Law on the Protection of Personal Data

At Second Hand Komori, we attach great importance to the confidentiality and security of your personal data.

In this context, the processing and storage of all kinds of personal data belonging to all persons associated with Second Hand Komori including our customers who benefit from our products and services and our business connections in accordance with the Law on the Protection of Personal Data No. 6698 (“KVKK”) is one of our top priorities. In accordance with the KVKK and in our capacity as “Data Controller,” we would like to inform you about the purposes for processing your personal data, the methods and reasons for collecting your data, your rights regarding the processing of your personal data, and the procedures and principles for exercising those rights.

a. What is Personal Data? Which Personal Data Do We Collect?

Personal data refers to any information that can be associated with your identity including, but not limited to, personal details (first name, last name, Turkish ID number, etc.), address and telephone information, vehicle and license plate details, family status information, IP address, and bank account details (“Personal Data”). Sensitive Personal Data, a special category of Personal Data, includes data such as your race, ethnic origin, political opinion, philosophical beliefs, religion, sect or other beliefs, attire, membership in associations, foundations or trade unions, health, information regarding your sex life, criminal convictions, and security measures, as well as your biometric and genetic data (“Sensitive Personal Data”). The explanations provided on this page regarding your Personal Data also apply to your Sensitive Personal Data.

In this context, as Second Hand Komori, we collect Personal Data when necessary and in accordance with the KVKK from our customers, business connections, employees, job applicants, users of our platforms (websites/mobile sites and applications), visitors, and the officials and employees of institutions with whom we have subcontracting or similar business relationships. We can detail the Personal Data we collect as follows:

• Identification Data: Data relating to a person’s identity, such as first name, last name, Turkish ID number, and photocopy of identification, which we collect from our customers, business connections, employees, job applicants, users of our platforms (websites/mobile sites and applications), visitors, and the officials and employees of institutions with whom we have subcontracting or similar business relationships.
• Contact Data: Data that enables communication with the individual, such as telephone number, address, email address, and IP address, which we collect from our customers, business connections, employees, job applicants, users of our platforms (websites/mobile sites and applications), visitors, and the officials and employees of institutions with whom we have subcontracting or similar business relationships.
• Data Pertaining to Family Members: Data regarding the family members and close relatives of the relevant person, which we collect from our employees, job applicants, and the officials and employees of institutions with whom we have subcontracting or similar business relationships, in compliance with the applicable legislation and/or in order to protect the legal and other interests of our Company or the relevant person.
• Financial Data: Data such as salary, wage information, and bank account details, which we collect from our employees, job applicants, customers, business connections, and the officials and employees of institutions with whom we have subcontracting or similar business relationships, in accordance with the legal relationship established by our Company with the data subject.
• Personnel Data: Any personal data that forms the basis for the establishment of the personnel rights of individuals who are in an employment relationship with our Company, which we collect from our employees, job applicants, and the employees of institutions with whom we have subcontracting or similar business relationships.
• Physical Premises Security Data: Personal data such as security and camera recordings obtained during entry into and while remaining in a physical location, which we collect from our customers, business connections, employees, job applicants, visitors, and the officials and employees of institutions with whom we have subcontracting or similar business relationships.
• Communication and Complaint Management Data: Personal data obtained from our customers, business connections, users of our platforms (websites/mobile sites and applications), visitors, and the officials and employees of institutions with whom we have subcontracting or similar business relationships during the process of receiving and evaluating any request or complaint directed at our Company.
• Sensitive Personal Data: Data such as health information specified in Article 6 of the KVKK, biometric data (audio and video recordings), and information about religion and membership in an association or union, which we collect from our customers, business connections, employees, job applicants, visitors, and the officials and employees of institutions with whom we have subcontracting or similar business relationships.
• Other Data: Data processed for technical transaction security, purchase information, cookies, and other data collected automatically through various means, which we collect from our customers, business connections, employees, job applicants, users of our platforms (websites/mobile sites and applications), and the officials and employees of institutions with whom we have subcontracting or similar business relationships.

b. By What Methods and Legal Grounds Do We Collect / Process Your Personal Data?

We collect your Personal Data for the primary purposes and by the methods listed below, whether automatically or non-automatically, via audio, verbal, written, or electronic means, and through additional channels that may be introduced in the future.

We collect your Personal Data through our internet and mobile platforms (websites/mobile sites and applications), via our social media accounts operated in the name of Second Hand Komori on various social media platforms, through our call center managed by Second Hand Komori, via communication methods including email, short messages (“SMS”) or multimedia messages (“MMS”), through the contracts we have signed with you or the company you represent in the context of Second Hand Komori’s sales and marketing activities, through commercial proposals, printed and electronic forms, business cards and other documents provided by you during customer visits, through third parties such as Second Hand Komori group companies, business connections, dealers and sales channels, manufacturing companies, or firms from which services/products are procured, and through various channels including the Trade Registry, either automatically or non-automatically as part of any data recording system.

