CONTEMPORARY PAPER PACKAGING SAN. VE TİC. LTD. CO.

PERSONAL DATA PROCESSING AND PROTECTION POLICY

Publication Approval	Board of Directors ...... Dated Decision
Version	Version No. 01

TABLE OF CONTENTS

İçinde görünmek üzere ayarlanmış paragraf stillerini kullanmadığınız için içindekiler boş.

I. INTRODUCTION

PURPOSE OF THE POLICY

Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. The Board of Directors and all its personnel undertake to comply with the principles and rules introduced by the Constitution of the Republic of Turkey, the Law No. 6698 on the Protection of Personal Data (KVKK) and other legislation regarding the protection of personal data and to protect the rights of the relevant persons in line with the Personal Data Protection and Processing Policy. For this purpose, it has adopted a written personal data protection policy and system to be implemented and developed.

The purpose of the Personal Data Protection Policy is to ensure that Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. to establish and realize its own standards in the management of personal data; to determine and support organizational goals and obligations, to establish control mechanisms in accordance with the acceptable risk level of Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. to establish control mechanisms in line with the acceptable risk level; to fulfill its obligations in accordance with international conventions, the Constitution, laws, contracts and professional rules in the field of personal data protection and to protect the interests of individuals in the best way.

SCOPE OF THE POLICY

This policy has been prepared for Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. and covers the services provided within the organization. The provisions of the policy cover all information systems involved in the processing of personal data in Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. covers all information systems and sub-information, contracts, environmental and physical areas, and the systems and regulations produced for all these. This policy covers the Board of Directors of Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti.'s Board of Directors, all departments, directorates, employees of the company providing all kinds of services, interns and contracted personnel. Any action that violates KVKK or this policy is evaluated within the scope of the relevant legislation and sanctions are applied accordingly.

Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. solution partners, public institutions, insurance companies and all third parties working with Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. are invited to read and comply with this policy. Third parties must be at least as strong and competent as Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. to protect personal data with a system that is at least as strong and has sufficient standards. Third parties and Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. will enter into a written confidentiality agreement that includes the obligations under the protection of personal data and the right to audit them. Third parties may not enter into a confidentiality agreement with Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. cannot access the personal data processed by Çağdaş Kağıt Ambalaj San. ve Tic. Şti. Together with the Personal Data Protection and Processing Policy, Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. will make the data security principles adopted by Çağdaş Kağıt Ambalaj San. ve Tic. Şti. sustainable.

POLICY OBJECTIVE

Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. With the Policy, it is aimed to establish the necessary systems in line with the goal of raising awareness about the processing and protection of personal data in accordance with the law within the company and to establish the necessary order to ensure compliance with the legislation. In this context, the Policy aims to guide the implementation of the regulations set forth by the KVK Law and the relevant legislation.

DEFINITIONS AND ABBREVIATIONS

Company Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. (Çağdaş Kağıt)

Explicit Consent: Consent given on a specific subject, based on information and free will, in a clear manner that leaves no room for hesitation, and limited only to that transaction

Anonymization: Making personal data impossible to be associated with an identified or identifiable natural person under any circumstances, even by matching with other data

Employee Company personnel.

Relevant Person: The natural person whose personal data is processed.

Personal Data: Any information relating to an identified or identifiable natural person.

Sensitive Personal Data: Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect, or other beliefs, appearance and dress, membership to associations, foundations or trade unions, health, sexual life, criminal conviction, security measures, and biometric and genetic data.

Processing of Personal Data: Any operation performed on personal data such as obtaining, recording, storing, storing, changing, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by fully or partially automatic means or by non-automatic means provided that it is part of any data recording system

Data Processor: A natural or legal person who processes personal data on behalf of the data controller based on the authorization granted by the data controller

Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system

KVK Board: Personal Data Protection Board.

KVK Compliance Process : The program to ensure compliance with the legislation on the protection of personal data put into effect by Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. to ensure compliance with the legislation on the protection of personal data.

KVK Institution: Personal Data Protection Authority.

KVKK Law No. 6698 on the Protection of Personal Data published in the Official Gazette dated April 7, 2016 and numbered 29677

Policy: : Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. Personal Data Processing and Protection Policy.

Personal Data Storage and Destruction Policy: In accordance with the Regulation on Deletion, Destruction and Anonymization of Personal Data, Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. which is the basis for the process of determining the maximum period of time required for the purpose for which personal data are processed and the process of deletion, destruction and anonymization of personal data by Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. Personal Data Storage and Destruction Policy".

