Personal Data Protection Policy

For ORELSİS BİLİŞİM MAKİNE OTOMASYON SANAYİ VE TİCARET LİMİTED ŞİRKETİ ("ORELSIS" or the "Company"), protecting personal data is a core priority. We take care to protect the personal data of our customers, prospective customers, business partners, suppliers and their representatives and employees, as well as our employees, job applicants, website visitors and other third parties.

Under Article 20 of the Turkish Constitution, everyone has the right to request the protection of their personal data. This Personal Data Protection and Processing Policy (the "Policy") sets out the principles ORELSIS follows under Law No. 6698 on the Protection of Personal Data ("KVKK" or the "Law"), the amendments made by Law No. 7499 in force since 1 June 2024, secondary legislation and decisions of the Personal Data Protection Board (the "Board").

Purpose and scope

The Policy aims to ensure that all ORELSIS activities comply with personal data protection legislation and to inform, in a transparent manner, the data subjects whose personal data is processed. It covers every personal data processing activity carried out wholly or partly by automated means, or by non-automated means as part of a data filing system, and the technical and organisational measures taken in that context.

Definitions

Principles we follow

Under Article 4 of the Law, we process personal data in line with the following principles:

• Lawfulness and fairness: we respect data subjects' reasonable expectations and explain transparently how and why data is processed.
• Accuracy and, where necessary, being kept up to date: we take care to keep data accurate and up to date, and keep communication channels open for data subjects' correction requests.
• Specified, explicit and legitimate purposes: we process data only for purposes that have been disclosed, notified or agreed in a contract.
• Being relevant, limited and proportionate to the purpose: we do not process data that is unnecessary for the purpose, nor collect data for possible future needs.
• Retention only for as long as necessary: we keep data for the period laid down in legislation or required by the purpose of processing and, at the end of that period, dispose of it under the Data Retention and Disposal Policy.

Conditions for processing

As a rule, personal data is processed with the data subject's explicit consent. Under Article 5 of the Law, processing without explicit consent is also possible where one of the following conditions applies:

• It is expressly provided for by law (for example, record-keeping obligations under tax and commercial law)
• It is necessary to protect the life or physical integrity of a person who is unable to express consent due to actual impossibility
• It is directly related to the establishment or performance of a contract (for example, quotations, licence and service agreements)
• It is necessary for the data controller to fulfil its legal obligation
• The data has been made public by the data subject
• Processing is necessary for the establishment, exercise or protection of a right
• Processing is necessary for the legitimate interests of the data controller, provided that it does not harm the data subject's fundamental rights and freedoms (for example, information security and measuring service quality)

Where processing relies on explicit consent, the obligation to inform under Article 10 of the Law is fulfilled separately before consent is obtained; explicit consent is not made a condition for providing a service and may be withdrawn at any time.

Special categories of personal data

Given the nature of its business, ORELSIS does not, as a rule, process special categories of personal data, and our website forms do not ask for them. Where processing is necessary (for example, occupational health records of employees), one of the conditions listed in Article 6 of the Law as amended by Law No. 7499 must be met: explicit consent, express provision by law, actual impossibility, data having been made public, establishment, exercise or protection of a right, public health and medical services, legal obligations in employment, occupational health and safety and social security, and the other cases listed in the Law. Access to such data is restricted and the adequate measures set by the Board are applied.

Transfers within Türkiye

Under Article 8 of the Law and based on one of the processing conditions above, personal data may be transferred, in a manner limited and proportionate to the purpose, to our service providers (hosting, email, software and accounting services), business partners, group companies and legally authorised public authorities. Contracts including confidentiality and data security obligations are concluded with parties acting as data processors.

