Personal Data Protection Notice

NOTICE ON THE COLLECTION, PROCESSING AND PROTECTION OF PERSONAL DATA
1 — GENERAL INFORMATION AND DEFINITIONS

This notice has been prepared by Eren Makina (referred to as “sigaramakinasi.com”), acting as data controller, to fulfil the obligation to inform under Article 10 of Turkish Personal Data Protection Law No. 6698 (“Law”). The following terms have the meanings defined in the Law and its regulations and communiqués.

Personal data: Any information relating to an identified or identifiable natural person.

Processing of personal data: Any operation performed on personal data, wholly or partly by automated means or by non-automated means forming part of a filing system, including collection, recording, storage, retention, alteration, rearrangement, disclosure, transfer, retrieval, making available, classification or preventing its use.

Data subject: The natural person whose personal data is processed.

Explicit consent: Freely given, informed consent concerning a specific matter.

Anonymisation: Making data impossible to associate with an identified or identifiable natural person, even by matching it with other data.

Data controller: The natural or legal person determining the purposes and means of processing and responsible for establishing and managing the filing system.

Data processor: The natural or legal person processing personal data on behalf of the controller under its authority.

Filing system: A recording system in which personal data is structured and processed according to specific criteria.

Contact person: The natural person notified by the controller during registration in the Registry for communication with the Authority about obligations under the Law and secondary legislation, for legal persons resident in Turkey and representatives of legal-person controllers not resident in Turkey.

Personal data retention and disposal policy: The policy used by controllers to determine the maximum period needed for processing purposes and the procedures for deletion, destruction and anonymisation.

2 — DATA CONTROLLER INFORMATION

For legal persons, the legal entity itself is the controller. Obligations of legal persons resident in Turkey are fulfilled by the authorised body or persons entitled to represent and bind the entity. The authorised body may appoint one or more people to carry out obligations under the Law. Such appointment does not remove the legal entity's responsibility.

sigaramakinasi.com operates as a company with legal personality resident in Turkey. Its controller details are:

Registered name	:	Miss Lii Tekstil Endüstri Makinalari San. Tic. Ltd. Şti.
Address	:	Kordonboyu, Ankara Street No. 31, 34860 Kartal/Istanbul
Tax office	:	Kartal Tax Office
Tax number	:	6221439531
Telephone	:	0 536 691 03 44
Email	:	info@sigaramakinasi.com
Website	:	www.sigaramakinasi.com

3 — CONTROLLER OBLIGATIONS

sigaramakinasi.com must inform data subjects about:

• The identity of the controller and its representative, if any.
• The purposes of processing.
• Recipients and purposes of potential transfers.
• The collection method and legal basis.
• The rights of people whose personal data is processed.

For data security, sigaramakinasi.com takes necessary measures to prevent unlawful processing and access and ensure data preservation. It carries out the inspections required to comply with Law No. 6698, does not disclose the data contrary to the Law and does not use it outside its processing purpose.

4 — PERSONAL DATA TO BE PROCESSED

The following data may be processed by sigaramakinasi.com. Information may be added or changed when required by law and/or necessary.

• Identity information such as name, surname, Turkish identification number and date of birth.
• Contact details such as address, telephone, fax and email.
• Tax office and tax number.
• Employee salary, social security, bank account and family information.
• Profession and education information.
• Camera recordings, fingerprints and similar information.

5 — METHODS OF COLLECTION

Personal data may be obtained directly from the data subject or indirectly, depending on the purpose, through online sales platforms, camera recordings, dealers, partner organisations and other sources.

6 — PURPOSES OF PROCESSING

sigaramakinasi.com processes personal data for the following purposes:

• Fulfilling tax and other public-payment obligations under tax legislation, Turkish Commercial Code No. 6102 and other laws.
• Taking measures to protect consumer rights under Consumer Protection Law No. 6502.
• Receiving orders for products requested from sigaramakinasi.com, selling and delivering products, collecting payments, providing after-sales services, measuring customer satisfaction, and collecting and assessing complaints and suggestions about products or services.
• Improving service quality.
• Conducting and providing information about product and service campaigns, promotions, advertising and publicity.
• Ensuring internal security and increasing production efficiency.
• Proving employment relationships, recording salary information, making statutory notifications to financial, social security and other institutions, applying occupational health and safety principles, fulfilling legal obligations and determining working conditions.