Periodic Destruction : The process of deletion, destruction or anonymization to be carried out at recurring intervals in the event that all of the conditions for processing personal data specified in the law disappear

Registered Electronic Mail (REM): It is a system that protects all kinds of commercial, legal correspondence and document sharing in the form you send, identifies who the recipient is, ensures that the content does not change and makes the content legally valid and secure, conclusive evidence.

Data Controllers Registry Information System : The information system created and managed by the Presidency, accessible via the internet, which data controllers will use in the application to the Registry and other related transactions related to the Registry

VERBIS : Data Controllers Registry Information System

DISTRIBUTION OF TASKS RELATED TO PERSONAL DATA

Distribution of Duties Regarding the Protection of Personal Data

TITLE	UNIT	TASK
Board of Directors	Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. Members of the Board of Directors	To ensure that business and transactions are carried out in accordance with the Company policy
KVKK Committee	Committee consisting of persons determined by the Company during the compliance process regarding the protection of personal data	Responsible for the preparation, development, execution, publication in relevant media and updating of the Policy.
Department Heads	Human Resources, Accounting, Finance, Purchasing, Sales and Marketing, Quality Control, Production Planning, Warehouse and Shipment, Import and Export, IT Department Heads	Responsible for the execution of the Policy in accordance with their duties and confidentiality agreements.
Contact Person	The person appointed by the Data Controller	It is responsible for organizing the issues in the policy in accordance with the VERBIS system and making notifications.

II. ISSUES RELATED TO THE PROTECTION OF PERSONAL DATA

ENSURING THE SECURITY OF PERSONAL DATA

All staff and employees are obliged to ensure that the data processed by Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. are obliged to ensure that the data processed by Çağdaş Kağıt Ambalaj San. ve Tic. Şti. and under their responsibility are kept securely and not disclosed to third parties unless they sign a confidentiality agreement.

Personal data can only be accessed by those who need access to them. Information regarding personal access authorizations cannot be shared with third parties. Incidents related to information security regarding personal data are notified to the PDP Board as soon as possible and within 72 hours at the latest as soon as they are determined by the PDP Committee. The measures under the heading "Actions to be taken in case of a breach" specified in Article XII of this policy are also taken.

Environments where Personal Data is Available

Electronic Media

Non-Electronic Media

-Servers (Domain, backup, e-mail, database, web, file sharing, etc.) , Software (office software.)

-Information security devices (firewall, intrusion detection and prevention, log file, antivirus, etc.)

-Personal computers (Desktop, laptop)

-Mobile devices (phones, tablets, etc.)

-Optical disks (CD, DVD etc.)

-Removable memories (USB, Memory Card, etc.)

-Printer, scanner, photocopier

-Paper

-Manual data recording systems (survey forms, visitor logbook)

-Written, printed, visual media

-Unit cabinets

OBSERVANCE OF THE RIGHTS OF THE PERSON CONCERNED

Data Subjects Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. has the rights explicitly listed in Article 11 of the Law on the Protection of Personal Data and Article A-1 of Title XI of this policy regarding data processing activities and records. Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. continues its activities by observing all the rights of the relevant persons during the processing of personal data.

RAISING AWARENESS AND SUPERVISION OF DEPARTMENTS ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. ensures that necessary awareness trainings are organized for its employees and authorized sales points in order to prevent unlawful processing of personal data, to prevent unlawful access to data and to ensure the preservation of data.

RAISING AWARENESS AND SUPERVISION OF BUSINESS PARTNERS AND SUPPLIERS ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. ensures that necessary trainings are organized for its business partners and suppliers in order to raise awareness to prevent unlawful processing of personal data, unlawful access to data and to ensure the protection of data.

III PRINCIPLES AND RULES TO BE FOLLOWED IN THE PROCESSING OF PERSONAL DATA

PROCESSING OF PERSONAL DATA IN ACCORDANCE WITH THE PRINCIPLES STIPULATED IN THE LEGISLATION

1. Processing in accordance with the Law and Good Faith

Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. personal data of the relevant persons are processed in accordance with the rules of honesty, transparency and within the framework of the obligation to inform.

1. Ensuring that Personal Data is Accurate and Up-to-Date When Necessary

Necessary measures are taken in data processing procedures to ensure that the processed data is accurate and up-to-date, and the Data Subject is provided with the opportunity to update his/her data and to apply for correction of errors in the processed data, if any.

1. Processing for Specific, Explicit and Legitimate Purposes

Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. processes personal data within the scope of legitimate purposes determined to maintain its activities within the framework of the legislation and the ordinary flow of commercial life, the scope and content of personal data are clearly determined.

