SALONİ MOBİLYA SANAYİ VE TİCARET ANONİM ŞİRKETİ

PRIVACY NOTICE UNDER THE LAW NO. 6698 ON THE PROTECTION OF PERSONAL DATA

A. PURPOSE

As SALONİ MOBİLYA SANAYİ VE TİCARET ANONİM ŞİRKETİ (“COMPANY”, “Company”), with its registered office at Yeniceköy Mah. Fatih Sultan Mehmet Han Bulvarı No:36/1 İnegöl BURSA, Türkiye, this Privacy Notice (“Privacy Notice”) has been prepared under the Law No. 6698 on the Protection of Personal Data (“KVKK”) in order to fulfil the obligation set out by the KVKK, in consideration of the importance we attach to fundamental human rights and the paramount value of personal data.

We hereby inform you that your personal data which you have provided or will provide to our Company and/or which is obtained by our Company externally through any channel may be processed by our Company, acting in its capacity as “Data Controller”:

Within the scope of the purpose requiring their processing, and in a manner connected with, limited to and proportionate to that purpose,
Preserving the accuracy and the most up-to-date state of the personal data as notified by you or as they were notified to our Company,
And that they may be recorded, stored, retained, reorganised, shared with the institutions legally authorised to request such personal data, and, under the conditions set out in the KVKK, transferred or assigned to third parties in Türkiye or abroad, classified, processed in other manners listed in the KVKK and subjected to the other operations listed in the KVKK.

Through this Privacy Notice, the Company has adopted the principle of carrying out and developing its activities in compliance with the principles set out in the KVKK.

In accordance with the KVKK, the COMPANY, in its capacity as Data Controller, informs its employees, employee candidates, supplier employees, customers, visitors and third parties whose personal data will be processed, as set out below, and provides the disclosure required under Article 10 of the KVKK as follows.

B. PERSONAL DATA WE PROCESS BY DATA CATEGORY, THEIR LEGAL GROUNDS AND THE PURPOSES OF PROCESSING YOUR PERSONAL DATA

Identity

Personal Data Processed

Your name, surname, Turkish ID number, mother’s name, father’s name, place and date of birth, personnel registry number, and other information provided to the Company with your explicit consent.

Purpose of Processing

Conducting Application Processes for Employee Candidates. Fulfilment of Obligations Arising from the Employment Contract and Legislation for Employees. Conducting Training Activities. Conducting Finance and Accounting Affairs. Conducting Goods / Services Sales Processes. Conducting Customer Relationship Management Processes. Conducting Contract Processes. Follow-Up of Requests / Complaints. Work and Residence Permit Procedures for Foreign Personnel. Providing Information to Authorised Persons, Institutions and Organisations. Creating and Tracking Visitor Records.

Legal Grounds

Processing of personal data of the parties to a contract being necessary, provided that it is directly related to the conclusion or performance of that contract; processing being mandatory for the data controller to fulfil its legal obligations

Contact

Personal Data Processed

Address Number, E-Mail Address, Contact Address, Registered Electronic Mail (KEP) Address, Telephone Number

Purpose of Processing

Conducting Emergency Management Processes, Conducting Communication Activities, Conducting Goods / Services Sales Processes, Conducting Contract Processes, Providing Information to Authorised Persons, Institutions and Organisations

Legal Grounds

Location

Personal Data Processed

Location Information of Whereabouts

Purpose of Processing

Conducting Emergency Management Processes, Conducting Fringe Benefits and Interests Processes for Employees, Conducting Assignment Processes, Conducting Logistics Activities

Legal Grounds

Processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject

Personnel File

Personal Data Processed

Payroll Information, Disciplinary Investigation, Employment Entry-Exit Document Records, CV Information, Performance Evaluation Reports, Training Certificates, Documents Required by Law to Be Kept in the Personnel File

Purpose of Processing

Fulfilment of Obligations Arising from the Employment Contract and Legislation for Employees, Providing Information to Authorised Persons, Institutions and Organisations

Legal Grounds

Legal Action

Personal Data Processed

Information in Correspondence with Judicial Authorities, Information in Case Files, information in correspondence with authorised persons, institutions and organisations, data regarding enforcement files, information regarding legal information requests.