7 — TRANSFER AND PROTECTION OF PERSONAL DATA

sigaramakinasi.com does not transfer personal data obtained for processing purposes to third parties or organisations without the data subject's explicit consent.

sigaramakinasi.com may transfer personal data to persons and institutions required or permitted by tax, social security and other legislation, including authorised bodies such as the Revenue Administration, Turkish Employment Agency, Social Security Institution, Financial Crimes Investigation Board, Interbank Card Center and Credit Bureau; its domestic or overseas affiliates; dealers; programme and solution partners; postal branches; logistics, consultancy and independent audit providers, due to legal requirements. Even without a legal obligation, it may transfer data to third parties and institutions to achieve the service purposes in Section 6, subject to the data subject's rights under Law No. 6698.

8 — EXPLICIT CONSENT FOR PROCESSING

sigaramakinasi.com processes personal data with the data subject's explicit consent under Law No. 6698. Explicit consent means informed, freely given consent on a specific matter. Under Article 5(2), data may be processed without explicit consent if one of these conditions applies:

• Processing is expressly provided for by law.
• It is necessary to protect the life or physical integrity of a person unable to consent due to practical impossibility or whose consent is legally invalid, or of another person.
• Processing the parties' data is necessary and directly related to establishing or performing a contract.
• It is necessary for the controller to fulfil a legal obligation.
• The data has been made public by the data subject.
• It is necessary to establish, exercise or protect a right.
• It is necessary for the controller's legitimate interests without harming the data subject's fundamental rights and freedoms.

9 — RETENTION PERIOD

sigaramakinasi.com disposes of personal data by deletion, destruction or anonymisation when the processing purpose ceases and mandatory retention periods under applicable legislation expire.

10 — DATA SUBJECT RIGHTS

Data subjects may apply to the controller to:

• Learn whether their personal data is processed.
• Request information if it has been processed.
• Learn the purpose of processing and whether data is used accordingly.
• Know third-party recipients domestically or abroad.
• Request correction of incomplete or inaccurate data.
• Request deletion or destruction under the conditions provided by law.
• Request notification of changes to third-party recipients.
• Object to an adverse result arising exclusively from automated analysis.
• Seek compensation for damage caused by unlawful processing.

11 — APPLICATION TO THE CONTROLLER

Natural persons whose data is processed may apply to sigaramakinasi.com concerning their rights under Article 11 of Law No. 6698. Applications must be made in Turkish. Requests may be submitted through these channels:

• In writing.
• Through registered electronic mail (KEP).
• Using a secure electronic signature or mobile signature, or an email address previously supplied by the data subject to sigaramakinasi.com and registered in its system.

Applications must include:

• Name, surname and signature for written applications.
• Turkish identification number for Turkish citizens; nationality and passport number or identification number, if any, for foreigners.
• Residential or business address for service of notices.
• Email address, telephone and fax number for notifications, if available.
• The subject of the request.

Relevant information and documents must accompany the application. The Application Request Form may be used. Contact channels are listed in Section 2 — Data Controller Information.

sigaramakinasi.com resolves requests free of charge as soon as possible, according to their nature, and within thirty days at the latest. If processing entails an additional cost, the fee specified in Article 7 of the Communiqué on the Procedures and Principles of Application to the Data Controller may apply. If the application arises from the controller's error, any fee is refunded.

12 — CHANGES AND UPDATES

This notice was prepared under Law No. 6698, its regulations and communiqués, and the personal data processing purposes and policies of sigaramakinasi.com. It may be amended following changes to legislation and/or those purposes and policies.

The latest version is available at sigaramakinasi.com.