Weavers General Data Protection Regulation

Boyteks Tekstil Sanayi ve Ticaret A.Ş. (BOYTEKS Tekstil A.Ş.) takes every technical and legal precaution to protect your personal data in the processing of such data for the activities it carries out, in accordance with the Turkish Personal Data Protection Law No. 6698 (Turkish PDP Law). Concerned parties can access detailed information regarding their rights within the framework of Turkish PDP Law and the EU GDPR about processed data categories, legal basis for processing personal data, data that is transferred to third parties and the purpose of such transfers in the policy guide-lines defined below.

I. Data Controller

Boyteks Tekstil Sanayi ve Ticaret Anonim Şirketi (BOYTEKS Tekstil A.Ş.)

Mersis: 0-8000-9714-2600001

Web Address : http://www.weavers.com.tr

Telephone Number : +90 (352) 322 05 88

E-Mail : boyteks@hs02.kep.tr

Address : OSB 8.Cad. No:60 Kayseri/Turkey

II. Purpose of Processing Personal Data

Your personal data is processed by BOYTEKS Tekstil A.Ş. as the designated data controller in conformity with Articles 5 and 6 of the Turkish PDP Law for the purposes defined below:

• Upgrading, developing, diversifying our products and services, with the aim of providing alternatives to natural/legal persons with whom we have commercial relations,
• Strengthening communication and collaboration between BOYTEKS Tekstil A.Ş. and BOYDAK HOLDING, as well as BOYDAK HOLDING, with the aim of ensuring co-ordination, carrying out common areas of business, determining customer and employee requirements, fulfilling actions required by contracts, carrying out advertising and marketing activities, ensuring customer follow-up, and safe-guarding work security and operational continuity,
• Enhancing and developing our service standards,
• Defining and implementing our commercial business strategies,
• Fulfilling all activities in compliance with agreements that BOYTEKS Tekstil A.Ş. is party to, and making sure that all parties to such agreements are fulfilling their obligations,
• Protecting the legal status of all natural/legal persons with whom BOYTEKS Tekstil A.Ş. is in commercial relations with,
• Regulating commercial records, invoices, bank checks and payrolls that BOYTEKS Tekstil A.Ş. is required to keep in compliance with laws and regulations,
• Ensuring the security of employees, guests and BOYTEKS Tekstil A.Ş. buildings and controlling entrances-exits to premises,
• Evaluating the employment processes for prospective personnel, creating personnel files and carrying out BOYTEKS Tekstil A.Ş. human resources policies,
• Ensuring a high level of personnel morale and motivation, performance and satisfaction, intra-personnel and intra-company interaction, as well as company loyalty for all employees of BOYTEKS Tekstil A.Ş.,
• Providing Internet access to guests in areas of BOYTEKS Tekstil A.Ş. open to public access,
• Enabling BOYTEKS Tekstil A.Ş. to carry out its commercial purchasing procedures,
• Enabling BOYTEKS Tekstil A.Ş. to carry out its corporate communications,
• Registering visitor information for users of our website to create statistical data and provide customer care returns,
• Furthermore, to carry out the governance of our Company quality and standards, or to fulfill other responsibilities as per the valid laws and regulations.

III. Transfer of Personal Data

The personal data that we process for the purposes defined above may be transferred to the following third parties in the context of Articles 8 and 9 of the Turkish PDP Law:

• Our business partners, to ensure that our commercial activities are carried out in a consistent manner,
• Our suppliers, within the limits of providing products and services,
• Concerned public agencies and institutions, especially the Social Security Office, in order to fulfill legal responsibilities established by law and to provide for security stipulations,
• Private and public legal entities, especially banks, for the purpose of protecting the social and financial rights of personnel employed by BOYTEKS Tekstil A.Ş.,
• Legally authorized public agencies and institutions, as well as judicial organs, upon request of concerned public agencies and institutions,
• BOYDAK HOLDING and BOYDAK HOLDING Affiliates, for the purpose of establishing common databases, co-ordination and collaboration,
• Software and technology companies established in Turkey or abroad, in order to create databases, ensure program operability as well as the maintenance and repairs of such programs used by our Company and our parent company BOYDAK HOLDING,
• Cloud service provider technology companies established in Turkey or abroad, from which we procure cloud services,
• BOYDAK HOLDING and BOYDAK HOLDING Affiliates; business partners, authorized dealers and suppliers of companies affiliated with our Company or BOYDAK HOLDING in Turkey and abroad, for the purpose of customer care follow-up and meeting customer requirements,
• Companies under the parent company BOYDAK HOLDING and other companies in the related sector for organizing social and cultural events, conferences etc.,
• Employee health records may be transferred to health institutions and insurance companies which we procure services from, for the purpose of providing a healthy work environment for personnel in the context of work-place health and safety.

IV. Methods of Collecting Personal Data and Legal Basis

Your personal data is collected with your open consent, or in the legal framework of personal data processing, by BOYTEKS Tekstil A.Ş. or natural/legal persons authorized to process data on behalf of BOYTEKS Tekstil A.Ş. through the means of declarations, application forms, forms filled out on the Internet, documents required for personnel records, various contracts, all kinds of information forms, surveys, job application forms, as well as information that is spoken, written or conveyed on electronic channels through call centers.

This information is collected with the purpose of enabling BOYTEKS Tekstil A.Ş. to provide commercial and administrative services in compliance with the applicable laws, to continue its commercial vitality and ensure that the Company fulfills all the obligations defined by law in a complete and correct manner.

V. Rights of Concerned Persons According to KVKK Law

Natural persons whose personal data is being processed by BOYTEKS Tekstil A.Ş. have the following rights as per the Turkish PDP Law:

• Find out if their personal data has been processed or not,
• Request information if personal data has been processed,
• Inquire the purpose of processing their personal data and whether this information was used for the intended purpose,
• Inquire about third parties, recipients and recipient categories that their personal data has been transferred to in Turkey and abroad,
• Request the correction of personal data in the case that such data has been processed incompletely or incorrectly, and to request that all related actions are conveyed to third parties to whom data has been transferred,
• Request that personal data be deleted or destroyed, as well as request the suspension of such processing activities, if no valid reasons remain for this data to be processed, regardless of the fact that the data is being processed in conformity with the Turkish PDP Law and other related provisions of law,
• Contest a personally detrimental outcome that arises from their personal data being processed exclusively by automated systems,
• Appeal for indemnity of damages from losses that arise as a result of illegal processing of personal data.

Concerned persons can apply for requests related to these rights with a letter of notification from a public notary addressed to BOYTEKS Tekstil A.Ş. resident at OSB 8. Cad. No. 60 Kayseri, Türkiye, or in person to our company by presenting valid identification. Requests by concerned persons will be evaluated free of charge and replied to promptly or in a maximum period of thirty (30) days, when the outcome is determined. In the case that the evaluation and decision procedures require a cost to be incurred, the rates specified in the Procedures and Principles of Application to Data Controller Decree shall be applied. In the case that concerned persons are not satisfied with the response from our Company to their application, they may choose to apply to the Board of Protection of Personal Data.