We process your Personal Data, which we collect through the above methods, based on one or more of the following legal grounds:

• Obtaining your explicit consent,
• The provisions of the laws and regulations currently in force in the Republic of Turkey permitting the processing,
• If it is impossible to obtain your consent due to practical reasons and the processing is necessary to protect your or someone else’s life or physical integrity,
• It is necessary for the performance of the contract entered into with you or your company,
• It is necessary for the fulfillment of our legal obligations,
• Your personal data has been made public by you,
• It is necessary for the exercise or protection of our legal or contractual rights as Second Hand Komori,
• It is necessary for our legitimate interests, provided that it does not harm your fundamental rights and freedoms.

As Second Hand Komori, we store all the Personal Data we process in accordance with the timeframes mandated by the KVKK and other relevant legislation, and in any case, we take all necessary administrative and technical measures to preserve such data as long as the above legitimate purposes exist.

c. For What Purpose Do We Process Your Personal Data?

We process the Personal Data we collect for the following general purposes, depending on its nature:

1. The performance of contracts entered into by Second Hand Komori, including the provision, production, sale, delivery, and installation of the offered products and services; the development of products and services and the execution of necessary work and evaluations to enable you to benefit from them; and the performance of after-sales maintenance and repair operations.
2. The monitoring and fulfillment of obligations arising from consumer legislation and the response to consumer applications.
3. The tracking, evaluation, and provision of support services for requests and complaints from customers and consumers, as well as consumer satisfaction management, which includes planning, statistical analysis, and the implementation of satisfaction surveys.
4. Conducting quality evaluation and improvement activities to provide better and more reliable products and services and to ensure sustainability, as well as the supervision of suppliers, subcontractors, and other persons with whom we have business relationships.
5. Conducting advertising and marketing activities for the products and services offered by Second Hand Komori, including promotion, campaigns, offers, events, and similar matters; providing information about new products and services; and executing corporate communication activities.
6. Carrying out marketing and CRM (Customer Relationship Management) activities.
7. Engaging in corporate communication, organizing related events and invitations, providing information about them, and conducting market research activities.
8. Improving the digital platforms provided to our customers, consumers, and business connections, and extracting statistics (such as the number, type, visit frequency, behaviors, and geographical locations of platform users) to offer efficient and personalized experiences; as well as providing personalized content, campaigns, and advertisements based on the interests and needs of users of our platforms (websites, mobile sites, and applications) by means of cookies.
9. Ensuring the legal and commercial security of persons who are in a business relationship with Second Hand Komori (for example, by planning administrative operations related to communications conducted by our Company, ensuring the physical security and oversight of our locations, executing evaluation and audit processes for business partners/customers/suppliers (officials or employees), and managing legal compliance processes).
10. The exercise of legal rights and using information regarding the processing history as evidence in the event of a dispute after the termination of the legal relationship.
11. Determining and implementing Second Hand Komori’s commercial, legal, and business strategies.
12. Implementing Second Hand Komori’s human resources, accounting, and finance policies.
13. Planning, auditing, and executing information security processes.
14. Ensuring compliance with domestic and international legislation, obtaining information requested by public institutions and organizations, and fulfilling reporting obligations.

d. Transfer of Personal Data and Processing of Personal Data by Third Parties

The Company may transfer personal data to a third natural or legal person in accordance with the provisions of the KVKK. In such a case, the Company ensures that the third parties to whom the data is transferred also comply with this Policy. In this context, the necessary protective arrangements are added to the contracts entered into with the third party.

• Transfer of personal data to third parties located in Turkey; Personal Data may be transferred by the Company to third parties located in Turkey, either without obtaining explicit consent in exceptional cases specified in Article 5.2 and Article 6.3 of the KVKK, or in other cases by obtaining the explicit consent of the data subject (Articles 5.1 and 6.2 of the KVKK).
• Transfer of personal data to third parties located abroad; Personal Data may be transferred by the Company to third parties located abroad, either without obtaining explicit consent in exceptional cases specified in Article 5.2 and Article 6.3 of the KVKK, or in other cases by obtaining the explicit consent of the data subject (Articles 5.1 and 6.2 of the KVKK). However, for the foreign country to which the data is transferred, one of the following conditions must be met:
• The foreign country to which the personal data is transferred is recognized by the Data Protection Authority as having an adequate level of protection,
• If the foreign country to which the transfer is to take place is not included in the safe countries list of the Data Protection Authority, then the Company and the Data Controllers in that country must obtain permission from the Authority after providing a written commitment that adequate protection will be ensured.

