BOLÇİ ÇİKOLATA ANONİM ŞİRKETİ

PERSONAL DATA PROTECTION CLARIFICATION TEXT

This Clarification Text has been prepared, as stipulated in Article 10 of the Personal Data Protection Law No. 6698, and in line with the principles of superior service quality and transparency adopted by our Company, in order to inform you about the purposes for which your personal data will be processed, to whom and for what purposes your processed personal data may be transferred, our methods of collecting personal data and the legal grounds thereof, and your rights as a data subject.

IDENTITY OF THE DATA CONTROLLER

Pursuant to the Personal Data Protection Law No. 6698 (the “Law”), your personal data is collected and processed by Bolçi Çikolata Anonim Şirketi (the “Company”) in its capacity as data controller, through the purposes and methods explained below.

1. Purposes for Which Personal Data Will Be Processed

By the COMPANY;

Of job applicants,
- information in the identity category;
  - Conducting the selection and placement processes for job applicants / interns / students,
  - Conducting the application processes of job applicants,
  - Conducting communication activities
  - Planning human resources processes,
  - Conducting / auditing business activities
  - Conducting activities to ensure business continuity
  - for the purposes of conducting contract processes
- information in the contact category;
  - Conducting the selection and placement processes for job applicants / interns / students,
  - Conducting the application processes of job applicants,
  - Conducting communication activities
  - Planning human resources processes,
  - Conducting / auditing business activities
  - Conducting activities to ensure business continuity
  - for the purposes of conducting contract processes
- information in the personnel records category;
  - Conducting the selection and placement processes for job applicants / interns / students,
  - Conducting the application processes of job applicants,
  - Planning human resources processes,
  - Conducting / auditing business activities
  - Conducting activities to ensure business continuity
  - for the purposes of conducting contract processes
- information in the physical space security category;
  - Ensuring physical space security,
  - Following up and conducting legal affairs,
  - Conducting the selection and placement processes for job applicants / interns / students,
  - Conducting the application processes of job applicants,
  - for the purposes of conducting occupational health / safety activities
- information in the professional experience category;
  - Conducting the selection and placement processes for job applicants / interns / students,
  - Conducting the application processes of job applicants,
  - Planning human resources processes,
  - Conducting / auditing business activities
  - Conducting activities to ensure business continuity
  - for the purposes of conducting contract processes,
- information in the visual and audio records category;
  - Conducting the selection and placement processes for job applicants / interns / students,
  - Conducting the application processes of job applicants,
  - for the purposes of ensuring the security of the data controller’s operations
- information in the health data category;
  - Conducting the selection and placement processes for job applicants / interns / students,
  - Conducting the application processes of job applicants,
  - Conducting / auditing business activities
  - Conducting occupational health / safety activities,
  - Conducting activities to ensure business continuity
  - for the purposes of conducting contract processes
- information in the criminal convictions and security measures category;
  - Conducting the selection and placement processes for job applicants / interns / students,
  - Conducting the application processes of job applicants,
  - Planning human resources processes,
  - Conducting / auditing business activities,
  - Conducting activities to ensure business continuity,
  - for the purposes of conducting contract processes
Of employees,
- information in the identity category;
  - Conducting information security processes,
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting fringe benefits and entitlements processes for employees,
  - Conducting audit / ethics activities,
  - Conducting training activities,
  - Managing access authorisations,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Ensuring physical space security,
  - Following up and conducting legal affairs,
  - Conducting communication activities,
  - Planning human resources processes,
  - Conducting / auditing business activities,
  - Conducting occupational health / safety activities,
  - Conducting activities to ensure business continuity,
  - Conducting logistics activities,
  - Conducting goods / services production and operation processes,
  - Conducting performance evaluation processes,
  - Conducting storage and archiving activities,
  - Conducting contract processes,
  - Ensuring the security of movable property and resources,
  - Ensuring the security of the data controller’s operations,
  - Providing information to authorised persons, institutions and organisations,
  - for the purposes of conducting management activities
- information in the contact category;
  - Conducting information security processes,
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting fringe benefits and entitlements processes for employees,
  - Managing access authorisations,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Following up and conducting legal affairs,
  - Conducting communication activities,
  - Planning human resources processes,
  - Conducting / auditing business activities,
  - Conducting occupational health / safety activities,
  - Conducting activities to ensure business continuity,
  - Conducting storage and archiving activities,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the location category;
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting audit / ethics activities,
  - Conducting activities in compliance with the legislation,
  - Conducting assignment processes,
  - Conducting internal audit / investigation / intelligence activities,
  - Conducting communication activities,
  - Conducting / auditing business activities,
  - Conducting occupational health / safety activities,
  - Conducting logistics activities,
  - Conducting after-sales support services for goods / services,
  - Conducting goods / services sales processes,
  - Conducting customer relationship management processes,
  - Conducting activities aimed at customer satisfaction,
  - Conducting performance evaluation processes,
  - Following up requests / complaints,
  - Ensuring the security of movable property and resources,
  - Ensuring the security of the data controller’s operations,
  - Providing information to authorised persons, institutions and organisations,
- information in the personnel records category;
  - Conducting information security processes,
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting fringe benefits and entitlements processes for employees,
  - Conducting audit / ethics activities,
  - Conducting training activities,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Ensuring physical space security,
  - Conducting assignment processes,
  - Following up and conducting legal affairs,
  - Conducting communication activities,
  - Planning human resources processes,
  - Conducting / auditing business activities,
  - Conducting occupational health and safety activities,
  - Conducting activities to ensure business continuity,
  - Conducting logistics activities,
  - Conducting performance evaluation processes,
  - Conducting storage and archiving activities,
  - Ensuring the security of movable property and resources,
  - Ensuring the security of the data controller’s operations,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the legal proceedings category;
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting audit / ethics activities,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Following up and conducting legal affairs,
  - Conducting internal audit / investigation / intelligence activities,
  - Conducting activities to ensure business continuity,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the physical space security category;
  - Conducting emergency management processes,
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting audit / ethics activities,
  - Ensuring physical space security,
  - Following up and conducting legal affairs,
  - Conducting / auditing business activities,
  - Conducting occupational health / safety activities,
  - Conducting performance evaluation processes,
  - for the purposes of following up the provision of information to authorised persons, institutions and organisations
- information in the transaction security category;