1. Being relevant, limited and proportionate to the purpose for which they are processed

Personal data are processed in connection with the purposes clearly and precisely determined, in a limited and measured manner. Processing of personal data that is not relevant or not needed to be processed is avoided. For this reason, we do not process personal data of a special nature unless there is a legal requirement, or when we need to process personal data, explicit consents are obtained by making clarifications on the subject.

1. Preservation for the Period Required for the Purpose for which they are Processed or for the Period Stipulated in the Relevant Legislation

Many regulations in the legislation require personal data to be kept for a certain period of time. For this reason, the processed personal data are stored for the period stipulated in the relevant legislation or for the period required for the purposes of processing personal data.

Personal data are deleted, destroyed or anonymized in the event that the retention period stipulated in the legislation expires or the purpose of processing disappears. The principles and processes regarding retention periods are explained in detail in Article IV.C. of this policy.

OF PERSONAL DATA LIMITED TO THE PERSONAL DATA PROCESSING CONDITIONS SPECIFIED IN ARTICLE 5 OF THE KVKK

Personal data, as stated in Article 5 of the KVKK As stated in Art; It is necessary to process personal data belonging to the parties to the contract, provided that it is clearly stipulated in the law, it is mandatory for the protection of the life or physical integrity of the person himself or someone else who is unable to disclose his consent due to actual impossibility or whose consent is not legally valid, and it is directly related to the establishment or performance of a contract, it is mandatory for the data controller to fulfill its legal obligation, it is made public by the data subject himself/herself, data processing is mandatory for the establishment, exercise or protection of a right, data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject, and it is processed limited to these conditions.

INFORMING AND ENLIGHTENING THE PERSON CONCERNED

While collecting personal data by Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. while collecting personal data; first of all, the relevant persons are clearly informed and enlightened in accordance with Article 10 of the KVKK and the Communiqué on the Procedures and Principles to be Complied with in the Fulfillment of the Disclosure Obligation. In our clarification texts;

The company's title, address and contact information, ,
Information on the identity of the representative, if available,
Categories of personal data,
The purpose for which personal data will be processed,
To whom and for what purpose the processed personal data may be transferred,
Method of data collection and legal grounds,
The rights of the data subject listed in Article 11 of the LPPD are listed under subheadings and their contents in the form of . In addition to the information above, application methods are also listed in our clarification text. Thanks to these methods, it is aimed to be transparent and accessible in the Protection of Personal Data.

As the Company, care is taken to ensure that this Policy, which is open to the public, is clear, understandable and easily accessible.

In addition, "Clarification Texts" on the Law on the Protection of Personal Data for employees, employee candidates, visitors, customers and camera systems can be reviewed on the website (www.cagdaskagit.com/kvkk ).

PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA

Special categories of personal data are stipulated in a limited number in the laws. In order to process these data, data protection is ensured by taking administrative and technical measures stipulated by the articles of law and the PDP Board. In this context, it is prohibited by law to process special categories of personal data (race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures, and biometric and genetic data) without the explicit consent of the data subject. Personal data other than health and sexual life may be processed without the explicit consent of the data subject in cases stipulated by law. Personal data relating to health and sexual life may only be processed without the explicit consent of the data subject for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, by persons under the obligation of confidentiality or authorized boards and organizations.

IV. CLASSIFICATION, PROCESSING PURPOSES AND STORAGE PERIODS OF PERSONAL DATA PROCESSED BY ÇAĞDAŞ KAĞIT AMBALAJ SAN. VE TİC. LTD. ŞTİ.

CLASSIFICATION OF PERSONAL DATA

1. Personal Data

Personal data is any information relating to an identified or identifiable natural person.

The protection of personal data is only related to natural persons and information belonging to legal entities that does not contain information about natural persons is excluded from personal data protection. Therefore, this Policy does not apply to the data of legal entities

Personal Data Categories	Subheadings and Explanations
Identity	Documents such as driver's license, identity card and passport containing information such as name, surname, Turkish ID number, nationality, mother's name, father's name, mother's maiden name, place of birth, date of birth, gender, tax number, SSI number, signature information, vehicle license plate, etc.
Contact	Contact information; phone number, address, e-mail address, fax number, etc. are personal data.
Personnel	Payroll information, disciplinary proceedings, employment records, CV information, performance evaluation reports, etc.
Legal Action	Correspondence information with judicial authorities, information in case files.
Customer Transaction	Invoice, promissory note, check information, request information, order information, etc. are data related to customers.
Physical Space Security	Entry and exit records of employees and visitors, camera records.
Process Security	Website login and exit information, IP address information, password and password information.
Finance	Balance sheet information, asset information.
Professional Experience	Diploma information, courses attended, vocational training information, transcript information, certificates.
Marketing	Shopping history information, surveys, information obtained through campaigns.
Audio and Visual Recordings	Audio and visual recordings, audio and video camera recordings.
Sensitive Personal Data	Data specified in Article 6 of the LPPD (e.g. health data, including blood type, biometric data, religion and membership of associations).

