BANDİTO GİYİM TEKSTİL İTH. İHR. LTD.ŞTİ. 

PERSONAL DATA PROTECTION AND PROCESSING POLICY

1. 1. PURPOSE AND SCOPE

At BANDİTO GİYİM TEKSTİL İTH. İHR. LTD.ŞTİ. (hereinafter referred to as LOSBANDİTOS), maximum sensitivity is shown regarding the security of personal data in every one of our businesses. With this awareness, we attach great importance to the processing, recording, transferring, sharing, and storage of all kinds of personal data belonging to all individuals associated with our Companies, including those who benefit from our products and services, in accordance with the Law No. 6698 on the Protection of Personal Data (“KVKK Law”). In line with the importance it attaches to the protection of personal data, the LOSBANDİTOS KVKK Policy establishes the fundamental principles regarding the compliance of activities carried out by LOSBANDİTOS with the regulations set forth in the “KVKK Law”. Through the implementation of the provisions of the LOSBANDİTOS KVKK Policy, the data security principles adopted by LOSBANDİTOS will be made sustainable. The LOSBANDİTOS KVKK Policy is aimed at real persons whose personal data is processed by LOSBANDİTOS, provided that they are part of any data system, through automatic and non-automatic means, and at LOSBANDİTOS employees.

1. 2. GOAL

The goal of the LOSBANDİTOS KVKK Policy is to establish the necessary systems and set up the required order to ensure compliance with legislation, in line with the goal of creating awareness within LOSBANDİTOS regarding the lawful processing and protection of personal data. In this context, the LOSBANDİTOS KVKK Policy serves as a guide for the implementation of the regulations set forth by the KVKK Law and related legislation.

1. 3. DEFINITIONS

The important definitions used in the LOSBANDİTOS KVKK Policy are provided below:

Explicit Consent: Consent related to a specific issue, based on information and declared with free will.

Anonymization: Making personal data in such a way that it cannot be associated with an identified or identifiable natural person under any circumstances, even by matching it with other data.

1. 4. ROLES AND RESPONSIBILITIES

While being responsible for the implementation of the LOSBANDİTOS KVKK Policy in all LOSBANDİTOS operations, activities, and processes; the KVKK and Legal Advisors will be the source of advice and guidance in the implementation of the regulations, procedures, guideline standards, and training activities prepared in accordance with the LOSBANDİTOS KVKK Policy within LOSBANDİTOS. All our employees, stakeholders, guests, visitors, and relevant third parties across LOSBANDİTOS are obligated to cooperate with Legal Advisors in ensuring compliance with the LOSBANDİTOS KVKK Policy, as well as in preventing legal risks and imminent danger. All organs and departments of LOSBANDİTOS are responsible for overseeing compliance with the LOSBANDİTOS KVKK Policy.

1. 5. PRINCIPLES OF THE LOSBANDİTOS KVKK POLICY

1. 1. 5.1. DATA SUBJECT GROUPS MANAGED BY THE LOSBANDİTOS KVKK POLICY

The data subjects who are within the scope of the LOSBANDİTOS KVKK Policy and whose personal data is processed by LOSBANDİTOS are grouped as follows:

1. 1. • • LOSBANDİTOS Employee Candidates

Persons who have not established a service contract with LOSBANDİTOS but who are being evaluated by LOSBANDİTOS to be hired.

1. 1. • • LOSBANDİTOS Business Partner Authorities, Employees

Natural person authorities, shareholders, and employees of organizations with which LOSBANDİTOS has a commercial relationship.

1. 1. • • LOSBANDİTOS Visitors and Guests

LOSBANDİTOS guests, visitors, or natural persons who visit the websites operated by LOSBANDİTOS.

1. 1. • • Other Natural Persons

All natural persons who are not within the scope of the LOSBANDİTOS Employees' Personal Data Protection and Processing Policy.

1. 1. 5.2. PURPOSES OF PROCESSING PERSONAL DATA WITHIN THE SCOPE OF BUSINESS ACTIVITIES CARRIED OUT BY LOSBANDİTOS

1. 1. 6. PRINCIPLES ADOPTED BY LOSBANDİTOS REGARDING THE PROCESSING AND PROTECTION OF PERSONAL DATA

1. 1. 6.1. EXECUTION OF PERSONAL DATA PROCESSING ACTIVITIES IN ACCORDANCE WITH DATA PROCESSING CONDITIONS

While carrying out personal data processing activities, LOSBANDİTOS acts in accordance with (i) fundamental principles, (ii) personal data processing conditions, and (iii) processing conditions for special categories of personal data.

