Gezer Ayakkabı Deri Sanayi ve Ticaret Anonim Şirketi Corporate Personal Data Protection Policy

1. Purpose

Every individual's right to request the protection of their personal data is a sacred right arising from the Constitution. As Gezer, we consider fulfilling the requirements of this right to be one of our most valuable duties. For this reason, we attach importance to the lawful processing and protection of your personal data.

The Corporate Personal Data Protection Policy (“Policy”) has been prepared, as a result of the importance we attach to the protection of personal data, in order to determine the principles we adopt and the procedures we apply when processing and protecting personal data.

2. Scope

The Policy covers all kinds of operations carried out on personal data managed by Gezer, obtained, recorded, stored, preserved, altered, reorganized, disclosed, transferred, taken over, made retrievable, classified or prevented from being used, whether wholly or partly by automated means, or by non-automated means provided that it forms part of a data recording system.

The Policy relates to all personal data processed belonging to Gezer's shareholders, authorized persons, customers, employees, supplier representatives and employees, and third parties.

Gezer may amend this Policy for the purposes of complying with legislation and the decisions of the Personal Data Protection Authority, and of better protecting personal data.

3. Definitions

4. General Principles

At the preparatory stage of every new business process that requires the processing of personal data, Gezer checks the data to be processed for compliance with the principles below. Business processes that are found to be non-compliant are not put into practice.

When processing personal data, Gezer;

1. Complies with the law and the rules of good faith.
2. Ensures that personal data is accurate and, where necessary, up to date.
3. Ensures that the purpose of processing is specific, explicit and legitimate.
4. Checks that the data processed is relevant to the purpose of processing, limited to what is necessary for processing, and proportionate.
5. Retains data only for the period stipulated by the relevant legislation or required for the purpose for which it is processed, and destroys it once the purpose of processing ceases to exist.

5. Duties and Responsibilities

A Personal Data Protection Commission has been established within Gezer in order to manage this Policy and other related procedures relating to the processing of personal data and to ensure the Policy's enforcement. The Commission is composed of the General Manager, the Human Resources Officer, the IT Officer, the Legal Counsel and the Quality Officer. The members of the Commission and the division of duties are determined in line with the assignments made by the Company. In addition, Gezer also receives KVKK consultancy support, when necessary, in order to comply with Law No. 6698 on the Protection of Personal Data. The Commission may invite the KVKK consultant to its meetings when it deems necessary.

The duties and responsibilities of the Commission are set out below:

1. It ordinarily convenes once every 6 months. It may convene extraordinarily when circumstances so require (for example, in the event of a possible data breach).
2. It discusses matters that need to be amended/improved in the Policy.
3. It identifies matters that can be implemented for the lawful processing and protection of personal data.
4. It determines the steps that can be taken to increase KVKK awareness within the company and among business partners.
5. It identifies risks that may be encountered with respect to the processing and protection of personal data, and takes the necessary administrative and technical measures.
6. Ensures liaison with, and manages relations with, the Authority.
7. Evaluates requests received from the Data Subject.
8. Follows up periodic destruction processes.
9. Updates the Data Inventory.
10. Makes the assignments relating to the matters listed above.

6. Measures Taken for Data Security

Gezer takes all necessary technical and administrative measures to ensure an appropriate level of security in order to (i) prevent the unlawful processing of personal data, (ii) prevent unlawful access to personal data, and (iii) ensure the preservation of personal data.

6.1. Technical Measures

1. Network security and application security are ensured.
2. Security measures are taken within the scope of the procurement, development and maintenance of information technology systems.
3. Access logs are kept on a regular basis.
4. Up-to-date anti-virus systems are used.
5. Firewalls are used.
6. Necessary security measures are taken with respect to entry to and exit from physical environments containing personal data.
7. The security of physical environments containing personal data against external risks (fire, flood, etc.) is ensured.
8. The security of environments containing personal data is ensured.
9. Personal data is backed up, and the security of the backed-up personal data is also ensured.
10. A user account management and authorization control system is implemented, and these are also monitored.
11. Log records are kept in a manner that prevents user interference.
12. Intrusion detection and prevention systems are used.
13. Encryption is applied.

6.2. Administrative Measures

1. Disciplinary arrangements containing data security provisions are in place for employees.
2. Training and awareness activities on data security are carried out for employees at certain intervals.
3. Corporate policies on access, information security, use, retention and destruction have been prepared and put into practice.
4. Data masking measures are applied when necessary.
5. Confidentiality undertakings are obtained.
6. An authorization matrix has been established for employees.
7. The authorizations of employees whose duties have changed or who have left the company in this area are revoked.
8. Signed agreements contain data security provisions.
9. Personal data security policies and procedures have been determined.
10. Personal data security issues are reported promptly.
11. Personal data security is monitored.
12. Personal data is minimized to the extent possible.
13. Periodic and/or random internal audits are carried out and commissioned.
14. Existing risks and threats have been identified.
15. Protocols and procedures for the security of special categories of personal data have been determined and are applied.
16. Where special categories of personal data are to be sent by electronic mail, they are always sent encrypted and through a KEP (Registered Electronic Mail) or corporate e-mail account.
17. Awareness of data security is ensured among the service providers acting as data processors.

7. The Data Subject's Rights Regarding Personal Data

By applying to Gezer, the data subject may make requests regarding the following matters:

1. Learning whether their personal data is processed,
2. Requesting information if their personal data has been processed,
3. Learning the purpose of processing their personal data and whether it is used in accordance with that purpose,
4. Learning the third parties, in Turkey or abroad, to whom their personal data has been transferred,
5. Requesting the correction of their personal data if it has been processed incompletely or incorrectly, and requesting that the third parties to whom the personal data has been transferred be notified of this transaction,
6. Requesting the deletion, destruction or anonymization of their personal data if, despite having been processed in accordance with the KVKK and other relevant legal provisions, the reasons requiring its processing no longer exist, and requesting that the third parties to whom the personal data has been transferred be notified of this transaction,
7. Objecting to the occurrence of a result against themselves through the analysis of their processed data exclusively by automated systems,
8. Requesting compensation for damages in the event that they suffer damage due to the unlawful processing of their personal data.

8. Breach Notifications

Gezer employees report to the Commission any business, action or circumstance they believe to be in breach of the provisions of the KVKK and/or the Policy. Following such a breach notification, the Commission convenes when it deems necessary and prepares an action plan regarding the breach.

If a breach occurs through the unlawful acquisition of personal data by others, the Commission notifies the data subject and the Board of this situation within 72 hours, within the scope of the Board's decision dated 24.01.2019 and numbered 2019/10.

9. Amendments

Amendments to the Policy are prepared by the Commission and submitted for the approval of the Gezer Board of Directors. The updated Policy may be sent to employees by e-mail or published on the website.