Legal

PERSONAL DATA PROCESSING AND PROTECTION POLICY

Majorca Tiffany Yapı Ürünleri Tic. A.Ş. (“Majorca Ceramiche” or the “Company”) shows utmost sensitivity regarding the processing of personal data in accordance with the applicable legislation, as well as the protection of confidentiality and security. Majorca Ceramiche processes personal data within the limits mandated by the Law on the Protection of Personal Data No. 6698 (“Law” or “KVKK”), secondary regulations, and the binding decisions of the Personal Data Protection Board. This Policy has been drafted for the purposes of fulfilling the disclosure obligation stipulated under Article 10 of the Law in the capacity of Data Controller, and ensuring transparent information to data subjects regarding their rights under Article 11 of the Law.

This Policy covers all personal data processed fully or partially by automated means, or by non-automated means provided that such data forms part of any data recording system, belonging to employees, employee candidates, reference persons, supplier employees, supplier representatives, customers, and other third parties of Majorca Ceramiche. This Policy provides general information on all stages of the personal data processing procedures. For each specific personal data processing activity, separate Privacy Notices are prepared and data subjects are informed accordingly. The processed categories of personal data, the purposes of processing, the methods and legal grounds for collection, and the third parties to whom such data is transferred are specified in the Privacy Notices prepared specifically for each category of data subject.

1. PROCESSING OF PERSONAL DATA

Majorca Ceramiche adopts the following principles as its working guidelines to ensure the lawful processing and protection of personal data in accordance with Article 20 of the Constitution, KVKK No. 6698, secondary regulations, and relevant Board decisions.

1.1. General Principles

Personal data may be processed by Majorca Ceramiche in accordance with the principles listed in Article 4 of the Law and the procedures stipulated in other relevant legislation.

• Compliance with law and principle of good faith: Majorca Ceramiche processes personal data to the minimum extent necessary, taking into account the reasonable expectations of data subjects and without deviating from the declared processing purposes. The Company ensures transparency and fulfills its disclosure obligations.
• Accuracy and being up to date: Majorca Ceramiche ensures that personal data is accurate and up to date, and updates such data when necessary.
• Specific, explicit, and legitimate purposes: Personal data is processed for specific, clear, and legitimate purposes. Majorca Ceramiche does not process personal data for purposes other than those declared to the data subject.
• Relevant, limited, and proportionate processing: Majorca Ceramiche limits personal data processing to what is adequate, relevant, and necessary for achieving the declared purposes and avoids processing unnecessary data.
• Retention for the required period: In accordance with Article 138 of the Turkish Penal Code and Articles 4 and 7 of KVKK, Majorca Ceramiche retains personal data only for the duration stipulated in relevant legislation or only for the period required for the purpose of processing. When the lawful retention period expires or upon the request of the data subject, personal data is deleted, destroyed, or anonymized using methods determined by Majorca Ceramiche.

1.2. Method of Collecting Personal Data

Personal data may be collected by automated or non-automated means, including physical visits, camera recordings, call recordings, communication with our business units, verbal communication, physical delivery, contracts, forms, email, KEP, fax, telephone, website, and similar tools in verbal, written, or electronic form. Personal data may be processed as long as you benefit from the services of Majorca Ceramiche and may be updated when required to ensure accuracy.

1.3. Legal Grounds for Processing Personal Data

As per Article 5/1 of the Law, personal data cannot be processed without the **explicit consent** of the data subject. Explicit consent must be informed and freely given.

However, under Article 5/2, personal data may be processed without explicit consent if one of the following applies:

• Explicitly provided for by law.
• Consent cannot be obtained due to physical impossibility or lack of legal capacity.
• Direct relevance to the establishment or performance of a contract.
• Processing is required for the data controller to fulfill its legal obligations.
• Data has been made public by the data subject.
• Processing is necessary for the establishment, exercise, or protection of a right.
• Processing is necessary for the legitimate interests of the data controller, provided that it does not violate the fundamental rights and freedoms of the data subject.

1.4. Processing of Special Categories of Personal Data

Special categories of personal data include: race, ethnic origin, political opinion, philosophical belief, religion, sect, appearance, association/foundation/union membership, health, sexual life, criminal convictions and security measures, biometric and genetic data.

Processing of such data is prohibited unless:

• a) Explicit consent is obtained,
• b) Explicitly permitted by law,
• c) Consent cannot be obtained due to physical impossibility and processing is necessary for life/physical integrity,
• ç) Data is made public by the data subject,
• d) Processing is required for the establishment, exercise, or protection of a right,
• e) Processing by persons under confidentiality obligation for medical/planning purposes,
• f) Required for employment, OHS, social security, social services,
• g) Processing by non-profit organizations regarding their members.

Adequate safeguards determined by the Board must also be implemented.