1. 1. 1. 6.1.1. Compliance with Fundamental Principles

Within the scope of ensuring and maintaining compliance with personal data protection legislation, the following fundamental principles are adopted by LOSBANDİTOS:

1. • • (1) Processing personal data in accordance with the law and principles of integrity

LOSBANDİTOS conducts its personal data processing activities in accordance with the law and the principle of integrity, primarily in compliance with the Constitution of the Republic of Turkey and personal data protection legislation. In order for customers to benefit from the products and services offered to them by being customized according to their tastes and habits at the highest service quality, LOSBANDİTOS collects your personal data within the limits determined by official legislation and processes it within the terms and purposes specified in Articles 5 and 6 of Law No. 6698.

1. • • (2) Ensuring the accuracy and currency of processed personal data

While carrying out the activity of processing personal data by LOSBANDİTOS, all kinds of necessary administrative and technical measures are taken to ensure the accuracy and currency of personal data within technical possibilities. In this context, our Company carries out the necessary work to correct the personal data of personal data owners and to confirm their accuracy in case of any errors.

1. • • (3) Processing personal data for specific, explicit, and legitimate purposes

Personal data processing activities by LOSBANDİTOS are carried out within the scope of clear and lawful purposes determined before the personal data processing activity begins. The primary purpose of processing personal data is to increase the quality of LOSBANDİTOS services.

1. • • (4) Processing personal data in a manner connected, limited, and proportionate to the purpose

Personal data is processed by LOSBANDİTOS as much as is necessary for the realization of these services and in connection with data processing conditions. In this context, the purpose of personal data processing is determined before starting the personal data processing activity, and the data processing activity is not carried out with the assumption that it might be used in the future.

1. • • (5) Retaining personal data for the duration prescribed in the relevant legislation or required for the purpose for which they are processed

LOSBANDİTOS retains personal data limited to the period prescribed in the relevant legislation or required for the purpose of data processing. Accordingly, at the end of the period stipulated in the legislation or when the reasons requiring the processing of personal data disappear, the personal data is deleted, destroyed, or anonymized by LOSBANDİTOS.

1. 1. 1. 6.1.2. Compliance with Personal Data Processing Conditions

LOSBANDİTOS carries out its personal data processing activities in accordance with the data processing conditions set forth in Article 5 of the KVK Law. In this context, the personal data processing activities carried out are performed in the presence of the following personal data processing conditions:

1. • • (1) Presence of the Explicit Consent of the Personal Data Owner

Personal data processing activity is carried out by LOSBANDİTOS if the data owner gives approval freely, with sufficient information about the subject, with clarity leaving no room for hesitation, and limited only to that transaction.

1. • • (2) Explicit Provision of Personal Data Processing Activity in Laws If there is an explicit regulation in the laws regarding the personal data processing activity, LOSBANDİTOS may carry out the personal data processing activity limited to the relevant legal regulation.
     • (3) Inability to Obtain the Explicit Consent of the Data Owner Due to Actual Impossibility and the Necessity of Personal Data Processing

In cases where the personal data owner cannot express their consent or their consent is not recognized as valid, if the processing of personal data is necessary for the protection of the life or bodily integrity of individuals, the data processing activity is carried out by LOSBANDİTOS within this scope.

1. • • (4) Direct Relevance of the Personal Data Processing Activity to the Establishment or Performance of a Contract

In cases where it is directly related to the establishment or performance of a contract, if it is necessary to process the personal data of the parties to the contract, the data processing activity is carried out by LOSBANDİTOS.

1. • • (5) Necessity of Carrying Out the Personal Data Processing Activity for LOSBANDİTOS to Fulfill Its Legal Obligation

In cases where LOSBANDİTOS, which has adopted showing the necessary sensitivity regarding compliance with the law as a Company policy, has a legal obligation, the personal data processing activity is carried out to fulfill the legal obligation.

1. • • (6) Data Owner Making Their Personal Data Public

Personal data that has been made public (disclosed to the public in any way) by the relevant person themselves is processed by LOSBANDİTOS in accordance with the purpose of making it public.

1. • • (7) Necessity of Data Processing for the Establishment, Exercise, or Protection of a Right

In cases where the processing of personal data is necessary for the establishment, exercise, or protection of a right, the personal data processing activity is carried out by LOSBANDİTOS in parallel with this necessity.

