Law on the Protection of Personal Data

At Stark Company, we attach great importance to the confidentiality and security of your personal data.

In this context, it is our priority to process and store in accordance with the Law on the Protection of Personal Data No. 6698 (“KVKK”) all kinds of personal data belonging to every individual associated with Stark Company, including our customers and business partners who benefit from our products and services. In our capacity as “Data Controller” under KVKK and being fully aware of this responsibility, we would like to inform you as follows about the purposes of processing your personal data, the methods and reasons for collecting your data, your rights regarding the processing of your personal data, and the procedures and principles for exercising those rights.

a. What is Personal Data? Which Personal Data Do We Collect?

Personal data refers to any information that can be associated with you, including personal details pertaining to your identity (such as name, surname, Turkish ID number, etc.), as well as your address and telephone information, vehicle and license plate details, marital status information, IP address, bank account information, etc. (“Personal Data”). Its special category, Sensitive Personal Data, refers to the sensitive types of personal data such as your race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and attire, union, foundation or association membership, health, sexual life, criminal convictions, security measures-related data, as well as your biometric and genetic data (“Sensitive Personal Data”). The explanations provided on this page regarding your Personal Data also cover your Sensitive Personal Data.

Accordingly, as Stark Company, when necessary and in compliance with KVKK, we collect Personal Data from our customers, business partners, employees, job applicants, users of our platforms (web/mobile sites and applications), visitors, and from the authorized persons and employees of institutions with which we have subcontracting or similar business relationships. The Personal Data we collect can be detailed as follows:

• Identity Data: Data relating to personal identity, such as name, surname, Turkish ID number, and photocopy of the identity card collected from our customers, business partners, employees, job applicants, users of our platforms (web/mobile sites and applications), visitors, and from the authorized persons and employees of institutions with which we have subcontracting or similar business relationships.
• Contact Data: Data that enables communication, such as telephone number, address, email address, and IP address, collected from our customers, business partners, employees, job applicants, users of our platforms (web/mobile sites and applications), visitors, and from the authorized persons and employees of institutions with which we have subcontracting or similar business relationships.
• Family Member Data: Data concerning the family members and relatives of the relevant person, collected from our employees, job applicants, and from the authorized persons and employees of institutions with which we have subcontracting or similar business relationships, in accordance with the relevant legislation and/or to protect the legal and other interests of our Company or the relevant person.
• Financial Data: Data such as salary, wage information, and bank account details collected from our employees, job applicants, customers, business partners, and from the authorized persons and employees of institutions with which we have subcontracting or similar business relationships, based on the legal relationship established between our Company and the data subject.
• Employment Data: Any personal data collected from our employees, job applicants, and from the employees of institutions with which we have subcontracting or similar business relationships that forms the basis for the establishment of the employment rights of individuals working with our Company.
• Physical Premises Security Data: Personal data such as security and camera recordings obtained during entry to and while staying within a physical premises, collected from our customers, business partners, employees, job applicants, visitors, and from the authorized persons and employees of institutions with which we have subcontracting or similar business relationships.
• Communication and Complaint Management Data: Personal data obtained from our customers, business partners, users of our platforms (web/mobile sites and applications), visitors, and from the authorized persons and employees of institutions with which we have subcontracting or similar business relationships during the receipt and evaluation of any type of request or complaint directed to our Company.
• Sensitive Personal Data: Data such as health information as specified in Article 6 of KVKK, biometric data (voice and image recordings), and information regarding religion and membership in associations or unions, collected from our customers, business partners, employees, job applicants, visitors, and from the authorized persons and employees of institutions with which we have subcontracting or similar business relationships.
• Other Data: Data processed for technical transaction security, purchase information, cookies, and other data collected automatically by various means from our customers, business partners, employees, job applicants, users of our platforms (web/mobile sites and applications), and from the authorized persons and employees of institutions with which we have subcontracting or similar business relationships.

b. By Which Methods and on What Legal Grounds Do We Collect / Process Your Personal Data?

We collect your Personal Data for the main purposes and by the methods outlined below—and possibly through additional channels in the future—by both automatic and non-automatic means, and in oral, verbal, written, or electronic form.

We collect your Personal Data through our internet and mobile platforms (web/mobile sites and applications), via our social media accounts operated on behalf of Stark Company across various social media platforms, through our call center managed by Stark Company, via email, SMS, or multimedia messages (MMS) including other communication methods, through contracts, commercial offers, printed and electronic forms, business cards and other documents provided by you during customer visits conducted within the scope of Stark Company’s sales and marketing activities, via third parties such as Stark Company group companies, business partners, dealers and sales channels, manufacturing companies or companies that supply services/products, and through various channels—including sources such as the Trade Registry—in a manner that may be completely or partially automated or not part of any data registration system, either orally, in writing, or electronically.

