Privacy Notice under the Personal Data Protection Law

As Kütahya 30 Ağustos Industrial Zone (an Organized Industrial Zone, "OSB"), we care about the security of your personal data. This privacy notice has been prepared, in our capacity as data controller, pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (the "Law", also known as "KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform. It explains for which purposes, on which legal grounds and by which methods your personal data are processed, to whom they may be transferred, and your rights under the Law.

1. Data Controller

2. Categories of Personal Data Processed

Depending on the nature of your relationship with our Zone Directorate, the following personal data may be processed:

• Identity: name, surname, Turkish ID number, title, signature,
• Contact: phone number, e-mail address, postal address, KEP address,
• Customer / Investor Transactions: parcel, allocation, subscription, application, request and complaint information,
• Finance: invoice, payment and bank account information,
• Legal Transactions: correspondence and information in court and enforcement files,
• Physical Premises Security: visitor records at zone and building entrances,
• Visual and Audio Records: security camera recordings, photographs and videos taken at events,
• Transaction Security: log records created when you visit our website, such as IP address, browser and operating system information, visited page, referring address and time of visit,
• Professional Experience: CV, education and experience information submitted with job applications.

Special categories of personal data are processed only where the conditions set out in Article 6 of the Law are met and with the adequate measures determined by the Personal Data Protection Board (the "Board").

3. Purposes of Processing

Your personal data are processed in accordance with the general principles in Article 4 of the Law for the following purposes:

• Fulfilling duties arising from the applicable legislation, in particular Organized Industrial Zones Law No. 4562 and the Organized Industrial Zones Implementing Regulation,
• Carrying out parcel allocation, sales, building permit, occupancy permit and zoning procedures,
• Providing infrastructure services such as electricity, water, natural gas and wastewater, and managing subscription and billing processes,
• Receiving, assessing and concluding applications, requests, suggestions and complaints,
• Communicating with investors, public institutions and stakeholders,
• Ensuring physical security within the zone and keeping visitor records,
• Ensuring the security of our website, improving our services and producing visit statistics,
• Organizing and announcing events, trainings and information activities,
• Carrying out human resources processes and evaluating job applications,
• Carrying out finance, accounting and audit activities,
• Following legal proceedings and providing information to authorized institutions.

4. Method of Collection and Legal Grounds

Your personal data are collected through written applications, petitions, contracts and forms submitted to our Zone Directorate; electronic channels such as e-mail, KEP, telephone and our website; security cameras and visitor records; and correspondence from public institutions. They are collected by fully or partially automated means, or by non-automated means provided that they form part of a data filing system.

These personal data are processed on the following legal grounds set out in Article 5(2) of the Law:

• It is expressly provided for by law (5/2-a),
• Processing the personal data of the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of that contract (5/2-c),
• It is necessary for the data controller to fulfil its legal obligation (5/2-ç),
• The data have been made public by the data subject (5/2-d),
• Processing is necessary for the establishment, exercise or protection of a right (5/2-e),
• Processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (5/2-f).

Where none of the legal grounds above applies, for example for the analytics and measurement cookies used on our website (Google Analytics, Google Tag Manager, LinkedIn Insight Tag) and for publishing photographs taken at events for promotional purposes, your personal data are processed based on your explicit consent under Article 5(1) of the Law. These cookies and tracking codes are not loaded unless you give your consent in the cookie window shown on your first visit. You can withdraw or change your consent at any time through the Cookie Preferences link at the bottom of the page; you can also delete or block cookies in your browser settings.

5. To Whom and For Which Purposes Personal Data May Be Transferred

For the purposes stated above and in accordance with the conditions in Articles 8 and 9 of the Law, your personal data may be transferred to:

• Authorized public institutions such as the Ministry of Industry and Technology of the Republic of Türkiye, the Supreme Organization of Organized Industrial Zones (OSBÜK), the governorship, the municipality, tax offices, the Social Security Institution, judicial authorities and law enforcement, to fulfil legal obligations,
• The bodies of our zone (General Assembly, Board of Directors and Audit Board), to carry out duties arising from the legislation,
• Persons and organizations providing consultancy services such as legal, financial advisory and independent audit services, to carry out legal and financial processes,
• Suppliers providing information technology, hosting, security and maintenance services, to the extent required by the service,
• Banks, to carry out payment and collection transactions.

Since the servers of the Google Analytics, Google Tag Manager and LinkedIn Insight Tag services used on our website are located abroad, cookie and usage data collected through these services may be transferred abroad. Such transfers are carried out in accordance with the conditions set out in Article 9 of the Law.

6. Retention Period

Your personal data are kept for the period required by the applicable legislation or for the period necessary for the purpose for which they are processed. When this period ends, your personal data are deleted, destroyed or anonymized in accordance with the Regulation on the Deletion, Destruction or Anonymization of Personal Data.

7. Your Rights under Article 11 of the Law

Under Article 11 of the Law, by applying to the data controller you have the right to:

• Learn whether your personal data are processed,
• Request information if your personal data have been processed,
• Learn the purpose of processing and whether the data are used in line with that purpose,
• Know the third parties in Türkiye or abroad to whom your personal data are transferred,
• Request the correction of your personal data if they are incomplete or inaccurate,
• Request the deletion or destruction of your personal data under the conditions set out in Article 7 of the Law,
• Request that the correction, deletion or destruction be notified to third parties to whom your personal data have been transferred,
• Object to a result against you arising from the analysis of the processed data exclusively by automated systems,
• Claim compensation for damages if you suffer damage due to unlawful processing of your personal data.

8. How to Apply

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit your requests regarding the rights listed above in writing and in Turkish, or by other methods determined by the Board, through one of the following channels:

• With a wet-signed petition, in person or through a notary, to Çalca OSB Mah. 2. Cad. No:7, Merkez, Kütahya, Türkiye,
• By registered electronic mail (KEP) to kthosb@hs01.kep.tr,
• Signed with a secure electronic signature or mobile signature, or from the e-mail address you have previously notified to our Zone Directorate and that is registered in our system, to iletisim@30agustososb.org.tr.

Your application must include:

• Your name, surname and, if the application is in writing, your signature,
• Your Turkish ID number for citizens of the Republic of Türkiye; for foreigners, your nationality, passport number or ID number, if any,
• Your residential or business address for notifications,
• Your e-mail address, telephone and fax number for notifications, if any,
• The subject of your request.

Information and documents related to the request should be attached to the application.

Your application will be concluded free of charge as soon as possible, and at the latest within thirty days, depending on the nature of the request. If the process requires an additional cost, a fee may be charged according to the tariff determined by the Personal Data Protection Board. If your application is rejected, if you find the response insufficient, or if no response is given in time, you may file a complaint with the Personal Data Protection Board within thirty days from the date you learn of the response and, in any case, within sixty days from the date of your application.

Kütahya 30 Ağustos Industrial Zone