EKAS DESIGN PRIVACY AND PERSONAL DATA PROTECTION POLICY

Personal data protection is a priority for EKAS DESIGN. As a data controller, Ekas Design adopts the principles stipulated by the Law on the Protection of Personal Data No. 6698 (“LPPD”) and fulfills its obligations regarding the processing, deletion, destruction, anonymization, and transfer of personal data, as well as providing necessary notifications to the relevant persons and ensuring data security.

This Privacy and Personal Data Protection Policy is made available to natural persons whose personal data is processed (“Data Subject”).

1. Scope and Purpose of the Policy

This Privacy and Personal Data Protection Policy explains:

• Methods and legal grounds for collecting personal data,

• Which groups of persons’ data are processed (Data Subject Categorization),

• Which categories of personal data are processed (Data Categories) and sample data types,

• In which business processes and for what purposes this data is used,

• Technical and administrative measures taken to ensure data security,

• To whom and for what purpose personal data may be transferred,

• Retention periods for personal data,

• Rights of Data Subjects and how they can exercise these rights.

2. Methods of Collecting Personal Data and Legal Grounds

Ekas Design collects personal data electronically or in writing via the website, forms, notifications from administrative and judicial authorities, and other communication channels, in accordance with the processing conditions specified in the LPPD.

3. Data Categories and Sample Data Types

4. Purpose of Processing Personal Data

Personal data is processed for purposes including, but not limited to:

• Carrying out marketing and promotional activities (with explicit consent),

• Resolving customer complaints and managing service appointments,

• Executing accounting, invoicing, and purchasing processes,

• Ensuring compliance with legal regulations and responding to requests from judicial authorities,

• Evaluating job applications and managing recruitment,

• Ensuring information security and preventing malicious use.

5. Technical and Administrative Measures for Data Security

Ekas Design undertakes to take all necessary measures to ensure the confidentiality, integrity, and security of your personal data.

• SSL Encryption: All areas of the website where personal data is received are protected by SSL (Secure Socket Layer) encryption.

• Access Control: Access authorization matrices are implemented to prevent unauthorized access.

• Physical Security: Data in paper format is kept in locked cabinets accessible only by authorized personnel.

• Breach Notification: In case of a data breach despite security measures, Ekas Design will immediately notify the Data Subject and the Personal Data Protection Board.

6. Retention and Destruction of Data

Ekas Design retains personal data for the periods stipulated by law or required by the purpose of processing.

• Accounting/Financial Records: 10 years.

• Online Traffic Data: 2 years (Law No. 5651).

• Customer/Supplier Data: 10 years following the end of the legal relationship.

Upon expiration of these periods, data will be deleted, destroyed, or anonymized in accordance with the Regulation on Deletion, Destruction, or Anonymization of Personal Data.

7. Rights of the Data Subject (Article 11 of LPPD)

As a Data Subject, you have the right to:

1. Learn whether your personal data is being processed,

2. Request information if your data has been processed,

3. Learn the purpose of the processing and whether it is used accordingly,

4. Know the third parties to whom data is transferred (locally or abroad),

5. Request correction of incomplete or inaccurate data,

6. Request the deletion or destruction of data under the conditions of the Law,

7. Object to results derived exclusively from automated systems,

8. Claim compensation for damages arising from unlawful processing.