Conducting information security processes,
Conducting audit / ethics activities,
Managing access authorisations,
- Conducting internal audit / investigation / intelligence activities,
- Conducting / auditing business activities,
- Ensuring the security of the data controller’s operations,
- for the purposes of providing information to authorised persons, institutions and organisations
- information in the finance category;
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting fringe benefits and entitlements processes for employees,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Following up and conducting legal affairs,
  - Conducting / auditing business activities
  - Conducting storage and archiving activities,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the professional experience category;
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting fringe benefits and entitlements processes for employees
  - Conducting activities in compliance with the legislation,
  - Conducting assignment processes
  - Conducting / auditing business activities
  - Conducting occupational health / safety activities
  - Receiving and evaluating suggestions for the improvement of business processes,
  - Implementing the remuneration policy,
  - Ensuring the security of the data controller’s operations,
  - Conducting talent / career development activities,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the visual and audio records category;
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting audit / ethics activities,
  - Conducting assignment processes,
  - Conducting internal audit / investigation / intelligence activities,
  - Conducting storage and archiving activities,
  - Ensuring the security of the data controller’s operations,
  - for the purposes of providing information to authorised persons, institutions and organisations,
- information in the philosophical belief, religion, sect and other beliefs category;
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Following up and conducting legal affairs,
  - for the purposes of conducting storage and archiving activities
- information in the health data category;
  - Conducting emergency management processes
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting fringe benefits and entitlements processes for employees,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Conducting assignment processes,
  - Following up and conducting legal affairs,
  - Planning human resources processes,
  - Conducting and auditing business activities,
  - Conducting occupational health and safety activities,
  - Conducting activities to ensure business continuity,
  - Conducting goods / services production and operation processes,
  - Conducting performance evaluation processes,
  - Ensuring the security of the data controller’s operations,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the criminal convictions and security measures category;
  - Conducting the selection and placement processes for job applicants / interns / students,
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting activities in compliance with the legislation,
  - Following up and conducting legal affairs
  - for the purpose of conducting activities to ensure business continuity

Of shareholders/partners,
- information in the identity category;
  - Conducting emergency management processes,
  - Managing access authorisations,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Conducting communication activities,
  - Conducting supply chain management processes,
  - Providing information to authorised persons, institutions and organisations,
  - for the purposes of conducting management activities
- information in the contact category;

Conducting emergency management processes,
Managing access authorisations,
Conducting activities in compliance with the legislation,
Conducting finance and accounting affairs,
Conducting communication activities,
Conducting supply chain management processes,
Providing information to authorised persons, institutions and organisations,
for the purposes of conducting management activities
- information in the personnel records category;
  - for the purposes of conducting activities in compliance with the legislation,
- information in the legal proceedings category;
  - Conducting activities in compliance with the legislation
  - Following up and conducting legal affairs,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the transaction security category;