Based on the above methods, we process the Personal Data we collect on one or several of the legal grounds specified below:

• Your explicit consent,
• The provisions of laws and regulations currently in force in the Republic of Turkey permitting processing,
• If it is not possible to obtain your consent due to practical impossibility and processing is necessary for the protection of your or another person’s life or physical integrity,
• It being necessary for the performance of the contract we have entered into with you or your company,
• It being necessary for the fulfillment of our legal obligations to process your Personal Data,
• Your Personal Data having been made public by you,
• It being necessary for Stark Company to exercise or protect our legal or contractual rights,
• It being necessary for our legitimate interests, provided that such processing does not harm your fundamental rights and freedoms.

As Stark Company, we store all Personal Data that we process in accordance with the retention periods mandated by KVKK and other applicable legislation, and in any case, we safeguard it with all necessary administrative and technical measures as long as the aforementioned legitimate purposes persist.

c. For What Purposes Do We Process Your Personal Data?

We process the Personal Data we collect, according to its nature, for the following general purposes:

1. To fulfill the requirements of contracts entered into by Stark Company, to provide, produce, sell, deliver, and install the products and services offered, to develop these products and services, to carry out the necessary work and evaluations so that you can benefit from them, and to provide after-sales maintenance and repair services;
2. To monitor and fulfill the obligations arising from consumer legislation and to respond to consumer inquiries;
3. To track, evaluate, and provide support services for the requests and complaints of relevant persons such as customers and consumers, to manage consumer satisfaction, and to conduct planning, statistical analyses, and satisfaction surveys within this scope;
4. To carry out quality evaluation and improvement studies in order to deliver better and more reliable products and services and to ensure sustainability, including the monitoring of suppliers, subcontractors, and other business-related parties;
5. To conduct advertising and marketing activities related to the products and services offered by Stark Company, including promotion, campaigns, offers, events, and similar matters, and to provide information regarding new products and services, as well as to conduct corporate communication activities;
6. To carry out marketing and CRM (Customer Relationship Management) activities;
7. To organize corporate communications and related events and invitations, to provide information about them, and to conduct market research;
8. To improve the digital platforms we provide to customers, consumers, and business partners, and to extract statistics such as the number, type, frequency of visits, behavior, geographical locations, and similar data of platform users, so as to offer personalized content, campaigns, and advertisements based on the interests and needs of users of our platforms (web and mobile sites and applications); and to use cookies for this purpose;
9. To ensure the legal and commercial security of persons in a business relationship with Stark Company (for example, by planning administrative operations regarding communication conducted by our Company, ensuring and monitoring the physical security of Company-owned locations, evaluating and auditing business partners/customers/suppliers (authorized persons or employees), and managing legal compliance processes);
10. To exercise legal rights and to use information regarding the processing history as evidence in the event of a dispute after the termination of the legal relationship;
11. To determine and implement Stark Company’s commercial, legal, and business strategies;
12. To carry out Stark Company’s human resources and accounting/finance policies;
13. To plan, audit, and execute information security processes;
14. To ensure compliance with domestic and international legislation, to obtain information requested by public institutions, and to fulfill reporting obligations.

d. Transfer of Personal Data and Processing of Personal Data by Third Parties

The Company may transfer personal data to a third party, whether a natural or legal person, in accordance with KVKK regulations. In such cases, the Company ensures that the third parties to whom the data is transferred also comply with this Policy. Accordingly, the necessary protective provisions are incorporated into the contracts entered into with the third parties.

• Transfer of personal data to third parties located in Turkey: Personal Data may be transferred by the Company to third parties located in Turkey without obtaining explicit consent in the exceptional cases specified in KVKK Article 5.2 and Article 6.3, or otherwise with the explicit consent of the data subject (in accordance with KVKK Articles 5.1 and 6.2).
• Transfer of personal data to third parties located abroad: Personal Data may be transferred by the Company to third parties located abroad without obtaining explicit consent in the exceptional cases specified in KVKK Article 5.2 and Article 6.3, or otherwise with the explicit consent of the data subject (in accordance with KVKK Articles 5.1 and 6.2). However, with respect to the foreign country to which the transfer is made, one of the following conditions must be met:
• The foreign country to which the personal data is transferred must be classified by the Authority as a country with adequate protection;
• If the foreign country is not included in the Authority’s list of safe countries, the Company and the Data Controllers in that country must provide a written commitment to ensure sufficient protection and obtain permission from the Authority.

