Personal Data Protection

1. INTRODUCTION

Under the Constitution of the Republic of Turkey, everyone has the right to request the protection of their personal data. This right includes the right to be informed about personal data concerning oneself, to access such data, to request its correction or deletion, and to learn whether it is being used in accordance with its intended purposes.

To ensure the exercise of this constitutional right, the Law on the Protection of Personal Data No. 6698 (“KVKK”) was enacted to regulate the protection of individuals’ fundamental rights and freedoms in the processing of personal data, as well as the procedures and principles that natural and legal persons processing personal data must comply with. ENTEGRE PROJE YÖNETİM DANIŞMANLIK MÜHENDİSLİK TİCARET A.Ş. (“Entegre Project Management”) exercises due diligence regarding compliance with the KVKK and has established this compliance as a corporate culture and policy through this Personal Data Protection and Processing Policy (“Policy”).

The scope of this Policy covers the protection by Entegre Project Management of personal data belonging to Job Applicants, Entegre Project Management Shareholders, Visitors, Employees of Organizations We Collaborate With, Customers, and Third Parties (Guarantors, Victims/Right Holders, etc.). Activities related to the protection of our employees’ personal data are managed in accordance with the provisions of the “Policy on the Processing of Personal Data of Entegre Project Management Employees,” which was drafted in line with the principles set forth in this Policy.

2. PURPOSE

The purpose of this Policy is to provide explanations regarding the personal data processing activities conducted by Entegre Project Management in compliance with the Personal Data Protection Law (KVKK) and the principles adopted for the protection of personal data. In this context; the aim is to inform individuals whose personal data is processed by Entegre Project Management—including, but not limited to, Job Applicants, Entegre Project Management Shareholders, Visitors, Employees of Partner Organizations, Customers, and Third Parties with legitimate interests—and to ensure full transparency throughout the process.

3. SCOPE

Within the scope of this Policy, data subjects whose personal data is processed are categorized as follows:

With regard to the processing of Entegre Project Management employees' personal data—whether fully or partially automated, or processed by non-automated means provided it forms part of a data recording system—the “Policy on the Processing of Entegre Project Management Employees’ Personal Data” has been established separately from this Policy.

4. DEFINITIONS

The definitions used in this Policy are as follows:

5. GENERAL PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA

Pursuant to Article 3 of the Personal Data Protection Law (KVKK); any operation performed on personal data—such as the collection, recording, storage, retention, modification, reorganization, disclosure, transfer, acquisition, making available, classification, or restriction of use—whether fully or partially automated or carried out by non-automated means as part of a data recording system, falls within the scope of the processing of personal data.

In the processing of personal data by Entegre Project Management, compliance with the following fundamental principles set forth in Article 4 of the Law is mandatory:

Compliance with the Law and Principles of Good Faith

Entegre Project Management conducts its personal data processing activities in compliance with the Constitution, the Personal Data Protection Law (KVKK), relevant legislation, and the principles of good faith.

Accuracy and, Where Necessary, Timeliness

During the processing of personal data, Entegre Project Management takes all necessary administrative and technical measures to ensure the accuracy and timeliness of the data. In this context, data subjects are given the opportunity to update their information.

Processing for Specific, Clear, and Legitimate Purposes

Entegre Project Management clearly defines the purpose of the data processing activity in a specific, clear, and legitimate manner before commencing such processing.

Processing That Is Relevant, Limited, and Proportionate to the Purpose

Personal data is processed only to the extent necessary to achieve the specified purposes. Data processing is not conducted based on the notion that “it might be needed in the future” (for storage purposes).

Retention for the Period Specified by Applicable Legislation or Necessary for the Purpose of Processing

Entegre Project Management retains personal data for the period specified in applicable legislation, if any, or for the period required by the purpose of processing, if no such period is specified. At the end of this period, the data is deleted, destroyed, or anonymized.

6. PROCESSING OF PERSONAL DATA

Entegre Project Management conducts its processing activities involving personal data and special category personal data in full compliance with the data processing conditions set forth in Articles 5 and 6 of the Personal Data Protection Law (KVKK).