Conducting information security processes,
Conducting audit / ethics activities,
Managing access authorisations,
- Conducting internal audit / investigation / intelligence activities,
- Conducting / auditing business activities,
- Ensuring the security of the data controller’s operations,
- for the purposes of providing information to authorised persons, institutions and organisations
- information in the finance category;
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Following up and conducting legal affairs,
  - Conducting / auditing business activities
  - Conducting storage and archiving activities,
  - Providing information to authorised persons, institutions and organisations,
  - for the purposes of conducting management activities,
- information in the visual and audio records category;
  - Conducting storage and archiving activities,
  - Ensuring the security of the data controller’s operations,
  - for the purposes of providing information to authorised persons, institutions and organisations,
- information in the philosophical belief, religion, sect and other beliefs category;
  - Following up and conducting legal affairs,
  - Conducting storage and archiving activities,
  - Ensuring the security of the data controller’s operations,
  - for the purposes of conducting management activities,
- information in the health data category;
  - Conducting emergency management processes
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Conducting and auditing business activities,
  - Conducting occupational health and safety activities,
  - Conducting activities to ensure business continuity,
  - Ensuring the security of the data controller’s operations,
  - Providing information to authorised persons, institutions and organisations,
  - for the purposes of conducting management activities,

Of potential purchasers of products or services,
- information in the identity category;
  - Conducting communication activities,
  - Conducting goods / services sales processes,
  - Conducting customer relationship management processes,
  - Conducting activities aimed at customer satisfaction,
  - Conducting marketing analysis studies,
  - Conducting advertising / campaign / promotion processes,
  - Conducting contract processes,
  - Following up requests / complaints,
  - Conducting the marketing processes of products / services,
  - for the purposes of ensuring the security of the data controller’s operations
- information in the contact category;
  - Conducting communication activities,
  - Conducting goods / services sales processes,
  - Conducting customer relationship management processes,
  - Conducting activities aimed at customer satisfaction,
  - Conducting marketing analysis studies,
  - Conducting advertising / campaign / promotion processes,
  - Conducting contract processes,
  - Following up requests / complaints,
  - Ensuring the security of movable property and resources,
  - Conducting the marketing processes of products / services,
  - for the purposes of ensuring the security of the data controller’s operations
- information in the physical space security category;
  - Ensuring physical space security,
  - Following up and conducting legal affairs,
  - Conducting and auditing business activities,
  - Providing information to authorised persons, institutions and organisations,
  - for the purposes of conducting occupational health / safety activities
- information in the transaction security category;
  - Conducting information security processes,
  - Managing access authorisations,
  - Conducting internal audit / investigation / intelligence activities,
  - Conducting / auditing business activities,
  - Conducting goods / services sales processes,
  - Conducting customer relationship management processes,
  - Conducting marketing analysis studies,
  - Conducting advertising / campaign / promotion processes,
  - Conducting contract processes,
  - Conducting strategic planning activities,
  - Following up requests / complaints,
  - for the purposes of ensuring the security of the data controller’s operations
- information in the marketing category;
  - Managing access authorisations,
  - Conducting loyalty processes towards the company / products / services,
  - Receiving and evaluating suggestions for the improvement of business processes,
  - Conducting goods / services sales processes,
  - Conducting customer relationship management processes,
  - Conducting activities aimed at customer satisfaction,
  - Conducting marketing analysis studies,
  - Conducting advertising / campaign / promotion processes,
  - Conducting contract processes,
  - Conducting strategic planning activities,
  - Following up requests / complaints,
  - for the purposes of conducting the marketing processes of products / services
Of interns,
- information in the identity category;
  - Conducting information security processes,
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting fringe benefits and entitlements processes for employees,
  - Conducting audit / ethics activities,
  - Conducting training activities,
  - Managing access authorisations,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Ensuring physical space security,
  - Following up and conducting legal affairs,
  - Conducting communication activities,
  - Planning human resources processes,
  - Conducting / auditing business activities,
  - Conducting occupational health / safety activities,
  - Conducting activities to ensure business continuity,
  - Conducting logistics activities,
  - Conducting goods / services production and operation processes,
  - Conducting performance evaluation processes,
  - Conducting storage and archiving activities,
  - Conducting contract processes,
  - Ensuring the security of movable property and resources,
  - Ensuring the security of the data controller’s operations,
  - Providing information to authorised persons, institutions and organisations,
  - for the purposes of conducting management activities
- information in the contact category;
  - Conducting information security processes,
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting fringe benefits and entitlements processes for employees,
  - Managing access authorisations,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Following up and conducting legal affairs,
  - Conducting communication activities,
  - Planning human resources processes,
  - Conducting / auditing business activities,
  - Conducting occupational health / safety activities,
  - Conducting activities to ensure business continuity,
  - Conducting storage and archiving activities,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the location category;
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting audit / ethics activities,
  - Conducting activities in compliance with the legislation,
  - Conducting assignment processes,
  - Conducting internal audit / investigation / intelligence activities,
  - Conducting communication activities,
  - Conducting / auditing business activities,
  - Conducting occupational health / safety activities,
  - Conducting logistics activities,
  - Conducting after-sales support services for goods / services,
  - Conducting goods / services sales processes,
  - Conducting customer relationship management processes,
  - Conducting activities aimed at customer satisfaction,
  - Conducting performance evaluation processes,
  - Following up requests / complaints,
  - Ensuring the security of movable property and resources,
  - Ensuring the security of the data controller’s operations,
  - Providing information to authorised persons, institutions and organisations,
- information in the personnel records category;
  - Conducting information security processes,
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting fringe benefits and entitlements processes for employees,
  - Conducting audit / ethics activities,
  - Conducting training activities,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Ensuring physical space security,
  - Conducting assignment processes,
  - Following up and conducting legal affairs,
  - Conducting communication activities,
  - Planning human resources processes,
  - Conducting / auditing business activities,
  - Conducting occupational health and safety activities,
  - Conducting activities to ensure business continuity,
  - Conducting logistics activities,
  - Conducting performance evaluation processes,
  - Conducting storage and archiving activities,
  - Ensuring the security of movable property and resources,
  - Ensuring the security of the data controller’s operations,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the legal proceedings category;
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting audit / ethics activities,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Following up and conducting legal affairs,
  - Conducting internal audit / investigation / intelligence activities,
  - Conducting activities to ensure business continuity,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the physical space security category;
  - Conducting emergency management processes,
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting audit / ethics activities,
  - Ensuring physical space security,
  - Following up and conducting legal affairs,
  - Conducting / auditing business activities,
  - Conducting occupational health / safety activities,
  - Conducting performance evaluation processes,
  - for the purposes of following up the provision of information to authorised persons, institutions and organisations
- information in the transaction security category;