2. Special Categories of Personal Data

Personal data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data are sensitive personal data

PURPOSES OF PROCESSING PERSONAL DATA

As the Company, we process personal data for purposes similar to, but not limited to, those listed below:

Execution of Emergency Management Processes
Execution of Information Security Processes
Execution of Employee Candidate / Intern / Student Selection and Placement Processes
Execution of Employee Candidate Application Processes
Execution of Employee Satisfaction and Loyalty Processes
Fulfillment of Obligations Arising from Employment Contract and Legislation for Employees
Execution of Fringe Benefits and Benefits Processes for Employees
Conducting Audit / Ethics Activities
Conducting Training Activities
Execution of Access Authorizations
Execution of Activities in Compliance with the Legislation
Execution of Finance and Accounting Affairs
Execution of Company / Product / Service Loyalty Processes
Ensuring Physical Space Security
Execution of Assignment Processes
Follow-up and Execution of Legal Affairs
Conducting Internal Audit / Investigation / Intelligence Activities
Execution of Communication Activities
Planning Human Resources Processes
Execution / Supervision of Business Activities
Execution of Occupational Health / Safety Activities
Receiving and Evaluating Suggestions for Improvement of Business Processes
Execution of Business Continuity Ensuring Activities
Ensuring Quality Standards
Controlling Entry and Exit to and from the Institution Building and Preventing Unauthorized Entry
Execution of Logistics Activities
Execution of Goods / Service Procurement Processes
Execution of Goods / Services After Sales Support Services
Execution of Goods / Service Sales Processes
Execution of Goods / Services Production and Operation Processes
Execution of Customer Relationship Management Processes
Execution of Activities for Customer Satisfaction
Organization and Event Management
Conducting Marketing Analysis Studies
Execution of Performance Evaluation Processes
Execution of Advertising / Campaign / Promotion Processes
Execution of Storage and Archive Activities
Implementation of Social Responsibility and Civil Society Activities
Execution of Contract Processes
Execution of Sponsorship Activities
Tracking Requests / Complaints
Execution of Supply Chain Management Processes
Execution of Wage Policy
Execution of Marketing Processes of Products / Services
Ensuring the Security of Data Controller Operations
Execution of Investment Processes
Execution of Talent / Career Development Activities
Providing Information to Authorized Persons, Institutions and Organizations
Execution of Management Activities
Creating and Tracking Visitor Records
Ensuring the Security of Movable Property and Resources
Preparation of Product Invoices
Execution of Product Sales Policy
Fulfillment of the Obligations of the Members of the Board of Directors Arising from the Turkish Commercial Code Legislation

RETENTION PERIODS OF PERSONAL DATA

Personal data are stored for the period required by the purpose of processing personal data, without prejudice to the retention periods stipulated in the legislation. Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. Storage and Destruction Policy published on the official website contains details of storage and destruction periods.

In cases where personal data is processed for more than one purpose, the data is deleted, destroyed or anonymized and stored if the purposes of processing the data disappear or if there is no obstacle in the legislation to delete the data upon the request of the Data Subject. The provisions of the legislation and the decisions of the KVK Board are complied with in terms of destruction, deletion or anonymization

1. Measures taken regarding the storage of personal data

a. Technical measures

The technical measures regarding the Protection of Personal Data are set out below.

Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. has technical tools and equipment suitable for each destruction method in this policy.
Risks to prevent unlawful processing of personal data are identified, technical measures are taken in accordance with these risks and technical controls are carried out for the measures taken.
Access to storage areas containing personal data is recorded and inappropriate access or access attempts are kept under control.
Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. takes the necessary measures to ensure that the deleted personal data is inaccessible and non-reusable for the relevant users.
Strong passwords are used in electronic environments where personal data is processed.
Data backup programs are used to ensure that personal data is stored securely.
Separate policy has been determined for the security of special categories of personal data
Trainings on special categories of personal data security were provided for employees involved in special categories of personal data processing processes, confidentiality agreements were made, and the authorizations of users authorized to access data were defined.
Adequate security measures are taken for the physical environments where special categories of personal data are processed, stored and/or accessed, and unauthorized entry and exit are prevented by ensuring physical security.

b. Administrative measures

The administrative measures taken regarding the Protection of Personal Data are set out below.