1.5. Categories of Processed Personal Data

Majorca Ceramiche may process data categories such as:

• identity,
• contact,
• personnel file,
• legal transaction,
• customer transaction,
• transaction security,
• risk management,
• finance,
• marketing,
• professional experience,
• visual/audio records,
• physical security,
• health information,
• criminal convictions and security measures.

1.6. Data Subjects

Data subjects include:

• Employees,
• employee candidates,
• interns,
• reference persons,
• supplier employees,
• supplier representatives,
• customers, and
• other third parties.

1.7. Purposes of Processing

Personal data may be processed within the scope of Articles 5 and 6 for the purposes required by the Company’s operations.

---

2. TRANSFER OF PERSONAL DATA

Personal data may be transferred in accordance with Articles 8 and 9 of the Law to:

• Tax Authority,
• Social Security Institution,
• Legally authorized public or private institutions,
• Service providers (training, accounting, legal firms such as OSGB, CPA, Law Offices),
• Independent audit firms,
• Banks (for payments),
• Insurance companies (BES payments),
• IT service providers,
• Suppliers,
• Business partners, group companies.

Transfers are conducted in a limited, relevant, and proportionate manner.

---

3. ENSURING SECURITY AND CONFIDENTIALITY OF PERSONAL DATA

Under the Constitution Article 20, individuals have the right to protection of personal data. Majorca Ceramiche takes all necessary technical and administrative measures to prevent unlawful processing, unlawful access, and ensure secure storage of data.

---

4. MANAGEMENT OF PROCESSES FOR DATA PROTECTION

The Company:

• provides KVKK training to employees,
• establishes internal KVKK policies,
• assigns responsible personnel,
• conducts audits,
• implements updates in accordance with legislation and Board decisions.

---

5. RETENTION AND DESTRUCTION OF PERSONAL DATA

Personal data is stored for the required legal period or for the period necessary for processing. At the end of this period or upon request, data is **deleted, destroyed, or anonymized** using approved methods.

---

6. INFORMATION OF DATA SUBJECTS

Separate **Privacy Notices** are issued for specific processes (Employee, Candidate, Customer, etc.). Data subjects are informed about:

• processed data categories,
• purpose of processing,
• legal ground and collection method,
• third-party recipients,
• rights under the Law.

---

7. RIGHTS OF DATA SUBJECTS AND EXERCISE OF RIGHTS

7.1. Rights of Data Subjects

You may:

• Learn whether your personal data is processed,
• Request information if processed,
• Learn purpose and whether used accordingly,
• Learn third-party recipients,
• Request correction of incomplete/incorrect data,
• Request deletion/destruction under the Law,
• Object to automated processing results,
• Request compensation in case of damage.

7.2. Exercise of Rights

Requests may be submitted via the **Data Subject Application Form** to:

• Address: Söke Organize Sanayi Bölgesi Mah. Sokak No:1 Söke/Aydın
• Email: info@majorcaceramiche.com

Applications must include:

• Name, surname, signature,
• ID number (or passport number for foreigners),
• Address for notification,
• Email/phone/fax (if applicable),
• Subject of request.

Applications made by third parties require a **notarized power of attorney**. Requests are answered within **30 days**. Fees may apply per Board tariff.

7.3. Circumstances for Rejection

Requests may be rejected under Article 28 when:

• Processing relates to personal activities,
• Data is anonymized for statistical purposes,
• Processing relates to artistic/scientific expression without violating rights,
• Processing by authorized state institutions for security purposes,
• Processing by judiciary for investigation/prosecution.

Additionally, Articles 10, 11 (except compensation), and 16 do not apply when:

• Processing is necessary to prevent crime,
• Data is made public by the data subject,
• Processing by authorized institutions for inspection/regulation,
• Processing is necessary for economic/fiscal interests of the state.

---

8. ENFORCEMENT AND EXECUTION OF THE POLICY

This Policy enters into force on its **publication date**. Majorca Ceramiche reserves the right to update the Policy as required by legislation. Updates enter into force upon publication. If inconsistent with legislation, the legislation prevails.

---

ANNEX: DEFINITIONS

• Personal Data: Any information relating to an identified or identifiable natural person.
• Special Categories of Personal Data: Race, ethnic origin, political opinion, philosophical belief, religion, sect, appearance, association/foundation/union membership, health, sexual life, criminal convictions, security measures, biometric/genetic data.
• Explicit Consent: Consent that is informed, freely given, and specific.
• Data Controller: The natural/legal person determining purposes and means of processing.
• Data Subject: The individual whose personal data is processed.
• Contact Person: Person responsible for communication with the Authority.
• Processing: Any operation performed on data.
• Data Recording System: System where data is structured according to criteria.
• Anonymization: Rendering data unidentifiable even when combined with other data.
• Board: Personal Data Protection Board.
• Authority: Personal Data Protection Authority.
• Data Processor: Person processing data on behalf of the controller.