Conducting information security processes,
Conducting audit / ethics activities,
Managing access authorisations,
- Conducting internal audit / investigation / intelligence activities,
- Conducting / auditing business activities,
- Ensuring the security of the data controller’s operations,
- for the purposes of providing information to authorised persons, institutions and organisations
- information in the finance category;
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting fringe benefits and entitlements processes for employees,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Following up and conducting legal affairs,
  - Conducting / auditing business activities
  - Conducting storage and archiving activities,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the professional experience category;
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting fringe benefits and entitlements processes for employees
  - Conducting activities in compliance with the legislation,
  - Conducting assignment processes
  - Conducting / auditing business activities
  - Conducting occupational health / safety activities
  - Receiving and evaluating suggestions for the improvement of business processes,
  - Implementing the remuneration policy,
  - Ensuring the security of the data controller’s operations,
  - Conducting talent / career development activities,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the visual and audio records category;
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting audit / ethics activities,
  - Conducting assignment processes,
  - Conducting internal audit / investigation / intelligence activities,
  - Conducting storage and archiving activities,
  - Ensuring the security of the data controller’s operations,
  - for the purposes of providing information to authorised persons, institutions and organisations,
- information in the philosophical belief, religion, sect and other beliefs category;
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Following up and conducting legal affairs,
  - for the purposes of conducting storage and archiving activities
- information in the health data category;
  - Conducting emergency management processes
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting fringe benefits and entitlements processes for employees,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Conducting assignment processes,
  - Following up and conducting legal affairs,
  - Planning human resources processes,
  - Conducting and auditing business activities,
  - Conducting occupational health and safety activities,
  - Conducting activities to ensure business continuity,
  - Conducting goods / services production and operation processes,
  - Conducting performance evaluation processes,
  - Ensuring the security of the data controller’s operations,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the criminal convictions and security measures category;
  - Conducting the selection and placement processes for job applicants / interns / students,
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting activities in compliance with the legislation,
  - Following up and conducting legal affairs,
  - for the purpose of conducting activities to ensure business continuity