6.1 CONDITIONS FOR THE PROCESSING OF PERSONAL DATA

Entegre Project Management does not process personal data without the explicit consent of the data subject. However, in accordance with Article 5 of the KVKK, the processing of personal data without explicit consent is permitted if one of the following conditions is met:

• Explicit provision in laws: The processing of data is directly provided for in relevant laws.
• Actual impossibility: It is necessary to protect the life or physical integrity of a person who is unable to express consent or whose consent is not legally valid.
• Conclusion or performance of a contract: Where the processing of personal data belonging to the parties is necessary for the conclusion or performance of a contract, provided that such processing is directly related to the contract.
• Legal obligation: Where data processing is necessary for Entegre Project Management to fulfill its legal obligations.
• Disclosure: The data subject has disclosed their personal data to the public themselves.
• Establishment, exercise, or protection of a right: Data processing is necessary for the establishment or protection of a right.
• Legitimate interest: Data processing is necessary for the legitimate interests of Entegre Project Management, provided that it does not infringe upon the data subject’s fundamental rights and freedoms.

6.2 PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA

For this data, which carries a risk of discrimination if processed unlawfully, Entegre Project Management acts in accordance with Article 6 of the Personal Data Protection Law (KVKK). Special category personal data (excluding data related to health and sexual life) may be processed without explicit consent in cases provided for by law. Data related to health and sexual life, however, may only be processed by authorized institutions for limited purposes such as the protection of public health, medical diagnosis, and treatment. E Project Management meticulously implements the additional security measures determined by the Board during this process.

6.3 CATEGORIZATION OF PERSONAL DATA PROCESSED BY ENTEGRE PROJECT

7. ENSURING THE SECURITY AND CONFIDENTIALITY OF PERSONAL DATA

Entegre Project Management, in accordance with Article 12 of the Personal Data Protection Law (KVKK), takes all necessary technical and administrative measures to ensure that the personal data it processes is handled and stored in compliance with the law and to prevent unauthorized access to such data.

The relevant unit at Entegre Project Management, which assumes the role of corporate compliance, is responsible for coordinating the adequate and effective execution of activities under the KVKK as a whole, in accordance with this Policy. Within this scope, the aforementioned unit is responsible for:

• Monitoring the implementation of this Policy, updating it as necessary, and submitting it to the Board of Directors for approval,
• Developing other policies and procedures related to the protection and destruction of personal data in coordination with the relevant units,
• Assigning the necessary responsibilities for the implementation of the policies and procedures and submitting them to senior management for approval,
• To monitor the implementation of technical and administrative measures taken in accordance with Article 12 of the Law and to plan audits thereof,
• To track requests and inquiries from data subjects and coordinate their resolution,
• Identify the necessary requirements for compliance with the Personal Data Protection Law (KVKK) and related legislation and oversee their implementation,
• Is authorized and responsible for managing relations with the Personal Data Protection Board (the Board).

7.1 TECHNICAL MEASURES

All necessary technical security measures have been implemented to protect personal data, ensuring an adequate level of protection against potential risks. The primary measures are as follows:

• Periodic authorization and access controls are applied to systems that provide access to data within the Entegre Project Management framework.
• The technical measures taken are periodically audited as part of risk management, internal control, and internal audit processes, independently of operational activities.
• Personnel with sufficient expertise in data security and information systems are employed.

7.2 ADMINISTRATIVE MEASURES TAKEN

• Training and Awareness: All employees receive regular training and are made aware of KVKK compliance and the protection of personal data.
• Contract Management: In cases involving data transfers, protocols and confidentiality agreements that include data security obligations are signed with the counterparties.
• Corporate Discipline: Implementation rules have been established for each business unit, and the continuity of these rules is ensured through internal company procedures.
• Access Restrictions: Internal authorizations are structured so that employees can access only the data they need based on their job descriptions (need-to-know principle).

7.3 MEASURES TO BE TAKEN IN THE EVENT OF A DATA BREACH

In the event that processed personal data is obtained by others through unlawful means (data breach), a Data Breach Response Plan and internal procedures have been developed to ensure that this situation is reported to the Personal Data Protection Board as soon as possible and no later than 72 hours. If the breach poses a risk to the individuals concerned, data subjects are also notified through appropriate methods.