Awareness is raised by informing employees about the technical and administrative risks related to the storage of personal data,
In case of cooperation with third parties for the storage of personal data, the agreements made with the companies to which personal data are transferred include provisions on the persons to whom personal data are transferred to take the necessary security measures for the protection and safe storage of the transferred personal data,
Texts are prepared and published within the scope of the obligation to inform employees, customers, visitors and prospective employees,
After disclosure, explicit consent texts are created in line with the clear and explicit will of the persons concerned,
Layered lighting tables for camera systems are hung,
The security of the places where personal data is stored is ensured and locker systems are used,
Confidentiality agreements (Supplier, Franchise, Dealer) are signed

V. OF PERSONAL

A. Obligations regarding the security of personal data

Personal data;

Prevention of unlawful processing,
Prevention of unlawful access,
In order to ensure that it is stored in accordance with the law, Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. takes administrative and technical measures according to technological possibilities and implementation costs.

B. Measures we take to prevent unlawful processing of personal data

Random and/or periodic audits are conducted and commissioned within the company,
Employees (blue-collar and white-collar) are periodically provided with awareness training on the protection of personal data,
The activities carried out by the company are evaluated in detail specific to all departments, and as a result of this evaluation, personal data are processed specific to the activities carried out by the relevant units,
In cases where cooperation is made with third parties for the purpose of processing personal data, the contracts made with companies that process personal data include provisions on the persons processing personal data to take the necessary administrative and technical measures,
In case of unlawful disclosure of personal data or data leakage, the PDP Board is notified of the situation and the examinations stipulated by the legislation in this regard are carried out and measures are taken.

1. Technical and administrative measures taken to prevent unlawful access to personal data

To prevent unlawful access to personal data;

Employees with technical expertise are employed,
Technical measures are periodically updated and renewed,
Access authorization procedures are being established within the company,
Procedures for reporting the technical measures taken and audit processes are being determined,
The data recording systems used within the company are established in accordance with the legislation and periodically audited,
Emergency action plans are created against possible risks and systems are developed for their implementation,
Employees are trained and informed about access to personal data and authorization,
In cases where cooperation is made with third parties for activities such as the processing and storage of personal data, the confidentiality agreements made with companies that provide access to personal data include provisions on the persons providing access to personal data to take the necessary administrative and technical measures,
Security systems are established within technological developments in order to prevent unlawful access to personal data.

2. Measures we take in case of unlawful disclosure of personal data

Administrative and technical measures are taken to prevent unlawful disclosure of personal data and these measures are updated in accordance with the relevant procedures. In the event that unauthorized disclosure of personal data is detected, systems and infrastructures are established to notify the Data Subject and the PDP Board of this situation

In the event that an unlawful disclosure occurs despite all administrative and technical measures taken, if deemed necessary by the PDP Board, this situation may be announced on the website of the PDP Board or by another method or notified directly to the relevant person.

VI. GROUPS OF PERSONS WHOSE DATA ARE PROCESSED BY ÇAĞDAŞ KAĞIT AMBALAJ SAN. VE TİC. LTD. ŞTİ.

Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. and Construction belongs to the following groups of persons

Employee
Employee Candidate
Shareholder/Partner
Customers and their Authorities
Product or Service Recipient
Potential Product or Service Buyer
Intern
Supplier
Supplier Employee
Supplier Officer
Visitor
Members of the Board of Directors
Guarantor

VII. PROCESSING OF PERSONAL DATA AND SPECIAL CATEGORIES OF PERSONAL DATA

PROCESSING OF PERSONAL DATA

According to Law No. 6698 on the Processing of Personal Data, "Personal Data cannot be processed without the explicit consent of the Data Subject." However, personal data may be processed without the consent of the owner if one of the following conditions exists.

Explicitly Stipulated in Laws
Failure to Obtain the Explicit Consent of the Relevant Person Due to Actual Impossibility
Directly Related to the Establishment or Performance of the Contract
Fulfillment of the Company's Legal Obligation
Publicization of Personal Data by the Data Subject
Data Processing is Mandatory for the Establishment or Protection of a Right
Data Processing is Mandatory for the Legitimate Interest of our Company, provided that it does not harm the Fundamental Rights and Freedoms of the Data Subject

The exceptional cases where special categories of personal data may be processed without the explicit consent of the Data Subject are specified in Article XI. B. of this Policy.

PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA

It is prohibited by law to process sensitive personal data (data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data) without the explicit consent of the data subject. Personal data other than health and sexual life may be processed without the explicit consent of the data subject in cases stipulated by law. Personal data relating to health and sexual life may only be processed without the explicit consent of the data subject for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, by persons under the obligation of confidentiality or authorized boards and organizations.

VIII. THIRD PARTIES TO WHOM PERSONAL DATA IS TRANSFERRED BY ÇAĞDAŞ KAĞIT AMBALAJ SAN. VE TİC. LTD. AND PURPOSES OF TRANSFER

Personal data;

Dealer Network/Points of Sale
Real or Private Legal Entities,
Franchise and dealer networks,
Business partners and business contacts,
Associates and Subsidiaries,
Legally authorized public institutions and organizations,
Private law persons from whom services are provided,
Shareholders
Social Security Institution,
Suppliers,
Group Companies and,
It may be transferred to Authorized Public Institutions and Organizations within the framework of the following purposes.

The Purposes of Transfer of Personal Data are as follows:

Execution of activities,
Providing support services to customers within the scope of the contract and service standards,
Identifying the preferences and needs of customers and shaping and updating the services provided accordingly,
Fulfillment of legal obligations as required or mandated by legal regulations,
Ability to conduct market research and statistical studies
Organizing surveys, contests, promotions and sponsorships,
Evaluation of job applications,
Liaison with persons who have a business relationship with the Company,
Management of marketing processes,
Management of vendor/supplier relationships,
Completion of legal reporting and invoicing processes.

Transfer of Personal Data

Conditions for Transfer of Personal Data Domestically

Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. acts in accordance with the decisions and regulations stipulated in the KVKK and taken by the KVK Board regarding the transfer of personal data.

Without prejudice to the exceptional circumstances stipulated in the legislation, personal data and sensitive personal data shall not be transferred to other natural persons or legal entities by Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. without the explicit consent of the Data Subject

In exceptional cases stipulated by the KVKK and other legislation, personal data may be transferred to authorized administrative/judicial institutions or organizations and private law persons without the explicit consent of the Data Subject in the manner and subject to the limits stipulated in the legislation.

1. Conditions for Transfer of Personal Data Abroad

As a rule, personal data is not transferred abroad without the explicit consent of the Data Subject.

However, in cases where one of the exceptional circumstances specified in Article XI. B. of this Policy exists, third parties located abroad:

Being located in countries with adequate protection declared by the KVK Board;
In case of being located in countries where there is no adequate protection, personal data may be transferred abroad without explicit consent, provided that the data controllers in Turkey and in the foreign country in question undertake an adequate protection in writing and the permission of the PDP Board is obtained.

a. Institutions and organizations to which personal data are transferred

Personal data;

Dealer Network/Points of Sale
Real or Private Legal Entities,
Business partners and business contacts,
Associates and Subsidiaries,
Legally authorized public institutions and organizations,
Private legal persons from whom services are provided,
Shareholders
Social Security Institution,
Suppliers,
Group Companies and
It may be transferred to Authorized Public Institutions and Organizations in accordance with the principles and principles stated above

B. Transfer of Special Categories of Personal Data

1. for Domestic Transfer of Sensitive Personal Data

Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. may transfer the Sensitive Personal Data of the Data Subject to third parties by taking the necessary administrative and technical measures in line with the purposes of data processing. Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. will be able to transfer Special Categories of Personal Data to third parties in the presence of one of the processing conditions specified in the section above and the following conditions.

In addition, in exceptional cases stipulated by the legislation,

In addition to taking the measures stipulated by the PDP Board and the relevant legislation, sensitive personal data relating to the health and sexual life of the Data Subject may only be transferred to persons or authorized institutions and organizations under the obligation of confidentiality for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, without the need for explicit consent.

1. Conditions for the Transfer of Sensitive Personal Data Abroad

Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. will be able to transfer the Sensitive Personal Data of the Data Subject to the foreign country where the data controller has adequate protection or undertakes adequate protection in the following cases in line with the legitimate and lawful personal data processing purposes by taking the necessary administrative and technical measures and taking the measures deemed necessary by the Board.

If the Data Subject has explicit consent, based on the consent shown,
If there is no explicit consent of the Data Subject;

Sensitive personal data other than the health and sexual life of the Data Subject (race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing, membership of associations, foundations or trade unions, criminal convictions and security measures, and biometric and genetic data), in cases stipulated by law,
Sensitive Personal Data relating to the health and sexual life of the Data Subject may be transferred abroad only for the purposes of protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, within the scope of processing by persons or authorized institutions and organizations under the obligation of confidentiality.

