Data Protection and Privacy Policy

1. Purpose

As EAE Elektrik Aydınlatma Endüstrisi San. ve Tic. A.Ş. (“EAE Aydınlatma” or “the Company”), we place great importance on the protection of personal data belonging to our customers, employees, suppliers, business partners, visitors, and other relevant individuals.

We conduct all our processes related to the processing, storage, transfer, and deletion of personal data in compliance with applicable legislation, primarily the Personal Data Protection Law No. 6698 (“KVKK”).

This Policy has been prepared to explain the purposes for which personal data is processed, with whom it may be shared, how long it may be retained, and the rights of data subjects.

2. Scope

This Policy covers the personal data of our customers, potential customers, employees, job applicants, suppliers, business partners, visitors, users of our website, and other individuals who have a relationship with our Company.

3. Definitions

Personal Data: Any information relating to an identified or identifiable natural person.

Sensitive Personal Data: Data specifically protected under the Personal Data Protection Law (KVKK), such as race, ethnic origin, political opinions, philosophical beliefs, religion, denomination, health, sexual life, criminal convictions, security measures, biometric, and genetic data.

Data Subject: A natural person whose personal data is processed.

Data Controller: A natural or legal person who determines the purposes and methods of processing personal data.

Data Processor: A natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.

Explicit Consent: Consent that is specific to a particular matter, based on information provided, and freely given.

4. Principles of Personal Data Processing

At EAE Aydınlatma, we process personal data in accordance with the following principles:

Personal data is processed in compliance with the law and the principles of good faith.

Necessary measures are taken to ensure that data is accurate and, where necessary, up-to-date.

Personal data is processed for specific, explicit, and legitimate purposes.

The data processed is kept relevant, limited, and proportionate to the purpose of processing.

Personal data is retained for the period prescribed by applicable legislation or as necessary for the purpose of processing.

Upon the cessation of the purpose of processing or the expiration of the retention period, personal data is deleted, destroyed, or anonymized in accordance with the law.

5. Purposes of Processing Personal Data

Personal data may be processed for the following purposes within the scope of the Company’s operations:

Conducting operations and managing business processes,

Managing customer relationships,

Providing, developing, and supporting products and services,

Planning sales, marketing, advertising, and promotional activities,

Evaluating requests, suggestions, and complaints,

Managing relationships with business partners, suppliers, and third parties,

Conducting human resources processes,

Evaluating job applications,

Conducting contract processes,

Managing billing and financial processes,

Compliance with legal obligations,

Providing information to authorized public institutions and organizations,

Ensuring information security, building security, and business continuity.

6. Processing of Special Category Personal Data

Special-category personal data is processed in accordance with the conditions set forth in the Personal Data Protection Law (KVKK) and by taking the necessary administrative and technical measures.

As a general rule, such data is not processed without the explicit consent of the data subject. However, it may be processed without explicit consent in cases explicitly provided for by law or permitted by legislation.

Sensitive personal data relating to health and sexual life, however, may be processed only for purposes specified in the legislation—such as the protection of public health, preventive medicine, medical diagnosis, treatment, and care services, as well as the planning and management of health services—and only by authorized individuals or institutions.

7. Transfer of Personal Data

Personal data may be shared with the following individuals, institutions, and organizations in accordance with the Personal Data Protection Law (KVKK) and relevant legislation, provided that such sharing is limited to the purposes of processing:

Suppliers,

Business partners and business associates,

Group companies and affiliates,

Shareholders,

Persons and organizations from whom services are obtained,

Consultants,

Legally authorized public institutions and organizations,

Legally authorized private entities.

As a general rule, personal data is not transferred abroad without the explicit consent of the data subject. However, transfers abroad may be made in the exceptional cases specified in the Personal Data Protection Law (KVKK) and provided that the necessary legal conditions are met.

8. Retention and Deletion of Personal Data

Personal data is retained for the periods specified in the relevant legislation or for as long as necessary to fulfill the purpose of processing.

Upon the expiration of the retention period or the cessation of the purpose of processing, personal data is deleted, destroyed, or anonymized in accordance with the law.

Anonymized data may be used for purposes such as research, reporting, and statistical studies in a manner that does not allow for the identification of the data subject.

9. Security of Personal Data

EAE Lighting takes the necessary administrative and technical measures to ensure the security of personal data.

In this context:

Access to personal data is restricted in accordance with authorization principles,

Employees are informed about the protection of personal data,

Data security processes are reviewed regularly,

Technological security measures such as firewalls and antivirus systems are used,

Measures are implemented to prevent the unlawful processing, access, or sharing of personal data,

In the event of a data breach, the notification and response procedures required by law are followed.

10. Website and Cookies

Cookies may be used on our website to enhance the user experience, measure site performance, and remember your preferences.

Data collected through cookies is processed in accordance with applicable laws and limited to the purpose for which it was collected.

11. Camera Recordings, Visitor Entries, and Log Records

Camera surveillance may be conducted at company premises to ensure security, maintain operations, and improve service quality.

Visitor entry and exit records, as well as log records related to guest internet access, are processed within the scope of applicable laws and only to the extent necessary.

Access to these records is limited to authorized personnel, and the necessary technical and administrative measures are taken to ensure the security of personal data.

12. Rights of Data Subjects

Under the KVKK, data subjects have the following rights:

To learn whether their personal data is being processed,

To request information regarding the processing of their personal data if it has been processed,

To learn the purpose of the processing of their personal data and whether it is being used in accordance with that purpose,

To know the third parties to whom their personal data has been transferred, whether within or outside the country,

To request the correction of their personal data if it has been processed incompletely or incorrectly,

To request the erasure or destruction of personal data in accordance with the conditions set forth in the KVKK,

To request that third parties to whom personal data has been transferred be notified of any rectification, erasure, or destruction,

To object to a decision made solely through the automated processing of personal data that results in a negative outcome for you,

To request compensation for damages incurred as a result of the unlawful processing of personal data.

13. Submission Method

You may submit your requests regarding your personal data using the KVKK Request Form available on our website via the following methods:

Email address: [email protected]

Certified email address: [email protected]

Requests must be clear and understandable, include the applicant’s identification and contact information, and, where necessary, be accompanied by documents verifying the applicant’s identity.

Requests will be resolved as soon as possible depending on the nature of the request, and in any case, no later than 30 days.

14. Right to File a Complaint

If the request is denied, the response is deemed insufficient, or no response is provided within the prescribed timeframe, the data subject may file a complaint with the Personal Data Protection Board within 30 days of receiving the response and, in any case, within 60 days of the date of the request.

15. Entry into Force and Updates

This Policy enters into effect on the date it is published on the EAE Aydınlatma website.

The Company reserves the right to update this Policy in accordance with changes in legislation or as needed.