1. • • (8) Necessity of Carrying Out the Personal Data Processing Activity for the Legitimate Interests of LOSBANDİTOS, Provided That It Does Not Harm the Fundamental Rights and Freedoms of the Data Owner

In cases where personal data processing is necessary for the legitimate interests of LOSBANDİTOS, the data processing activity can be carried out provided that the fundamental rights and freedoms of the data owner are not harmed.

1. 1. 1. 6.1.3. Compliance with Processing Conditions for Special Categories of Personal Data

Special attention is paid by LOSBANDİTOS to the processing of special categories of personal data, which carry the risk of creating discrimination when processed unlawfully. In this context, before processing special categories of personal data, LOSBANDİTOS first determines with sensitivity whether the data processing conditions exist, and only carries out the data processing activity after being sure of the existence of the condition of compliance with the law.

Special categories of personal data can be processed by LOSBANDİTOS in the following cases, provided that the adequate measures determined by the KVK Board are taken:

1. • • (1) Processing of Personal Health Data

Personal health data can be processed by LOSBANDİTOS in the presence of one of the conditions listed below:

– for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing, due to insurance transactions, for the purpose of law enforcement and judicial processes, by persons or authorized institutions and organizations under the obligation of confidentiality; or

1. • – Presence of the explicit consent of the personal data owner,

1. • (2) Processing of Special Categories of Personal Data Other Than Health and Sexual Life

Special categories of personal data other than health and sexual life (race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, dress, membership in associations, foundations or unions, data related to health, sexual life, criminal convictions and security measures, and biometric and genetic data) can be processed by LOSBANDİTOS if the data owner gives explicit consent or in cases provided for by law.

1. 1. 1. 6.1.4. Compliance with Personal Data Transfer Conditions

In personal data transfers to be carried out by LOSBANDİTOS, the personal data transfer conditions regulated in Articles 8 and 9 of the KVK Law are complied with.

1. 1. • (1) Transfer of Personal Data Domestically

In accordance with Article 8 of the KVK Law, LOSBANDİTOS acts in accordance with data processing conditions in domestic data transfer activities.

1. 1. • (2) Transfer of Personal Data Abroad

In accordance with Article 9 of the KVK Law, personal data can be transferred abroad by LOSBANDİTOS in accordance with personal data processing conditions, and if the country to which the transfer will be made is one of the countries announced by the KVK Board as having adequate protection, or in case there is no adequate protection in the relevant foreign country, if the data controllers in Turkey and the relevant foreign country undertake adequate protection in writing.

1. 1. • (3) Groups of Persons to Whom Personal Data is Transferred by LOSBANDİTOS

In accordance with Articles 8 and 9 of the KVK Law, LOSBANDİTOS may transfer the personal data of data owners covered by the LOSBANDİTOS KVK Policy to the following groups of persons for the purposes stated:

1. 1. (i) Limited to ensuring the conduct of commercial activities requiring the participation of LOSBANDİTOS Group Companies,
   2. (ii) Limited to ensuring the establishment and continuation of the partnership to LOSBANDİTOS Business Partners,
   3. (iii) Limited to the purpose of carrying out LOSBANDİTOS' commercial activities for which supplies are procured from the supplier, to LOSBANDİTOS Suppliers,
   4. (iv) Limited to the purpose requested by authorized public institutions and organizations and authorized private legal entities within their legal authority,
   5. (v) To third parties in accordance with personal data transfer conditions.

1. 1. 6.2. INFORMING OF PERSONAL DATA OWNERS BY LOSBANDİTOS

In accordance with Article 10 of the KVK Law and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation, LOSBANDİTOS carries out the necessary processes to ensure that data owners are informed during the collection of personal data. In this context, the disclosure texts presented to data owners by LOSBANDİTOS contain the following information:

1. • (1) Our company's trade name,
   • (2) For what purpose personal data of data owners will be processed by LOSBANDİTOS,
   • (3) To whom and for what purpose the processed personal data can be transferred,
   • (4) The method and legal reason for collecting personal data,
   • (5) The rights of the data owner, which are;