Purpose of Processing

Follow-Up and Conduct of Legal Affairs, Providing Information to Authorised Persons, Institutions and Organisations

Legal Grounds

Processing being mandatory for the data controller to fulfil its legal obligations

Customer Transaction

Personal Data Processed

Records regarding the use of products and services and information such as the customer’s instructions and requests necessary for the use of products and services, customer number, contract numbers, transaction date, account number, product information, Invoice, Promissory Note, Cheque Information, Order Information, Request Information

Purpose of Processing

Ensuring That Activities Are Carried Out in Compliance with Legislation, Conducting Goods / Services Sales Processes, Conducting After-Sales Support Services for Goods / Services, Conducting Customer Relationship Management Processes, Conducting Activities for Customer Satisfaction

Legal Grounds

Processing of personal data of the parties to a contract being necessary, provided that it is directly related to the conclusion or performance of that contract

Physical Premises Security

Personal Data Processed

Entry-Exit Record Information of Employees and Visitors, Camera Records

Purpose of Processing

Ensuring the Security of Physical Premises

Legal Grounds

Processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject

Transaction Security

Personal Data Processed

IP address information, website entry-exit information, password and passcode information

Purpose of Processing

Conducting Information Security Processes

Legal Grounds

Processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject

Finance

Personal Data Processed

Balance sheet information; bank name and branch information, bank account number information and IBAN number information obtained for the payment of salaries and fringe benefits and for making payments in assignments outside the company

Purpose of Processing

Conducting Finance and Accounting Affairs, Conducting Investment Processes, Providing Information to Authorised Persons, Institutions and Organisations

Legal Grounds

Processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject; processing being mandatory for the data controller to fulfil its legal obligations

Professional Experience

Personal Data Processed

Diploma information, courses attended, in-service training information, certificates, transcript information

Purpose of Processing

Conducting Application Processes for Employee Candidates, Fulfilment of Obligations Arising from the Employment Contract and Legislation for Employees, Planning of Human Resources Processes

Legal Grounds

Processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject

Marketing

Personal Data Processed

Shopping history information, surveys, cookie records, information obtained through campaign activities

Purpose of Processing

Conducting Marketing Analysis Studies, Conducting Marketing Processes of Products / Services, Conducting Advertising / Campaign / Promotion Processes, Conducting marketing analysis, cookies, CRM, surveys, campaigns, advertising, access via social media accounts, promotion, publicity, information and marketing activities, and sending commercial electronic messages to customers

Legal Grounds

Processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject; the data subject having given explicit consent

Audio and Visual Records

Personal Data Processed

Audio and visual records; in connection with conferences, seminars, theatre performances, exhibitions, debates and similar events organised by the Company, still or moving images and/or sounds of the venue and of the participants for purposes such as promoting, announcing and disseminating the event, together with the audio/visual information provided by the cameras installed to ensure security at the Company’s head office, branches and representative offices. The audio/visual information obtained at such events may be used on the Company’s website, on the social sharing platforms used by the Company and in works printed by the Company, in a manner not exceeding the Company’s activities and limited to the purpose of the event. Alternatively, it may be sent, with the Company’s permission and under its control, to third parties (printing house, publisher, institution, organisation…) for printing/publication. This manner of use shall not cover security camera footage, and before the relevant audio/visual personal data are used, the participants will be separately informed (for example, at the beginning of the event) and their explicit consent will be obtained.

Purpose of Processing

Conducting / Supervising Business Activities, Providing Information to Authorised Persons, Institutions and Organisations

Legal Grounds

Processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject

Health Information

Personal Data Processed

Information on disability status, blood type information, personal health information, information on devices and prostheses used

Purpose of Processing

Fulfilment of Obligations Arising from the Employment Contract and Legislation for Employees, Conducting Fringe Benefits and Interests Processes for Employees, Conducting Occupational Health / Safety Activities, Providing Information to Authorised Persons, Institutions and Organisations

Legal Grounds

Being expressly provided for by law; processing being mandatory for the data controller to fulfil its legal obligations; processing being mandatory for the establishment, exercise or protection of a right

Criminal Convictions and Security Measures

Personal Data Processed

Information on criminal convictions, information on security measures

Purpose of Processing

Conducting Application Processes for Employee Candidates, Planning of Human Resources Processes, Providing Information to Authorised Persons, Institutions and Organisations

Legal Grounds

The data subject having given explicit consent

Although the Company has no direct purpose of processing special categories of personal data other than the purposes stated above, the Company may also process your data relating to religion, dress and attire, philosophical belief, political opinion and health which may be obtained indirectly from the identity document or photographs you have submitted to the Company or from data obtained from still/moving images within the scope of events (for example, clothing, devices and prostheses discernible from a photograph), as well as other special categories of information that you voluntarily state in a document provided by the Company.

Your personal data are collected, both before the establishment of the contractual relationship and after its establishment and throughout its continuation, through all kinds of information, documents and records that you have submitted to our Company and that are obtained from third parties and from public institutions and organisations for the reasons stipulated by law, through physical or electronic media for the reasons stipulated by law, through registration/application forms filled in over the internet, receipts and expenditure documents, image and sound recording devices used at events, security camera records, and, where personal data are sent to the COMPANY’s official e-mail address, KEP address or fax address, through the said communication channels.

Personal data are also collected through the physical sending of documents, the physical completion of a document provided by the Company, and calls made to the Company’s telephone numbers.

