Personal Data Protection Law

Karsan Raf Sistemleri San. ve Tic. Ltd. Şti. (“Karsan Raf”) attaches utmost importance to the security of personal data. Karsan Raf takes the highest level of security measures reasonably available within the framework of the applicable legislation in order to ensure that your personal data is collected, stored and shared in accordance with the law and to protect your privacy. Aware of this responsibility, Karsan Raf, acting as the data controller within the scope of Law No. 6698 on the Protection of Personal Data (“Personal Data Protection Law”), processes your personal data as explained below and in accordance with the applicable legislation.

Your personal data is collected electronically by Karsan Raf through the website owned by Karsan Raf for the purpose of carrying out web communication activities and receiving and handling requests or complaints, based on the legal grounds of ensuring compliance with the legislation and Karsan Raf’s policies, performance of contracts, explicit legal requirements, and Karsan Raf’s legitimate interests. Your personal data may also be processed in accordance with the fundamental principles stipulated under the Personal Data Protection Law, within the scope of the conditions and purposes for processing personal data set forth under Articles 5 and 6 of the Personal Data Protection Law and for the purposes specified in this Privacy Notice.

The personal data processed herein is not transferred to third parties for the processing purposes listed below, except where legally required.

1) Identity of the Data Controller and Its Representative

Pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (“Personal Data Protection Law”), the scope within which your personal data may be processed by Karsan Raf Sistemleri San. ve Tic. Ltd. Şti., acting as the data controller, is explained below.

2) Purposes of Processing Personal Data

Your personal data collected may be processed by Karsan Raf for the following purposes, in accordance with the fundamental principles stipulated under the applicable legislation:

• Complying with information retention, reporting and notification obligations stipulated by official authorities under the applicable legislation, and fulfilling our legal obligations to which we are subject in relation to benefiting from such services;
• Reviewing, evaluating and responding to requests received from official authorities or relevant persons;
• Conducting information security processes;
• Conducting communication activities;
• Ensuring the security of the data controller’s operations;
• Following up on requests and complaints;
• Fulfilling the obligation to provide evidence in potential future legal disputes; and processing personal data within the scope of the conditions and purposes for processing personal data specified under Articles 5 and 6 of the Personal Data Protection Law.

3) Rights of the Data Subject Listed under Article 11 of Law No. 6698

• As data subjects, if you submit your requests concerning your rights to Karsan Raf through the methods specified in the Karsan Raf Sistemleri San. ve Tic. Ltd. Şti. Personal Data Protection and Processing Policy, which has been made publicly available at www.karsanayc.com, Karsan Raf shall conclude your request as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the relevant transaction requires an additional cost, Karsan Raf may charge the fee specified in the tariff determined by the Personal Data Protection Board. Within this scope, data subjects have the right to:
• Learn whether their personal data is being processed;
• Request information if their personal data has been processed;
• Learn the purpose of processing their personal data and whether such data is being used in accordance with this purpose;
• Know the third parties to whom their personal data is transferred, whether domestically or abroad;
• Request the correction of their personal data if it has been processed incompletely or inaccurately, and request that the relevant action taken in this regard be notified to third parties to whom the personal data has been transferred;
• Request the deletion or destruction of their personal data where the reasons requiring its processing have ceased to exist, even though such data has been processed in accordance with the Personal Data Protection Law and other applicable laws, and request that the relevant action taken in this regard be notified to third parties to whom the personal data has been transferred;
• Object to the occurrence of a result against the individual where the processed data is analyzed exclusively through automated systems;
• Request compensation for damages arising from the unlawful processing of their personal data.

In the event that an application is rejected, the response provided is deemed insufficient, or no response is provided within the prescribed period, the data subject may lodge a complaint with the Personal Data Protection Board within thirty days from the date on which the data subject becomes aware of the data controller’s response and, in any event, within sixty days from the date of application. Pursuant to Article 13 of the Law, a complaint may not be lodged without first exhausting the application procedure.

Applications concerning the rights listed above may be submitted by using the Data Controller Application Form available at www.karsanayc.com.