e. Your Rights and the Application Procedure

e.1. Your Rights Regarding Your Personal Data

We would like to inform you that you have the following rights regarding the data processed within Stark Company and its affiliates:

1. The right to learn whether your Personal Data has been processed,
2. The right to obtain information if your Personal Data is being processed,
3. The right to know the purpose of the processing of your Personal Data and whether your Personal Data is being used in accordance with that purpose,
4. The right to learn who the third parties are—domestically or abroad—to whom your data has been transferred, and which data has been transferred, if applicable,
5. The right to request the correction of your processed Personal Data if it is incomplete or incorrect,
6. The right to request that, in the event of correction, deletion, or destruction of your Personal Data, such actions be communicated to the third parties to whom your Personal Data has been transferred,
7. The right to request the deletion or destruction of your processed Personal Data if the reasons necessitating its processing cease to exist or if your Personal Data becomes outdated,
8. The right to object to any decision based solely on automated processing that produces an adverse result for you,
9. The right to claim compensation in the event that you suffer damages due to the unlawful processing of your Personal Data.

e.2. Application

You can submit your requests regarding your Personal Data by filling out the application form provided in the link below:

1. It may be delivered to our consultation office at the company address indicated in the Data Controller Identity Information section, or served by a notary to the same address,
2. Or it can be submitted via registered email.

Stark Company will resolve the requests submitted to it free of charge, as soon as possible and no later than 30 (thirty) days from the date your request is received. Should any cost arise from the fulfillment of your request, we may only charge you the fees determined by the Personal Data Protection Authority’s tariff.

Following the submission of your request, Stark Company may either accept the request or reject it with an explanation, and we may communicate our response in writing or electronically to the applicant. In the event that the request is accepted, Stark Company is immediately obliged to fulfill it.

e.3. Complaint

If Stark Company rejects your request, if you are not satisfied with the response provided, or if no response is given, you may lodge a complaint with the Personal Data Protection Authority within 30 (thirty) days from the date on which the response was communicated to you, or, if no response is given, within 30 days following the end of the 30-day period.

f. Data Controller Identity Information

The term “Stark Company” used in this text has been prepared for the Stark Company affiliate established in Turkey, with the details provided below, and is addressed to the individuals whose data is processed by the company specified below as the Data Controller:

Stark Company

Telephone: +90 544 557 50 97

Application Form under KVKK

Under the Law on the Protection of Personal Data No. 6698 (“KVK Law”), personal data subjects—hereinafter referred to as “Applicant”—are granted certain rights to make requests regarding the processing of their personal data under Article 11 of the KVK Law. In accordance with the first paragraph of Article 13 of the KVK Law, applications regarding these rights must be submitted to our Company, as the Data Controller, in person, in written Turkish, and via the following methods determined by the Personal Data Protection Authority (“Authority”).

Below is the information regarding how written applications should be delivered to us.

In accordance with the Communiqué on the Application Procedures and Principles for the Data Controller (dated 10/03/2018 and numbered 30356 R.G.), the following information is required to be included in the applications.

Information to be Provided During the Application:

• Name, surname and, if the application is in writing, signature,
• For Turkish citizens, the Turkish ID number; for foreigners, their nationality, passport number or, if available, identification number,
• The residence or work address that serves as the basis for notification,
• If applicable, the email address, telephone, and fax number for notifications,
• The subject of the request

Additionally, information and documents related to the subject should be attached to the application.

If you wish to make an application regarding your personal data, you are required to completely fill out the application form provided below. This application form has been prepared to ascertain your relationship with our Company, to fully identify any personal data processed by our Company, and to ensure that your application is answered correctly and within the legally prescribed time limit. In order to mitigate the legal risks that may arise from the unlawful and unjust sharing of data, and particularly to ensure the security of your personal data, our Company reserves the right to request additional documents and information (such as a copy of your identity card or driver’s license) for the purposes of verifying your identity and authority. Our Company shall not be held liable for any claims arising from incorrect information or unauthorized applications submitted in connection with your requests as provided in this form.

Your applications submitted to us will be answered in writing free of charge within no later than thirty days from the date your request is received, in accordance with the second paragraph of Article 13 of the KVK Law, depending on the nature of the request.