Transfers abroad

Some providers we use to host our website and deliver form submissions to us by email may have servers outside Türkiye. Cross-border transfers are carried out under Article 9 of the Law as amended by Law No. 7499 and the Regulation on the Procedures and Principles for Transferring Personal Data Abroad, in the following order:

1. 1.An adequacy decision issued by the Board for the destination country, sector or international organisation
2. 2.In the absence of an adequacy decision, appropriate safeguards such as the standard contract announced by the Board (notified to the Authority within five business days of signature), binding corporate rules, or a written undertaking approved by the Board
3. 3.Where neither exists, and only on an incidental basis, one of the exceptions in Article 9(6) of the Law (for example, the data subject's explicit consent after being informed of possible risks)

Website visitors

On orelsis.com, visitors' technical data (IP address, browser and device information, time of access) is kept in server logs for security and for obligations under Law No. 5651. Information submitted through forms is used only to respond to your request. Details are in the Disclosure Notice, Privacy Policy and Cookie Policy.

Data security

Under Article 12 of the Law, we take technical and organisational measures that ensure an appropriate level of security to prevent unlawful processing of and access to personal data and to safeguard it. These include:

• Identifying the personal data processed and the related risks, and applying measures in proportion to those risks.
• Restricting access by role on a need-to-know basis, and updating it immediately on a change of role or departure.
• Using encrypted connections (TLS) for data in transit, and applying authentication, authorisation and logging in our systems.
• Training employees regularly on data protection and information security and obtaining confidentiality undertakings.
• Keeping systems up to date and carrying out vulnerability scans and internal audits.
• If personal data is obtained by others unlawfully, notifying the Board as soon as possible and within 72 hours at the latest, and the data subjects without delay.

Erasure, destruction and anonymisation

Under Article 7 of the Law, even where personal data has been processed lawfully, it is erased, destroyed or anonymised ex officio or at the data subject's request once the reasons for processing no longer exist. Procedures and periods are set out in the Data Retention and Disposal Policy. Anonymised data falls outside the scope of the Law and may be used for purposes such as statistics.

Data subject rights

Under Article 11 of the Law, you have the right to:

• Learn whether your personal data is processed
• Request information if your personal data has been processed
• Learn the purpose for which your personal data is processed and whether it is used in line with that purpose
• Know the third parties in Türkiye or abroad to whom your personal data is transferred
• Request correction of your personal data if it has been processed incompletely or inaccurately
• Request erasure or destruction of your personal data under the conditions laid down in Article 7 of the Law
• Request that correction, erasure or destruction be notified to the third parties to whom your personal data has been transferred
• Object to any result to your detriment arising from the analysis of the processed data exclusively by automated systems
• Claim compensation if you suffer damage because your personal data was processed unlawfully

Applications

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you may submit requests regarding your rights by a written application bearing a wet-ink signature, delivered in person or through a notary public to Fikirtepe Mah. Rüzgar Sk. A1 Blok No:44A D:18, 34720 Kadıköy/İstanbul, Türkiye; or to [email protected] from your registered electronic mail (KEP) address, with a secure electronic signature or mobile signature, or from an email address that you have previously notified to us and that is registered in our system. For the information an application must contain and for the form, please see the Data Subject Application Form page.

Your applications are concluded free of charge as soon as possible, and within thirty days at the latest, depending on the nature of the request. If the response exceeds ten pages, a fee of 1 Turkish lira may be charged for each page above ten; if it is provided on a recording medium such as a CD or flash drive, the cost of that medium may be charged.

We may ask for additional information to verify that the applicant is the data subject, and ask questions to clarify the request. A person applying on behalf of the data subject must hold a special power of attorney.

Exceptions to the right to apply

Under Article 28 of the Law, the Law does not apply where personal data is processed for research, planning and statistical purposes after being anonymised through official statistics; for artistic, historical, literary or scientific purposes or within freedom of expression; within preventive activities for national defence, national security, public security or economic security; or within judicial or enforcement proceedings. In addition, in cases of criminal investigation, data made public, supervisory and disciplinary duties, and protection of the State's economic and financial interests, the rights in Article 11 cannot be exercised, except the right to claim compensation.

Updates

The Policy is updated in line with changes in law and in our activities. The current version is published on this page with its update date.