8. PURPOSES OF PROCESSING PERSONAL DATA AND RETENTION PERIODS

8.1 PURPOSES OF PROCESSING PERSONAL DATA

At Entegre Project Management, personal data is processed within the framework of the conditions for processing personal data specified in Articles 5 and 6 of the Personal Data Protection Law (KVKK), for the purposes listed below:

• Management of Operational Processes: Planning and execution of business operations, our business relationships, contract processes, and human resources processes.
• Contract and Supply Chain Management: Management of relationships and business processes within the scope of contracts entered into with partner organizations and/or suppliers.
• Customer Relations: Ensuring that our products and services are provided to our customers in the most appropriate manner, and evaluating and resolving customer requests and complaints.
• Legal and Regulatory Compliance: Fulfilling obligations arising from corporate law and other relevant legislation; providing information to authorized institutions and organizations as required by law.
• Audit and Security: Conducting audit and internal control processes to ensure that activities are carried out in accordance with Entegre Project Management procedures and applicable laws; maintaining visitor logs and monitoring physical premises security.
• Marketing and Development: Executing processes related to marketing activities and planning corporate sustainability initiatives.
• Human Resources: Conducting processes related to job candidates (application, interview, evaluation) and establishing employment contracts.

8.2 RETENTION PERIODS FOR PERSONAL DATA

Entegre Project Management determines whether relevant legislation specifies a retention period for personal data and acts in accordance with Article 138 of the Turkish Penal Code and Articles 4 and 7 of the Personal Data Protection Law (KVKK).

• If a Retention Period Is Specified by Law: Personal data is retained for the period specified in the relevant law or regulation (e.g., statute of limitations, retention periods for commercial records, etc.).
• If No Retention Period Is Specified by Law: Personal data is retained only for as long as necessary to fulfill the purpose of processing.

9. DELETION, DESTRUCTION, AND ANONYMIZATION OF PERSONAL DATA

When the purpose of processing personal data has ended and the retention periods established by applicable legislation and Entegre Project Management have expired, personal data is deleted, destroyed, or anonymized upon the data subject’s request or by Entegre Project Management on its own initiative.

The procedures and principles regarding this process are carried out in accordance with the provisions of the Personal Data Protection Law (KVKK) and the “Regulation on the Deletion, Destruction, or Anonymization of Personal Data.”

9.1 TECHNIQUES FOR THE DELETION AND DESTRUCTION OF PERSONAL DATA

Personal data must be destroyed using methods appropriate to the storage media on which it is held. While technical details are outlined in the company’s “Personal Data Retention and Destruction Policy”, the primary methods used are as follows:

Physical Destruction

This involves the irreversible destruction of data stored on physical data storage systems—such as paper or optical/magnetic media—using methods like burning, shredding, or melting, ensuring the data cannot be recovered.

Secure Deletion/Destruction via Software

This involves deleting data stored in digital environments using relevant software in such a way that it cannot be recovered by anyone, including authorized users.

Secure Deletion/Destruction by Experts

Entegre Project Management may seek external professional support to ensure data is permanently and irreversibly deleted in situations requiring technical expertise. In such cases, the data is destroyed by experts using secure methods.

9.2 ANONYMIZATION TECHNIQUES

Anonymization is the process of rendering personal data such that it cannot be associated with any identifiable or identifiable natural person under any circumstances, even if matched with other data.

Pursuant to Article 28 of the KVKK, anonymized data may be processed for purposes such as research, planning, and statistics. Since this data falls outside the scope of the KVKK, the data subject’s explicit consent is not required, and the rights outlined in Section 12 of the Policy cannot be asserted with respect to this data. The primary techniques used by Entegre Project Management are as follows:

Masking

This involves removing the key identifying information from personal data (e.g., masking part of a Turkish ID number with asterisks) from the dataset.

Aggregation

This involves removing personal identifiers from the data and converting it into statistical summaries (e.g., recording “total number of customers in Region X” instead of individual names).

Data Derivation

This involves creating a more general representation of the data’s content (e.g., recording only “Age Range” instead of a specific date of birth).

Data Scrambling (Adding Noise)

This involves scrambling the values within the dataset to sever the link between the data and actual individuals.

10. THIRD PARTIES TO WHOM PERSONAL DATA IS TRANSFERRED AND THE PURPOSES OF SUCH TRANSFERS

The procedures and principles to be followed in the transfer of personal data are regulated in Articles 8 and 9 of the KVKK. Entegre Project Management may share personal data with third parties in order to perform its services, primarily in accordance with the provisions of Law No. 1774 on Identity Reporting, Law No. 6502 on the Protection of Consumers, and other relevant legislation.

Personal data may be transferred to third parties under Article 8 of the KVKK without the data subject’s explicit consent, provided that the conditions for data processing specified in Articles 5 and 6 of the KVKK are met. In cases where explicit consent is required, such consent is obtained separately from the data subject. Details regarding the transfer processes are defined in the internal “Data Transfer and Sharing Procedure”.