IX. DATA PROCESSING ACTIVITIES REGARDING WORKPLACE AND WEBSITE VISITORS

CAMERA SURVEILLANCE ACTIVITIES CARRIED OUT IN THE WORKPLACE

Carrying out surveillance activities with security cameras in order to ensure the security of the workplace, employees, visitors and customers in accordance with the law on the protection of personal data and limited to this purpose,
Announcement of camera surveillance activity,
Ensuring the security of the data obtained,
Retention period of personal data obtained through camera surveillance,
Information on who can access the information obtained as a result of monitoring and to whom this information is transferred has been added to the disclosure texts as "layered" as announced by the PDP Board on its official website. Layered Camera Clarification Texts were posted in tables in all places where camera systems are located.

TRACKING OF GUEST ENTRY AND EXIT RECORDS

For the purpose of ensuring security and for other purposes specified in this Policy, the Company carries out personal data processing activities for the follow-up of workplace guest entry and exit records. While the identity data of the persons who come to the Company premises as guests are obtained or Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. or through the texts posted or otherwise made available to the guests in other ways, the relevant person in question is enlightened in this context. The data obtained for the purpose of tracking guest entry-exit are processed only for this purpose and the relevant personal data are recorded in the data recording system in a physical environment.

KEEPING RECORDS OF INTERNET ACCESS PROVIDED TO VISITORS AND GUESTS AT THE WORKPLACE

For the purpose of ensuring security and for other purposes specified in this Policy, the Company may provide internet access to visitors who request it during their stay in the workplace. In this case, log records regarding internet access are kept in accordance with the Law No. 5651 and the mandatory provisions of the legislation regulated in accordance with this Law, and these records are processed only upon request by authorized public institutions and organizations or in order to fulfill the relevant legal obligation in the audit processes to be carried out within the Company.

WEBSITE VISITORS

Cookie records, Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. is used to improve the functioning and use of the official website. It is aimed to make the time spent on the official website of the company more efficient and enjoyable. In addition, some cookies are used to remember the preferences made on the website, thus providing users with an improved and personalized experience. Personal data is collected through the cookies on the websitethe collected data can be processed, transferred and stored. For detailed information about the cookies used on the website, you can visit the official website "Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. Cookie Clarification Text" on the official website.

X. CONDITIONS FOR DELETION, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA

Pursuant to Article 138 of the Turkish Penal Code, Article 7 of the KVK Law and the "Regulation on Deletion, Destruction and Anonymization of Personal Data", although it has been processed in accordance with the provisions of the relevant law, in the event that the reasons requiring its processing disappear, Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti.'s own decision or upon the request of the person concerned, personal data shall be deleted, destroyed or anonymized. Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. has established a policy in this regard according to the provisions of the regulation, and in accordance with this policy, destruction is carried out according to the nature of the data. In accordance with this regulation, Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. has determined periodic destruction dates and a calendar has been created according to which periodic destruction will be carried out at various intervals with the commencement of the obligation.

OBLIGATION TO DELETE, DESTROY AND ANONYMIZE PERSONAL DATA

In the event that all of the conditions for processing personal data specified in Articles 5 and 6 of the LPPD are no longer applicable, personal data must be deleted, destroyed or anonymized by the data controller ex officio or upon the request of the data subject. In the deletion, destruction or anonymization of personal data, it is obligatory to act in accordance with the general principles in Article 4 of the Law and the technical and administrative measures to be taken within the scope of Article 12, the provisions of the relevant legislation, the decisions of the Board and the personal data storage and destruction policy. The data controller is obliged to explain the methods applied for the deletion, destruction and anonymization of personal data in the relevant policies and procedures. In accordance with Article 7 of the Regulation on Deletion, Destruction or Anonymization of Personal Data mentioned above, Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. and also Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. Storage and Destruction Policy has been established.

TECHNIQUES FOR DELETION, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA

Techniques for Deletion and Destruction of Personal Data

Physical Destruction
1. Secure Deletion Software
2. Sending to a Specialist for Secure Deletion

Techniques for Anonymization of Personal Data

Masking
1. Aggregation
2. Data Derivation
3. Data Shuffing, Permutation

XI. RIGHTS OF PERSON CONCERNED; EXERCISE AND EVALUATION OF THESE RIGHTS

RIGHTS OF PERSON CONCERNED AND THE EXERCISE OF THESE RIGHTS

Rights of the Relevant Person

Within the scope of the disclosure obligation, Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. informs the Data Subject and the systems and infrastructures related to this information are established. The technical and administrative arrangements necessary for the Data Subject to exercise his/her rights regarding his/her personal data are made by Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti.

