferred,
   7. In the event that the processed data is analyzed exclusively through automated systems and a result occurs to the detriment of the person himself/herself, to object to this result,
   8. In case of damage due to unlawful processing of personal data, demand compensation for the

In the event that personal data is not obtained directly from the data subject, the Company carries out activities to enlighten data subjects (1) within a reasonable period of time from the acquisition of personal data, (2) if personal data will be used for communication with the data subject, during the first

communication, (3) if personal data will be transferred, at the latest during the first transfer of personal data.

5.2  Cases where the personal data subject cannot assert his/her rights:

Pursuant to Article 28 of the LPPD, personal data subjects cannot assert their rights listed in 5.1 in these matters, since the following cases are excluded from the scope of the LPPD:

1. Processing of personal data by natural persons within the scope of activities related to themselves or their family members living in the same residence, provided that personal data are not disclosed to third parties and obligations regarding data security are complied with,
2. Processing of personal data for purposes such as research, planning and statistics by anonymizing them with official statistics,
3. Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that such processing does not violate national defense, national security, public security, public order, economic security, privacy or personal rights or constitute a crime,
4. Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public security, public order or economic security,
5. Processing of personal data by judicial or enforcement authorities in relation to investigations, prosecutions, trials or executions.

Pursuant to Article 28.2 of the LPPD, in the cases listed below, personal data subjects cannot assert their other rights listed in 5.1, except for the right to demand compensation for the damage:

1. Processing of personal data is necessary for the prevention of crime or criminal investigation,
2. Processing of personal data made public by the personal data subject himself/herself,
3. Personal data processing is necessary for the execution of supervisory or regulatory duties and disciplinary investigation or prosecution by the authorized and authorized public institutions and

organizations and professional organizations in the nature of public institutions based on the authority granted by law,

4. Processing of personal data is necessary for the protection of the economic and financial interests of the State in relation to budgetary, tax and fiscal matters.

6.  Deletion, Destruction, Anonymization of Personal Data

Although it has been processed in accordance with the provisions of the relevant law as regulated in Article 138 of the Turkish Penal Code and Article 7 of the LPPD, personal data shall be deleted, destroyed or anonymized upon the resolution of the Company or upon the request of the personal data subject if the reasons requiring its processing disappear. In this context, the Company has taken the necessary technical and administrative measures within the Company in order to fulfill its relevant obligation, has developed the necessary operating mechanisms in this regard, and trains, assigns and raises awareness of, the relevant

business units, to act in accordance with these obligations.

Contact Us

Contact us for all your questions and comments regarding the Personal Data Protection Policy!