e. Your Rights and Application Procedure

e.1. Your Rights Regarding Your Personal Data

We would like to inform you that you have the following rights regarding the data processed within Second Hand Komori and its subsidiaries:

1. The right to know whether your Personal Data is being processed,
2. If your Personal Data is being processed, the right to obtain information about it,
3. The right to know the purpose of processing your Personal Data and whether it is used in accordance with that purpose,
4. The right to know which third parties if any your data has been transferred to, both domestically and internationally, and which data has been transferred,
5. The right to request correction of any inaccuracies or errors in your processed Personal Data,
6. The right to request that any corrections, deletions, or destructions of your Personal Data be communicated to the third parties to whom your Personal Data has been transferred,
7. The right to request deletion or destruction of your processed Personal Data if the reasons for processing it cease to exist or if your Personal Data loses its relevance,
8. The right to object to a result adversely affecting you that is solely based on automated processing of your Personal Data,
9. The right to claim compensation for damages in the event that your Personal Data is processed unlawfully.

e.2. Application

You may submit your requests regarding your Personal Data by filling out the application form provided in the link below:

1. It can be submitted by delivering it to the consultation office at our company address indicated in the Data Controller Identity information, or by having it served via a notary at the same address,
2. Or it can be done via the registered email.

Second Hand Komori will resolve the requests directed to it free of charge within the shortest possible time and, in any event, within 30 (thirty) days from the date your request is received. In the event that a cost arises from fulfilling your requests, we may only charge you the fees specified in the tariff determined by the Data Protection Authority.

In response to the requests submitted to Second Hand Komori, we may either accept the requests or reject them with an explanation, and we will communicate this response to the applicant in writing or electronically. In the event of acceptance, as Second Hand Komori, we are obligated to immediately fulfill the request.

e.3. Complaint

If your requests submitted to Second Hand Komori are rejected, if you are dissatisfied with the response provided by Second Hand Komori, or if no response is given, you may lodge a complaint with the Data Protection Authority within 30 (thirty) days from the date the response is communicated to you, or within 30 (thirty) days following the end of the 30-day period if no response is given.

f. Data Controller Identity Information

The term “Second Hand Komori” used in this document has been prepared for the Second Hand Komori affiliate established in Turkey, whose details are provided below, and is addressed to the data subjects whose data is processed by the company mentioned below as the Data Controller:

Second Hand Komori

Address: Yüzyıl Mah. Matbaacılar ve Ambalajcılar Sitesi 3. Cad. No:221 34218 Bağcılar/İstanbul/Türkiye

E-Mail Address: info@secondhandkomori.com

Telephone Number: +90 212 629 04 33

Telephone Number: +90 212 629 05 46

Application Form Under the KVKK

Under the Law on the Protection of Personal Data No. 6698 (“KVK Law”), personal data owners defined as the relevant person (hereinafter referred to as “Applicant”) have been granted the right to submit certain requests regarding the processing of their personal data, as provided in Article 11 of the KVK Law. In accordance with the first paragraph of Article 13 of the KVK Law, applications regarding these rights must be submitted to our Data Controller in person, in writing in Turkish, and by the following methods as determined by the Data Protection Authority (“Authority”).

Below are details regarding how written applications should be delivered to us.

In accordance with the Communiqué on the Application Procedure and Principles for the Data Controller (dated 10/03/2018 and numbered 30356), the following information is required to be included in applications.

Information to be Filled Out During the Application:

• First name, last name and, if the application is in writing, a signature,
• Turkish ID number for Turkish citizens, and for foreigners, their nationality, passport number, or, if available, identification number,
• The address of residence or business address for notification purposes,
• If applicable, the email address, telephone, and fax number used for notification,
• The subject of the request

Additionally, information and documents related to the subject should be attached to the application.

If you wish to submit an application regarding your personal data, it is required that the application form provided below is filled out completely. This application form has been prepared to determine your relationship with our Company, to identify all the personal data processed by our Company, if any, and to ensure that a correct and timely response can be provided to your application. In order to eliminate the legal risks that may arise from unlawful and unjust data sharing, and especially to ensure the security of your personal data, our Company reserves the right to request additional documents and information (such as a copy of your identity card or driver’s license) for identity and authorization verification. If the information you provide in your requests is not accurate or up to date, or if an unauthorized application is made, our Company shall not be held liable for any requests arising from such incorrect information or unauthorized application.

Your applications submitted to us will be responded to in writing free of charge within a maximum of thirty days from the date your request is received by us, depending on the nature of the request, in accordance with the second paragraph of Article 13 of the KVK Law.