Data Subject on personal data;

Learn whether personal data is being processed,
Request information if personal data has been processed,
To learn the purpose of processing personal data and whether they are used for their intended purpose,
To know the third parties to whom personal data are transferred domestically or abroad,
To request correction of personal data in case of incomplete or incorrect processing,
To request the deletion or destruction of personal data in case the reasons requiring the processing of personal data disappear,
Request notification of the aforementioned correction, deletion or destruction to third parties to whom personal data are transferred,
To object to the occurrence of an unfavorable result by analyzing the processed data exclusively through automated systems,
In case of damage due to unlawful processing of personal data, it has the right to demand the compensation of the damage.

Application Procedure of the Relevant Person

The relevant person may apply to Çağdaş Kağıt Ambalaj San. ve Tic. Şti. in accordance with the application procedures stipulated in the Communiqué on the Procedures and Principles of Application to the Data Controller. Ltd. Şti.

In accordance with Article 13 of the KVKK and Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller, requests within the scope of the rights listed in Article 11 of the Law No. 6698 on the Protection of Personal Data can be applied by one of the methods described below by filling out the form atwww.cagdaskagit.com/kvkk .

The applications submitted to the Company will be answered within 30 days from the date the request is received by the Company, depending on the nature of the request, in accordance with Article 13/2 of the KVKK. The answers regarding the application will be delivered to the applicant in writing and electronically in accordance with Article 13 of the KVKK.

The Right of the Data Subject to File a Complaint to the Personal Data Protection Board

In cases where the application is rejected, the response to the application is found insufficient or the response is not given in due time; the applicant has the right to file a complaint to the PDP Board within 30 (thirty) days from the date of learning the response and in any case within 60 (sixty) days from the date of application

Cases where the Relevant Person cannot assert his/her rights

Pursuant to Article 28/2 of the KVKK, it will not be possible for the relevant persons to benefit from the rights specified in Article 11 of the Law, except for the right to demand compensation for the damage in the following cases;

Processing of personal data is necessary for the prevention of crime or criminal investigation,
Processing of personal data made public by the data subject himself/herself.

XII. ACTIONS TO BE TAKEN IN CASE OF VIOLATION

Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. in the event of a violation despite all technical and administrative measures taken by the relevant person will be notified in a clear and plain language. In this notification;

When the breach occurred,
- Which personal data is affected by the breach on the basis of personal data categories (by making a distinction between personal data / special categories of personal data),
Possible consequences of a personal data breach,
Measures taken or proposed to be taken to mitigate the negative effects of the data breach,
The name and contact details of the contact persons who will enable the relevant persons to receive information about the data breach will be included.

XIII. ÇAĞDAŞ KAĞIT AMBALAJ SAN. VE TİC. LTD. . PERSONAL DATA PROTECTION AND PROCESSING POLICY MANAGEMENT STRUCTURE

The KVK Committee has been assigned to manage this Policy and other policies related and related to this Policy within Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. to manage this Policy and other policies connected and related to this Policy, the PDP Committee has been assigned in accordance with the decision of the Board of Directors of the Company.

The duties of this Committee in relation to the protection of personal data are set out below:

To prepare and put into effect the basic policies on the protection and processing of personal data and amendments thereto when necessary and submit them to the approval of the Board of Directors,
To decide how the implementation and supervision of the policies on the protection and processing of personal data will be carried out and to submit the issues of making internal assignments and ensuring coordination within this framework to the approval of the Board of Directors,
To determine the matters that need to be done to ensure compliance with the PDP Law and related legislation, to submit them to the approval of the Board of Directors, to oversee their implementation and to ensure their coordination,
To raise awareness within the Company and the organizations with which the Company cooperates on the protection and processing of personal data,
Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti.'s personal data processing activities, to ensure that the necessary measures are taken by identifying the risks that may occur, and to submit the improvement suggestions to the approval of the Board of Directors,
To organize trainings on the protection of personal data and the implementation and dissemination of policies, to ensure that data subjects are informed about personal data processing activities and their legal rights,
To decide on the applications of the relevant persons,
To follow the developments and regulations on the protection of personal data and to take the necessary measures within the Company in accordance with these developments and regulations,
Maintaining relations with the PDP Board and the Authority,
To perform other duties to be assigned by the Company's Board of Directors regarding the protection of personal data.

Join Us