Of supplier employees,
- information in the identity category;
  - Conducting information security processes,
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting fringe benefits and entitlements processes for employees,
  - Conducting audit / ethics activities,
  - Conducting training activities,
  - Managing access authorisations,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Ensuring physical space security,
  - Following up and conducting legal affairs,
  - Conducting communication activities,
  - Planning human resources processes,
  - Conducting / auditing business activities,
  - Conducting occupational health / safety activities,
  - Conducting activities to ensure business continuity,
  - Conducting logistics activities,
  - Conducting goods / services production and operation processes,
  - Conducting performance evaluation processes,
  - Conducting storage and archiving activities,
  - Conducting contract processes,
  - Ensuring the security of movable property and resources,
  - Ensuring the security of the data controller’s operations,
  - Providing information to authorised persons, institutions and organisations,
  - for the purposes of conducting management activities
- information in the contact category;
  - Conducting information security processes,
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting fringe benefits and entitlements processes for employees,
  - Managing access authorisations,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Following up and conducting legal affairs,
  - Conducting communication activities,
  - Planning human resources processes,
  - Conducting / auditing business activities,
  - Conducting occupational health / safety activities,
  - Conducting activities to ensure business continuity,
  - Conducting storage and archiving activities,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the personnel records category;
  - Conducting information security processes,
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting fringe benefits and entitlements processes for employees,
  - Conducting audit / ethics activities,
  - Conducting training activities,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Ensuring physical space security,
  - Conducting assignment processes,
  - Following up and conducting legal affairs,
  - Conducting communication activities,
  - Planning human resources processes,
  - Conducting / auditing business activities,
  - Conducting occupational health and safety activities,
  - Conducting activities to ensure business continuity,
  - Conducting logistics activities,
  - Conducting performance evaluation processes,
  - Conducting storage and archiving activities,
  - Ensuring the security of movable property and resources,
  - Ensuring the security of the data controller’s operations,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the legal proceedings category;
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting audit / ethics activities,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Following up and conducting legal affairs,
  - Conducting internal audit / investigation / intelligence activities,
  - Conducting activities to ensure business continuity,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the physical space security category;
  - Conducting emergency management processes,
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting audit / ethics activities,
  - Ensuring physical space security,
  - Following up and conducting legal affairs,
  - Conducting / auditing business activities,
  - Conducting occupational health / safety activities,
  - Conducting performance evaluation processes,
  - for the purposes of following up the provision of information to authorised persons, institutions and organisations
- information in the transaction security category;

Conducting information security processes,
Conducting audit / ethics activities,
Managing access authorisations,
- Conducting internal audit / investigation / intelligence activities,
- Conducting / auditing business activities,
- Ensuring the security of the data controller’s operations,
- for the purposes of providing information to authorised persons, institutions and organisations
- information in the finance category;
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting fringe benefits and entitlements processes for employees,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Following up and conducting legal affairs,
  - Conducting / auditing business activities
  - Conducting storage and archiving activities,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the professional experience category;
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting fringe benefits and entitlements processes for employees
  - Conducting activities in compliance with the legislation,
  - Conducting assignment processes
  - Conducting / auditing business activities
  - Conducting occupational health / safety activities
  - Receiving and evaluating suggestions for the improvement of business processes,
  - Implementing the remuneration policy,
  - Ensuring the security of the data controller’s operations,
  - Conducting talent / career development activities,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the visual and audio records category;
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting audit / ethics activities,
  - Conducting assignment processes,
  - Conducting internal audit / investigation / intelligence activities,
  - Conducting storage and archiving activities,
  - Ensuring the security of the data controller’s operations,
  - for the purposes of providing information to authorised persons, institutions and organisations,
- information in the philosophical belief, religion, sect and other beliefs category;
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Following up and conducting legal affairs,
  - for the purposes of conducting storage and archiving activities
- information in the health data category;
  - Conducting emergency management processes
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting fringe benefits and entitlements processes for employees,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Conducting assignment processes,
  - Following up and conducting legal affairs,
  - Planning human resources processes,
  - Conducting and auditing business activities,
  - Conducting occupational health and safety activities,
  - Conducting activities to ensure business continuity,
  - Conducting goods / services production and operation processes,
  - Conducting performance evaluation processes,
  - Ensuring the security of the data controller’s operations,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the criminal convictions and security measures category;
  - Conducting the selection and placement processes for job applicants / interns / students,
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting activities in compliance with the legislation,
  - Following up and conducting legal affairs,
  - for the purpose of conducting activities to ensure business continuity

Of supplier officials,
- information in the identity category;
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Following up and conducting legal affairs,
  - Conducting communication activities,
  - Conducting / auditing business activities,
  - Conducting occupational health / safety activities,
  - Conducting goods / services procurement processes,
  - Conducting goods / services sales processes,
  - Conducting goods / services production and operation processes,
  - Conducting contract processes,
  - Providing information to authorised persons, institutions and organisations,
  - Following up requests / complaints,
  - Ensuring the security of movable property and resources,
  - Conducting supply chain management processes,
  - Ensuring the security of the data controller’s operations,
  - for the purposes of providing information to authorised persons, institutions and organisations

information in the contact category;
- Conducting activities in compliance with the legislation,
- Conducting finance and accounting affairs,
- Following up and conducting legal affairs,
- Conducting communication activities,
- Conducting / auditing business activities,
- Conducting occupational health / safety activities,
- Conducting goods / services procurement processes,
- Conducting goods / services sales processes,
- Conducting goods / services production and operation processes,
- Conducting contract processes,
- Providing information to authorised persons, institutions and organisations,
- Following up requests / complaints,
- Ensuring the security of movable property and resources,
- Conducting supply chain management processes,
- Ensuring the security of the data controller’s operations,
- for the purposes of providing information to authorised persons, institutions and organisations
- information in the legal proceedings category;