10.1 DOMESTIC TRANSFER

In accordance with Article 8 of the KVKK, the domestic transfer of personal data is permitted provided that at least one of the conditions specified in Section 6.1 of this Policy (Conditions for the Processing of Personal Data) is met.

10.2 TRANSFER ABROAD

In accordance with Article 9 of the KVKK; for the transfer of personal data abroad, in addition to the conditions for domestic transfer, one of the following criteria must be met:

• Adequacy Decision: The country, sector, or international organization to which the transfer will be made must be among those designated by the Board as “Adequate Protection” as announced by the Board.
• Appropriate Safeguards: In cases where no adequacy decision exists, personal data may be transferred abroad through the signing of standard contracts determined by the Board between data controllers and data processors, the application of Binding Corporate Rules (BCR), or the provision of appropriate safeguards.
• Exceptional Cases: The existence of the data subject’s explicit consent or other exceptional (temporary/one-time) circumstances listed in the Law.

10.3 CATEGORIES OF RECIPIENTS TO WHOM PERSONAL DATA IS TRANSFERRED

Entegre Project Management may transfer personal data covered by this Policy to the following categories of recipients, within the scope of the specified purposes:

11. INFORMATION DISCLOSURE OBLIGATION AND DATA SUBJECT RIGHTS

11.1 OUR COMPANY’S OBLIGATION TO PROVIDE INFORMATION

Entegre Project Management informs data subjects at the time of collecting personal data in accordance with Article 10 of the Personal Data Protection Law (KVKK). Within this scope, the following information is provided through our privacy notices:

• The name of Entegre Project Management as the data controller,
• The purposes for which personal data will be processed,
• To whom and for what purposes the processed data may be transferred,
• The method and legal basis for data collection,
• The data subject’s rights under Article 11 of the KVKK.

11.2 DATA SUBJECTS’ RIGHTS (RIGHT TO SUBMIT A REQUEST)

Pursuant to Article 11 of the KVKK, you may exercise the following rights by submitting a request to Entegre Project Management:

• To learn whether your personal data is being processed,
• To request information regarding such processing if it has occurred,
• To learn the purpose of processing and whether the data is being used in accordance with that purpose,
• To know the third parties to whom your personal data has been transferred, whether within or outside the country,
• To request the correction of your personal data if it has been processed incompletely or incorrectly,
• To request the erasure or destruction of your personal data under Article 7 of the KVKK,
• To request that third parties to whom your data has been transferred be notified of any corrections, erasures, or destruction,
• To object to a decision made solely through automated processing that adversely affects you,
• To request compensation for any damages you may have suffered due to unlawful processing.

11.3 APPLICATION PROCEDURES AND CHANNELS

You may submit your requests by filling out the “Data Subject Request Form” available on our website using the following methods:

• Hand-Signed Request: By sending a signed copy of the form in person or through a notary to the address “Barbaros Mah. Çiğdem Sok. Ağaoğlu My Office No: 1 / 36, 34734 Ataşehir/Istanbul.”
• Electronically Signed Request: By signing the form with a “secure electronic signature” as defined under the Electronic Signature Law No. 5070 and sending it via email to info@epy.com.

Important Note: Entegre Project Management may request additional information or identity verification to confirm that the person submitting the request is the “data subject.”

11.4 RESPONSE TIMEFRAME AND PROCEDURE

Entegre Project Management will process requests free of charge as soon as possible and no later than 30 (thirty) days, depending on the nature of the request. However, if the process incurs additional costs, a fee based on the tariff determined by the Board may be charged.

Data subjects’ requests may not be fulfilled in cases falling under the exceptions listed in Article 28 of the KVKK.

12. DATA PROCESSING ACTIVITIES IN SPECIFIC AREAS

12.1 VISITORS TO PHYSICAL PREMISES (Visitor Entries and Exits)

For visitors to the Entegre Project Management campus, data such as first and last names and entry and exit times are processed to ensure building security and comply with legal obligations. Visual data captured by security cameras in these areas is also recorded for security purposes.

12.2 WEBSITE VISITORS (Cookies)

The cookies used on our website are classified as essential cookies, performance/analytics cookies, and marketing cookies. Except for essential cookies, users’ explicit consent is required for all other cookies, and users may change their cookie preferences at any time. Detailed information is available in the “Cookie Policy” on our website.

Contact

To use your rights under the Personal Data Protection Law, you can download or fill out the application form.

Prepared in accordance with Law No. 6698 on the Protection of Personal Data.