Your personal data are also collected by automated means through cookies used on the www.saloni.furniture address and its extensions. The said cookies are only the cookies necessary for the visitor to use the site at full efficiency, are used to remember the visitor’s preferences and do not obtain any other personal data. You can access our cookie policy at www.saloni.furniture.

C. TRANSFER OF PERSONAL DATA

The procedures and principles applicable to transfers of personal data are set out in Articles 8 and 9 of the KVKK, and your personal data are shared, for the purposes and by the means set out in this Privacy Notice, with authorised public institutions and organisations, judicial authorities, enforcement authorities, law enforcement units and contracted suppliers from which products and/or services are procured.

The Company does not carry out any data transfer that does not concern its purposes. For example, even if obtained with your consent, information relating to your vehicle licence plate is not shared with any third party, including the persons and institutions indicated above. The exception to this determination is where the transfer of the data in question is made compulsory by legislation, or is mandatory for a criminal investigation, or is requested by an official authority on the basis of legislation and with its justification stated.

We may also share your personal data with the following recipients and/or categories of recipients:

Persons authorised by us to carry out the personal data processing operations described in this privacy notice (our employees and business partners who are bound by confidentiality obligations and obliged to comply with the rules on the processing of your personal data)
Our personal data processors (external companies to which we have delegated some of the processing activities listed in this privacy notice; for example, security system providers, accounting and other consultants, data hosting providers, etc.)
Law enforcement authorities or any other authority whose decisions are binding on us (this applies where we must comply with a court order or a law, or defend ourselves in legal proceedings.)

D. ENSURING THE SECURITY AND CONFIDENTIALITY OF PERSONAL DATA

In accordance with Article 12 of the KVKK, our Company takes all necessary technical and administrative measures to provide the appropriate level of security in order to prevent the unlawful processing of the personal data it processes and unlawful access to personal data, and to ensure the safekeeping of personal data. You can access the technical and administrative measures taken by our Company via the VERBİS “Registry Search” link, by typing “SALONİ MOBİLYA SANAYİ VE TİCARET ANONİM ŞİRKETİ” into the search section.

In the event that the processed personal data are obtained by others through unlawful means, our Company will notify the relevant data subject and the Personal Data Protection Board of this situation as soon as possible.

E. ERASURE, DESTRUCTION AND ANONYMISATION OF PERSONAL DATA

Pursuant to Article 7 of the KVKK, although personal data have been processed in compliance with the relevant legislation, where the reasons requiring their processing cease to exist, the personal data are erased, destroyed or anonymised by our Company ex officio or upon the request of the data subject. The procedures and principles in this regard will be fulfilled in accordance with the “Personal Data Retention and Disposal Policy” that we have prepared in line with the KVKK and the secondary legislation established on the basis of this Law.

F. RIGHTS OF THE DATA SUBJECT

Under the KVKK, you have the right to:

Learn whether your Personal Data are being processed,
Request information in this regard if your Personal Data have been processed,
Learn the purpose of processing of your Personal Data and whether they are used in accordance with that purpose,
Know the third parties to whom your Personal Data are transferred, in Türkiye or abroad,
Request the rectification of your Personal Data if they have been processed incompletely or inaccurately,
Request the erasure or destruction of your Personal Data within the framework of the conditions stipulated in the KVKK legislation,
Request that the operations carried out under items v. and vi. be notified to the third parties to whom your Personal Data have been transferred,
Object to the occurrence of a result to your detriment through the analysis of the processed data exclusively by automated systems,
Request compensation for the damage in the event that you suffer damage due to the unlawful processing of your Personal Data

as set out above.

How Can You Exercise Your Rights?

You may fill in the application form, which you can download from www.saloni.furniture, in line with your request/complaint and send the said form to us via [email protected], or fill in the form physically and send it by courier/post to the address “Yeniceköy Mah. Fatih Sultan Mehmet Han Bulvarı No:36/1 İnegöl BURSA”.

If you submit your request to us using one of the methods indicated above, pursuant to Article 13/2 of the KVKK your request will be evaluated within 30 days at the latest and you will be informed on the matter. If your request is accepted, the necessary operations will be carried out immediately by the COMPANY as data controller.

G. DATA CONTROLLER

As stated in this Privacy Notice, the COMPANY is the data controller under the KVKK.

Data Controller Information

Açık Adı SALONİ MOBİLYA SANAYİ VE TİCARET ANONİM ŞİRKETİ

Adres Yeniceköy Mah. Fatih Sultan Mehmet Han Bulvarı No:36/1 İnegöl BURSA

Web Adresi www.saloni.furniture

E-posta [email protected]

Telefon 02247113130

This page is a convenience translation of the Turkish “KVKK Aydınlatma Metni”. In case of any discrepancy between the translated versions and the Turkish original, the Turkish version shall prevail.