Following up and conducting legal affairs,
Conducting contract processes,
for the purposes of providing information to authorised persons, institutions and organisations
- information in the physical space security category;
  - Ensuring physical space security,
  - Following up and conducting legal affairs,
  - Conducting and auditing business activities,
  - Conducting occupational health / safety activities,
  - for the purposes of providing information to authorised persons, institutions and organisations,
- information in the risk management category;
  - Conducting goods / services procurement processes,
  - Conducting risk management processes,
  - Conducting contract processes,
  - for the purposes of ensuring the security of the data controller’s operations,
- information in the finance category;
  - Conducting goods / services procurement processes,
  - Conducting goods / services sales processes,
  - Conducting finance and accounting affairs,
  - Conducting contract processes,
  - Ensuring the security of the data controller’s operations,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the customer transaction category;
  - Conducting finance and accounting affairs,
  - for the purposes of conducting supply chain management processes

Of natural persons purchasing products or services, or of the officials of legal entities doing so,
- information in the identity category;
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Following up and conducting legal affairs,
  - Conducting communication activities,
  - Conducting / auditing business activities,
  - Conducting goods / services procurement processes,
  - Conducting after-sales support services for goods / services,
  - Conducting goods / services sales processes,
  - Conducting customer relationship management processes,
  - Conducting activities aimed at customer satisfaction,
  - Conducting marketing analysis studies,
  - Conducting advertising / campaign / promotion processes,
  - Conducting contract processes,
  - Providing information to authorised persons, institutions and organisations,
  - Following up requests / complaints,
  - Ensuring the security of movable property and resources,
  - Conducting supply chain management processes,
  - Conducting the marketing processes of products / services,
  - Ensuring the security of the data controller’s operations,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the contact category;
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Following up and conducting legal affairs,
  - Conducting communication activities,
  - Conducting / auditing business activities,
  - Conducting goods / services procurement processes,
  - Conducting after-sales support services for goods / services,
  - Conducting goods / services sales processes,
  - Conducting customer relationship management processes,
  - Conducting activities aimed at customer satisfaction,
  - Conducting marketing analysis studies,
  - Conducting advertising / campaign / promotion processes,
  - Conducting contract processes,
  - Providing information to authorised persons, institutions and organisations,
  - Following up requests / complaints,
  - Ensuring the security of movable property and resources,
  - Conducting supply chain management processes,
  - Conducting the marketing processes of products / services,
  - Ensuring the security of the data controller’s operations,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the customer transaction category;
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Conducting goods / services sales processes,
  - Conducting marketing analysis studies,
  - Conducting contract processes,
  - Providing information to authorised persons, institutions and organisations,
  - Following up requests / complaints,
  - Conducting supply chain management processes,
  - for the purposes of ensuring the security of the data controller’s operations
- information in the physical space security category;
  - Ensuring physical space security,
  - Following up and conducting legal affairs,
  - Conducting and auditing business activities,
  - Providing information to authorised persons, institutions and organisations,
  - for the purposes of conducting occupational health / safety activities
- information in the transaction security category;
  - Conducting information security processes,
  - Managing access authorisations,
  - Conducting internal audit / investigation / intelligence activities,
  - Conducting / auditing business activities,
  - Conducting goods / services procurement processes,
  - Conducting after-sales support services for goods / services,
  - Conducting goods / services sales processes,
  - Conducting customer relationship management processes,
  - Conducting marketing analysis studies,
  - Conducting advertising / campaign / promotion processes,
  - Conducting contract processes,
  - Conducting strategic planning activities,
  - Following up requests / complaints,
  - for the purposes of ensuring the security of the data controller’s operations
- information in the risk management category;
  - Conducting goods / services sales processes,
  - Conducting goods / services production and operation processes,
  - Conducting risk management processes,
  - Conducting contract processes,
  - for the purposes of ensuring the security of the data controller’s operations,
- information in the finance category;
  - Conducting finance and accounting affairs,
  - Conducting goods / services procurement processes,
  - Conducting storage and archiving activities,
  - Conducting goods / services sales processes,
  - Conducting contract processes,
  - for the purpose of providing information to authorised persons, institutions and organisations
- information in the marketing category;
  - Managing access authorisations,
  - Conducting loyalty processes towards the company / products / services,
  - Receiving and evaluating suggestions for the improvement of business processes,
  - Conducting after-sales support services for goods / services,
  - Conducting goods / services sales processes,
  - Conducting customer relationship management processes,
  - Conducting activities aimed at customer satisfaction,
  - Conducting marketing analysis studies,
  - Conducting advertising / campaign / promotion processes,
  - Conducting contract processes,
  - Conducting strategic planning activities,
  - Following up requests / complaints,
  - for the purposes of conducting the marketing processes of products / services
- information in the customer transaction category;
  - Conducting goods / services procurement processes,
  - Conducting after-sales support services for goods / services,
  - Conducting customer relationship management processes,
  - Conducting activities aimed at customer satisfaction,
  - Conducting contract processes,
  - for the purposes of providing information to authorised persons, institutions and organisations,
Of parents/guardians/representatives,
- information in the identity category;
  - Conducting information security processes,
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Following up and conducting legal affairs,
  - Conducting communication activities,
  - Planning human resources processes,
  - Conducting / auditing business activities,
  - Conducting activities to ensure business continuity,
  - Conducting storage and archiving activities,
  - Conducting contract processes,
  - Ensuring the security of the data controller’s operations,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the contact category;
  - Conducting information security processes,
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Following up and conducting legal affairs,
  - Conducting communication activities,
  - Planning human resources processes,
  - Conducting / auditing business activities,
  - Conducting activities to ensure business continuity,
  - Conducting storage and archiving activities,
  - Conducting contract processes,
  - Ensuring the security of the data controller’s operations,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the legal proceedings category;
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Following up and conducting legal affairs,
  - Conducting activities to ensure business continuity,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the physical space security category;
  - Conducting emergency management processes,
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Ensuring physical space security,
  - Following up and conducting legal affairs,
  - Conducting / auditing business activities,
  - Conducting occupational health / safety activities,
  - for the purposes of following up the provision of information to authorised persons, institutions and organisations
- information in the transaction security category;