1. 1. a) To learn whether personal data has been processed,
   2. b) To request information if personal data has been processed,
   3. c) To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
   4. d) To know the third parties to whom personal data is transferred domestically or abroad,
   5. e) To request the correction of personal data in case of incomplete or incorrect processing,
   6. f) To request the deletion or destruction of personal data within the framework of the prescribed conditions,
   7. g) to request that the transactions carried out in accordance with subparagraphs (e) and (f) be notified to third parties to whom personal data has been transferred,
   8. h) to object to the emergence of a result against the person himself/herself by analyzing the processed data exclusively through automated systems,
   9. i) to request the compensation of the damage in case of loss due to the unlawful processing of personal data,

1. 1. 6.3. FINALIZATION OF PERSONAL DATA SUBJECTS' REQUESTS BY LOSBANDITOS

In the event that data subjects submit their requests regarding their personal data to our Company in writing or by other methods determined by the KVK Board, LOSBANDITOS, in its capacity as the data controller, conducts the necessary processes to ensure that the request is concluded as soon as possible and within thirty (30) days at the latest, depending on the nature of the request, in accordance with Article 13 of the KVK Law. Data subjects must carry out their requests regarding their personal data in accordance with the procedures specified in the Clarification Text published on the web page by LOSBANDITOS and communicated separately to its customers and employees.

Within the scope of ensuring data security, LOSBANDITOS may request information to determine whether the person making the application is the subject of the personal data subject to the application. Our company may also ask questions to the personal data subject in order to ensure that the personal data subject's application is finalized in accordance with the request.

In cases where the data subject's application may prevent the rights and freedoms of others, requires disproportionate effort, or the information is publicly available, the request may be rejected by LOSBANDITOS by explaining the justification.

1. 1. 1. 6.3.1. Rights of Personal Data Subjects

In accordance with Article 11 of the KVK Law, you can make a request by applying to our Company regarding the following issues:

1. • • (1) Learning whether your personal data is being processed,
     • (2) Requesting information regarding your personal data if it has been processed,
     • (3) Learning the purpose of processing your personal data and whether they are used in accordance with their purpose,
     • (4) Learning the third parties to whom your personal data is transferred domestically or abroad,
     • (5) Requesting the correction of your personal data in case it is processed incompletely or incorrectly and requesting the notification of the transaction made within this scope to the third parties to whom your personal data has been transferred,
     • (6) Requesting the deletion, destruction, or anonymization of your personal data in the event that the reasons requiring processing disappear, despite the fact that it has been processed in accordance with the KVK Law and other relevant legal provisions, and requesting that the transaction carried out within this scope be notified to the third parties to whom your personal data has been transferred,
     • (7) Objecting to the emergence of a result against you by analyzing your processed data exclusively through automated systems,
     • (8) Requesting the compensation of the damage in case you suffer damage due to the unlawful processing of your personal data.

1. 1. 1. 6.3.2. Situations Outside the Scope of Personal Data Subjects' Rights Under Legislation

Pursuant to Article 28 of the KVK Law, since the following situations are not within the scope of the KVK Law, it will not be possible for personal data subjects to exercise their rights regarding the following issues:

1. • • (1) Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public security, public order, economic security, privacy of private life or personal rights or does not constitute a crime.
     • (2) Processing of personal data for purposes such as research, planning and statistics by making them anonymous with official statistics.
     • (3) Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations authorized by law to ensure national defense, national security, public security, public order or economic security.
     • (4) Processing of personal data by judicial authorities or execution authorities regarding investigation, prosecution, trial or execution proceedings.

Pursuant to Article 28/2 of the KVK Law; it will not be possible for personal data subjects to exercise their rights in the following cases, except for requesting the compensation of the damage:

1. • • (1) Personal data processing is necessary for the prevention of crime or for criminal investigation.
     • (2) Processing of personal data made public by the personal data subject himself/herself.
     • (3) Personal data processing is necessary for the execution of supervisory or regulatory duties and disciplinary investigation or prosecution by authorized and assigned public institutions and organizations and professional organizations having the status of public institution based on the authority given by law.
     • (4) Personal data processing is necessary for the protection of the economic and financial interests of the state regarding budget, tax and financial matters.

1. 1. 6.4. PERSONAL DATA CATEGORIES AND SHARED PARTY CATEGORIES PROCESSED WITHIN THE SCOPE OF PERSONAL DATA PROCESSING ACTIVITIES CONDUCTED BY LOSBANDITOS

1. 1. 1. 6.4.1. Personal Data Categories

The personal data categories processed within the scope of personal data processing activities conducted by LOSBANDITOS and their descriptions are regulated below: