Gentuğ Tekstil Ürünleri Sanayi ve Ticaret A.Ş.

As Gentuğ Tekstil Ürünleri Sanayi ve Ticaret A.Ş., we attach great importance to the security of your personal data. We reserve the right to update this Information Notice on the Protection of Personal Data at any time in line with changes in applicable legislation, decisions of the Personal Data Protection Board and court decisions. With this in mind, it is of great importance to our Company that all personal data of every person associated with the Company, including those who benefit from our services, is processed and stored in accordance with Law No. 6698 on the Protection of Personal Data (the “KVK Law”). We hereby inform you that your personal data will be processed by our Company, and that any operation performed on your data – including obtaining, recording, storing, retaining, altering, disclosing, transferring or making it available, whether by automated or non-automated means – constitutes “processing of personal data”. In this context:

• Law No. 6563 on the Regulation of Electronic Commerce also contains provisions on the protection of personal data.
• Under the provisions of Turkish Penal Code No. 5237, criminal sanctions are foreseen in certain cases for the protection of personal data.
• Furthermore, data must be collected and used in order to fulfil our obligations arising from Law No. 6502 on Consumer Protection and the Regulation on Distance Contracts.
• In addition, under Law No. 6769 there is data that our Company is obliged to retain. In line with this responsibility, in our capacity as “Data Controller” as defined in the KVK Law, we process your personal data as explained below and within the limits set by the legislation.

After you have reviewed this information notice and notified our Company accordingly, you will be presented with a consent text so that your personal data may be used by our Company within the scope of, and limited to the requirements of, the business and commercial relationship between you and our Company. Please note that signing this consent text is not mandatory. For it to be valid, the consent text should be approved only after this information notice has been reviewed in sufficient detail and, if any, all your questions have been forwarded to our Company.

In this information notice:

• Personal Data: any information relating to an identified or identifiable natural person;
• Personal Data Protection Law (“KVKK”): Law No. 6698 on the Protection of Personal Data, published in the Official Gazette and entered into force on 7 April 2016;
• Our Company: Gentuğ Tekstil Ürünleri Sanayi ve Ticaret A.Ş.;
• Data Processor: the natural or legal person who processes personal data on behalf of the data controller based on the authority granted by it;
• Data Controller: the natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system.

Pursuant to the KVK Law, your personal data may be processed by our Company, as data controller, within the scope explained below.

In order to ensure that the activities carried out by our Company are performed in accordance with the relevant legislation and our Company procedures, and to fulfil its obligations and commitments under all relevant national/international legislation, secondary regulations issued by national/international competent authorities on that basis, and the contracts to which it is a party in connection with these or with its activities, the following data is processed by our relevant departments:

• Identity information (name and surname, mother’s and father’s names, mother’s maiden name, date and place of birth, marital status, copy and serial number of the identity card, Turkish ID number, and passport information for foreign nationals);
• Contact information (address, e-mail address, correspondence address, registered electronic mail (KEP) address, telephone number);
• Location information (location data of where the person is);
• Customer transactions (call centre records, invoice, promissory note and cheque information, information on bank receipts, order information, request information);
• Risk management (information processed to manage commercial, technical and administrative risks);
• Finance (balance sheet information, financial performance information, credit and risk information, asset information);
• Visual and audio recordings;
• Physical premises security (entry and exit records of employees and visitors, camera recordings);
• Transaction security (IP address information, website login and logout information, password information);
• Marketing (shopping history, surveys, cookie records, information obtained through campaigns).

In addition, your personal data will be processed within the personal data processing conditions and purposes set out in Articles 5, 6, 8 and 9 of the KVK Law for the following purposes: establishing contracts for all products and services you request from our Company and preparing all other records and documents (on paper or electronically); conducting customer satisfaction calls; fulfilling SMS/e-mail requests; providing these products and services and ensuring their proper and uninterrupted continuation; carrying out the activities required for services and products; performing participant and customer transactions; processing in accordance with the Terms of Service or the product-specific contract; resolving complaints and improving services; carrying out customers’ lawful and contractual instructions; planning our Company’s human resources policies and processes; determining the scope of service, product and marketing activities; identifying and evaluating customers’ purchasing habits; identifying, statistically evaluating and executing marketing and service processes and their results; using data as evidence in the event of a legal dispute; fulfilling our obligations under the legislation and international rules to which our Company is subject; and protecting and retaining data that the authorities require to be kept for certain periods.

Your collected personal data is processed with the consent of customers and in accordance with the legislation, by our relevant departments, in order to ensure that the activities carried out by our Company comply with the relevant legislation and our procedures, within the scope of all relevant national/international legislation and secondary regulations issued on that basis, for the following purposes:

• Verifying the identity of the person shopping, or having shopping done, via the website or mobile applications;
• Establishing the contract requested by the Customer in respect of services and products;
• Recording the address and other information necessary for communication;
• Contacting customers and providing the necessary information regarding the terms, current status and updates of contracts concluded under the relevant articles of the Consumer Protection Law, in order to establish distance sales and/or sales contracts;
• Preparing all records and documents forming the basis of processing, electronically or on paper;
• Fulfilling the obligations required by the national/international legislation to which our Company is subject;
• Fulfilling the obligations of our Company under contracts concluded within the framework of the national/international legislation to which it is subject;
• Providing information to public officials upon request and as required by legislation on matters of public security;
• In order to provide customers with a better shopping experience: informing customers about products and services that may interest them taking their preferences into account, informing them of campaigns, carrying out activities that improve the user experience by monitoring consumer behaviour, market research, planning and implementing after-sales service activities, and organising and implementing relationship management processes;
• Increasing customer satisfaction, conducting customer satisfaction calls, fulfilling SMS/e-mail requests, identifying the purchasing habits of customers shopping via the website and/or mobile applications, and using the data in marketing and advertising activities for direct and indirect marketing, personalised marketing and remarketing according to customer preferences; in this context providing information electronically and/or physically through contracted organisations, defining target audiences, cross-selling, personalised segmentation, targeting, analysis and internal reporting;
• Carrying out R&D on the operation of our Company’s website and mobile application and personalising them according to consumer requests, preferences and needs;
• Fulfilling our Company’s obligations (identification, information storage, reporting, information) and commitments under the contracts to which it is a party;
• Resolving Customer complaints and improving the services offered by our Company;
• Carrying out customers’ lawful and contractual instructions;
• Planning our Company’s human resources policies and processes;
• Determining the scope of service, product and marketing activities, identifying and statistically evaluating their results, and executing them;
• Using data as evidence in the event of a legal dispute;
• Fulfilling our obligations under the national and international legislation and rules to which our Company is subject;
• Planning, maintaining and improving after-sales service processes alongside the sales and marketing of products and/or services, identifying and developing alternative production techniques, and planning and implementing processes to develop and/or increase loyalty to our products and/or services;
• Protecting and retaining, for the periods specified in the relevant legislation, data that the authorities require to be kept for certain periods.

All personal data within the scope set out above may be transferred, within the personal data processing conditions and purposes specified in Articles 8 and 9 of the KVK Law, to company officials, third parties, domestic and foreign business partners, solution partners, suppliers, legally authorised public institutions and private persons, and to persons and institutions authorised to request and obtain such data under the legislation to which our Company is subject. This includes obtaining, recording, storing, altering, updating, periodically checking, reorganising and classifying the data in whole or in part in a corporate or commercial capacity and as data controller and/or data processor; retaining it for as long as necessary for the purpose for which it is processed or for the period stipulated in the relevant law; sharing it, where legally or operationally required, with public institutions and organisations with which our Company works or to which it is legally obliged and/or with third-party service providers and suppliers resident in Türkiye or abroad; and transferring it abroad where legally or operationally required.

Depending on your relationship with our Company, your personal data may be collected verbally, in writing or electronically, by automated or non-automated methods, through our Company’s departments and offices, website, social media channels, mobile applications and similar means. Personal data collected in this way may be processed and transferred for the purposes set out in articles (2) and (3) of this notice, within the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVK Law. In addition, when you use our website to use our Company’s services, visit our Company or website, or attend training sessions, seminars or events organised by our Company, your personal data may be processed for the purposes stated in article 3.

When you use our Company’s website, the information collected is stored in order to form an understanding of your preferences. The following cookies are used on our website to track your browsing information and/or usage history in order to provide personalised promotions, organise promotional and marketing activities, improve the content of the website and/or determine your preferences:

• Cookiebot – stores the user’s cookie consent status for the current domain.
• Google Analytics – generates statistical data on how the visitor uses the website.
• Google Ads – collects statistical data on how the visitor uses the website and provides marketing statistics to the company.
• YouTube – registers a unique ID to keep statistics on which YouTube videos the user has seen.

Our Company’s website may provide links to websites belonging to third parties and institutions. Although these links are used to make it easier to obtain information and/or provide a service, if you are directed to other websites, companies or persons outside our Company’s website, you should review their privacy rules and cookie policies separately.

In such cases, our Company bears no responsibility for websites other than its own obtaining and processing your personal data. To be informed about the practices of the relevant persons and institutions regarding privacy and personal data, you should first review the information provided on the relevant websites and, if necessary, forward your questions to the management of those sites.

When determining retention periods for personal data, our Company takes into account the national and international legislation in force to which it is subject and the purposes for which the data is processed. In accordance with the KVKK, your personal data processed for the purposes stated in this Information Notice will be deleted, destroyed or anonymised for continued use by us when the purpose requiring its processing ceases to exist pursuant to Article 7/1 of the KVKK and/or when all periods, including the statutory limitation periods for which we are required to process your data under the legislation, have expired.

If you, as data subjects, submit your requests regarding your rights to our Company using the methods set out below in this Information Notice, our Company will conclude your request as soon as possible and within one month at the latest, depending on the nature of the request. In this context, data subjects have the right to:

• learn whether their personal data is being processed;
• request information if their personal data has been processed;
• learn the purpose of processing their personal data and whether it is used in line with that purpose;
• know the third parties in Türkiye or abroad to whom their personal data is transferred;
• request the correction of personal data that is incomplete or inaccurately processed, and request that this be notified to the third parties to whom the personal data has been transferred;
• request the deletion or destruction of personal data where the reasons requiring its processing no longer exist, even though it has been processed in accordance with the KVK Law and other applicable laws, and request that this be notified to the third parties to whom the personal data has been transferred;
• object to any outcome to their detriment arising from the analysis of the processed data exclusively through automated systems;
• claim compensation for damages if they suffer loss due to the unlawful processing of their personal data.

Pursuant to Article 13(1) of the KVK Law, you may submit your request to exercise the above rights in writing to Savaş Caddesi, Söğüt Sokak No:1, 34173 Merter, İstanbul, Türkiye. Should fulfilling your request require our Company to incur costs, we reserve the right to charge you according to the tariff set out in Article 13 of the KVKK, “Application to the data controller”. As the Personal Data Protection Board has not yet determined any other method, you must submit your application to our Company in writing in accordance with the KVK Law. The channels and procedures for submitting your written applications under Article 11 of the KVK Law are explained below.

To exercise the rights listed above, you may submit your request – containing the information necessary to identify you and your explanations regarding the right under Article 11 of the KVK Law that you wish to exercise – in person, together with documents verifying your identity, to Gentuğ Tekstil Ürünleri Sanayi ve Ticaret A.Ş., Savaş Caddesi, Söğüt Sokak No:1, 34173 Merter, İstanbul; send it via a notary public or by other methods specified in the KVK Law; or send it with a secure electronic signature to [email protected].

For more detailed information on the above, you can reach us by phone at +90 212 637 09 89 or by e-mail at [email protected].

I have read and understood the information notice.