Conducting information security processes,
Conducting audit / ethics activities,
Managing access authorisations,
- Conducting internal audit / investigation / intelligence activities,
- Conducting / auditing business activities,
- Ensuring the security of the data controller’s operations,
- for the purposes of providing information to authorised persons, institutions and organisations
- information in the finance category;
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Conducting fringe benefits and entitlements processes for employees,
  - Conducting activities in compliance with the legislation,
  - Conducting finance and accounting affairs,
  - Following up and conducting legal affairs,
  - Conducting / auditing business activities
  - Conducting storage and archiving activities,
  - for the purposes of providing information to authorised persons, institutions and organisations
- information in the visual and audio records category;
  - Conducting internal audit / investigation / intelligence activities,
  - Conducting storage and archiving activities,
  - Ensuring the security of the data controller’s operations,
  - for the purposes of providing information to authorised persons, institutions and organisations,
- information in the philosophical belief, religion, sect and other beliefs category;
  - Fulfilling the obligations arising from the employment contract and legislation for employees,
  - Following up and conducting legal affairs,
  - for the purposes of conducting storage and archiving activities

Of visitors,

their information in the identity category;

Conducting emergency management processes,
Ensuring physical space security,
Following up and conducting legal affairs,
Conducting communication activities,
for the purposes of conducting occupational health / safety activities,
- information in the physical space security category;
  - Ensuring physical space security,
  - Following up and conducting legal affairs,
  - Conducting occupational health / safety activities,
  - Ensuring the security of the data controller’s operations,
  - for the purposes of providing information to authorised persons, institutions and organisations

Of employees’ relatives,

their information in the identity category;

Conducting emergency management processes,
Conducting communication activities,
for the purposes of conducting occupational health / safety activities,

their information in the contact category;

Conducting emergency management processes,
Conducting communication activities,
for the purposes of conducting occupational health / safety activities

their information in the physical space security category;
- Ensuring physical space security,
- Following up and conducting legal affairs,
- Conducting occupational health / safety activities,
- for the purposes of providing information to authorised persons, institutions and organisations

may be processed.

2. To Whom and For What Purposes Processed Personal Data May Be Transferred

Your personal data processed by our Company may be transferred, for the purpose of fulfilling the processing purposes set out above, to;

The Company’s business partners and shareholders,
Persons or organisations permitted under the Tax Procedure Law, Social Security Institution legislation, the Court of Accounts, the Law on the Prevention of Laundering Proceeds of Crime, the Law on the Prevention of Money Laundering, the Turkish Commercial Code, the Code of Obligations, the Consumer Protection Law No. 4077, the Electronic Communications Law No. 5809, the Law on the Regulation of Electronic Commerce and the provisions of other legislation,
Public institutions and organisations legally authorised, natural persons or private law legal entities, mediators, lawyers, and administrative and judicial authorities

Your personal data processed by our Company may also be transferred, in the course of retention, storage and transfer activities and the conduct of the Company’s commercial activities and for the purpose of fulfilling the processing purposes set out above, where an adequacy decision has been issued by the Personal Data Protection Board or a standard contract approved by the Board exists, or in the circumstances specified in Article 9, paragraph 6 of the Law, to the following parties resident abroad;

Cloud-based servers,
E-mail servers,
Support service providers,
Service providers,
Business partners,
Principals or customers,
Official institutions of foreign countries,
Trade fair, transportation or accommodation service providers.

3. Method of Collecting Personal Data and the Legal Grounds

Your personal data is,

collected in full as part of a data recording system, by automated, semi-automated and non-automated methods, directly by you or by persons authorised to act on your behalf, through applications made to our Company’s official e-mail address;

through Company personnel, institutions to which we provide / from which we receive support services, natural and / or legal persons with whom transactions are carried out under any legislation or contract, and directly through automated systems (the official e-mail channel), in verbal, written or electronic form;

based on the grounds set out in Articles 5 and 6 of the Law, namely;

It being expressly provided for by law,
It being mandatory in order for our Company to fulfil its legal obligation,
Processing being necessary and directly related to the conclusion or performance of a contract,
Processing being mandatory for the legitimate interests of our Company, provided that it does not harm your fundamental rights and freedoms,
The data having been made public by you,
Processing being mandatory for the establishment, exercise or protection of a right,
Your explicit consent being present,
Processing being mandatory for the protection of your life or bodily integrity, or that of another person, where you are unable to give consent due to actual impossibility or where your consent would not be legally valid,
Processing being mandatory for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance

on the grounds set out above.

4. Rights of Personal Data Subjects

As data subjects, if you submit your requests concerning the rights listed in Article 11 of the Law through the methods set out below, the Company will conclude your request as soon as possible and within thirty days at the latest, depending on the nature of the request. No fee will be charged for responses of up to ten pages; a processing fee of 1 Turkish Lira will be charged for each page exceeding ten pages. Where the response to the application is provided on a recording medium such as a CD or flash drive, the fee that may be charged by our Company will not exceed the cost of the recording medium.

Pursuant to Article 11 of the Law, data subjects have the right to;

Learn whether their personal data is processed,
Request information if their personal data has been processed,
Learn the purpose of processing personal data and whether it is used in accordance with its purpose,
Know the third parties in Turkey or abroad to whom personal data has been transferred,
Request the correction of personal data in the event that it has been processed incompletely or inaccurately, and request that the action taken in this regard be notified to the third parties to whom the personal data has been transferred,
Request the erasure or destruction of personal data in the event that the grounds requiring its processing cease to exist, even though it has been processed in accordance with the Law No. 6698 and other relevant legislation, and request that the action taken in this regard be notified to the third parties to whom the personal data has been transferred,
Object to the emergence of a result to their detriment through the analysis of the processed data exclusively by automated systems,
Claim compensation for damages incurred as a result of the unlawful processing of personal data,

Data subjects hold the rights listed above.

5. Application Procedure for Data Subjects

In your application;

Your name, surname and, if the application is in writing, your signature,
Your Turkish Republic identity number if you are a Turkish citizen; your nationality, passport number or identity number, if any, if you are a foreign national,
Your residential or business address for the purposes of notification,
Your e-mail address, telephone and fax number for notification purposes, if any,
The subject of your request,

the above information is MANDATORY, and any information and documents relating to the subject matter must also be attached to the application.

You may access the application form at https://www.bolci.com.tr.

Applications you wish to make in writing may be submitted, together with the required documents, to our Company as data controller at the address SUSUZKINIK KÖYÜ, SUSUZKINIK OSB MEVKİİ 1 CAD. NO: 38 MERKEZ/BOLU.
Applications you wish to make by e-mail, may be sent to the e-mail address [email protected].
Applications you wish to make via registered electronic mail (KEP), [email protected] may be sent to our KEP address.

Depending on the nature of your request, the information and documents enabling identity verification must be provided to us completely and accurately. In the event that the requested information and documents are not duly provided, disruptions may occur in carrying out the investigations to be conducted in response to your request fully and properly, and we reserve our legal rights. For this reason, your application must be sent to us complete and containing the requested information and documents, depending on the nature of your request.

You may submit your requests regarding the matters set out above, pursuant to Article 13, paragraph 1 of the Law No. 6698 and the Communiqué on the Procedures and Principles of Application to the Data Controller No. 30356 dated 10.03.2018, in Turkish and in writing, or by using a registered electronic mail (KEP) address, secure electronic signature, mobile signature, or an e-mail address previously notified to the Company and registered in our system. Only information about the applicant will be provided in applications; no information will be provided about third parties. The Company reserves the right to verify your identity before responding.