BOLÇİ ÇİKOLATA ANONİM ŞİRKETİ
PERSONAL DATA PROTECTION PRIVACY NOTICE

Document No	İK.FR.30
Publication Date	26.09.2026
Revision No	00
Revision Date	–

This Privacy Notice has been prepared, as stipulated in Article 10 of the Personal Data Protection Law No. 6698, in line with the principles of superior service quality and transparency adopted by our Company, in order to inform you about the purposes for which your personal data will be processed, to whom and for what purposes your processed personal data may be transferred, our methods of collecting personal data and the legal grounds for doing so, and your rights as a data subject.

IDENTITY OF THE DATA CONTROLLER

Pursuant to the Personal Data Protection Law No. 6698 (the “Law”), your personal data is collected and processed by Bolçi Çikolata Anonim Şirketi (the “Company”), in its capacity as data controller, for the purposes and by the methods described below.

1. Purposes for Which Personal Data Will Be Processed

The following personal data may be processed by the COMPANY for the purposes set out below:

Employee candidates:
- Identity data, for the purposes of:
  - Carrying out employee candidate / intern / student selection and placement processes
  - Carrying out application processes of employee candidates
  - Carrying out communication activities
  - Planning human resources processes
  - Carrying out / auditing business activities
  - Carrying out business continuity activities
  - Carrying out contract processes
- Contact data, for the purposes of:
  - Carrying out employee candidate / intern / student selection and placement processes
  - Carrying out application processes of employee candidates
  - Carrying out communication activities
  - Planning human resources processes
  - Carrying out / auditing business activities
  - Carrying out business continuity activities
  - Carrying out contract processes
- Personnel data, for the purposes of:
  - Carrying out employee candidate / intern / student selection and placement processes
  - Carrying out application processes of employee candidates
  - Planning human resources processes
  - Carrying out / auditing business activities
  - Carrying out business continuity activities
  - Carrying out contract processes
- Physical premises security data, for the purposes of:
  - Ensuring the security of physical premises
  - Following up and carrying out legal affairs
  - Carrying out employee candidate / intern / student selection and placement processes
  - Carrying out application processes of employee candidates
  - Carrying out occupational health and safety activities
- Professional experience data, for the purposes of:
  - Carrying out employee candidate / intern / student selection and placement processes
  - Carrying out application processes of employee candidates
  - Planning human resources processes
  - Carrying out / auditing business activities
  - Carrying out business continuity activities
  - Carrying out contract processes
- Visual and audio recording data, for the purposes of:
  - Carrying out employee candidate / intern / student selection and placement processes
  - Carrying out application processes of employee candidates
  - Ensuring the security of data controller operations
- Health data, for the purposes of:
  - Carrying out employee candidate / intern / student selection and placement processes
  - Carrying out application processes of employee candidates
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out business continuity activities
  - Carrying out contract processes
- Criminal conviction and security measures data, for the purposes of:
  - Carrying out employee candidate / intern / student selection and placement processes
  - Carrying out application processes of employee candidates
  - Planning human resources processes
  - Carrying out / auditing business activities
  - Carrying out business continuity activities
  - Carrying out contract processes
Employees:
- Identity data, for the purposes of:
  - Carrying out information security processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out fringe benefits and benefits processes for employees
  - Carrying out audit / ethics activities
  - Carrying out training activities
  - Managing access authorisations
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Ensuring the security of physical premises
  - Following up and carrying out legal affairs
  - Carrying out communication activities
  - Planning human resources processes
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out business continuity activities
  - Carrying out logistics activities
  - Carrying out goods / services production and operation processes
  - Carrying out performance evaluation processes
  - Carrying out storage and archiving activities
  - Carrying out contract processes
  - Ensuring the security of movable property and resources
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
  - Carrying out management activities
- Contact data, for the purposes of:
  - Carrying out information security processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out fringe benefits and benefits processes for employees
  - Managing access authorisations
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Following up and carrying out legal affairs
  - Carrying out communication activities
  - Planning human resources processes
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out business continuity activities
  - Carrying out storage and archiving activities
  - Providing information to authorised persons, institutions and organisations
- Location data, for the purposes of:
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out audit / ethics activities
  - Carrying out activities in compliance with legislation
  - Carrying out assignment processes
  - Carrying out internal audit / investigation / intelligence activities
  - Carrying out communication activities
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out logistics activities
  - Carrying out after-sales support services for goods / services
  - Carrying out goods / services sales processes
  - Carrying out customer relationship management processes
  - Carrying out activities aimed at customer satisfaction
  - Carrying out performance evaluation processes
  - Following up requests / complaints
  - Ensuring the security of movable property and resources
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Personnel data, for the purposes of:
  - Carrying out information security processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out fringe benefits and benefits processes for employees
  - Carrying out audit / ethics activities
  - Carrying out training activities
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Ensuring the security of physical premises
  - Carrying out assignment processes
  - Following up and carrying out legal affairs
  - Carrying out communication activities
  - Planning human resources processes
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out business continuity activities
  - Carrying out logistics activities
  - Carrying out performance evaluation processes
  - Carrying out storage and archiving activities
  - Ensuring the security of movable property and resources
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Legal transaction data, for the purposes of:
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out audit / ethics activities
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Following up and carrying out legal affairs
  - Carrying out internal audit / investigation / intelligence activities
  - Carrying out business continuity activities
  - Providing information to authorised persons, institutions and organisations
- Physical premises security data, for the purposes of:
  - Carrying out emergency management processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out audit / ethics activities
  - Ensuring the security of physical premises
  - Following up and carrying out legal affairs
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out performance evaluation processes
  - Providing information to authorised persons, institutions and organisations
- Transaction security data, for the purposes of:
  - Carrying out information security processes
  - Carrying out audit / ethics activities
  - Managing access authorisations
  - Carrying out internal audit / investigation / intelligence activities
  - Carrying out / auditing business activities
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Financial data, for the purposes of:
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out fringe benefits and benefits processes for employees
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Following up and carrying out legal affairs
  - Carrying out / auditing business activities
  - Carrying out storage and archiving activities
  - Providing information to authorised persons, institutions and organisations
- Professional experience data, for the purposes of:
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out fringe benefits and benefits processes for employees
  - Carrying out activities in compliance with legislation
  - Carrying out assignment processes
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Receiving and evaluating suggestions for improving business processes
  - Carrying out the remuneration policy
  - Ensuring the security of data controller operations
  - Carrying out talent / career development activities
  - Providing information to authorised persons, institutions and organisations
- Visual and audio recording data, for the purposes of:
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out audit / ethics activities
  - Carrying out assignment processes
  - Carrying out internal audit / investigation / intelligence activities
  - Carrying out storage and archiving activities
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Philosophical belief, religion, sect and other beliefs data, for the purposes of:
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Following up and carrying out legal affairs
  - Carrying out storage and archiving activities
- Health data, for the purposes of:
  - Carrying out emergency management processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out fringe benefits and benefits processes for employees
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Carrying out assignment processes
  - Following up and carrying out legal affairs
  - Planning human resources processes
  - Carrying out and auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out business continuity activities
  - Carrying out goods / services production and operation processes
  - Carrying out performance evaluation processes
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Criminal conviction and security measures data, for the purposes of:
  - Carrying out employee candidate / intern / student selection and placement processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out activities in compliance with legislation
  - Following up and carrying out legal affairs
  - Carrying out business continuity activities
Shareholders / partners:
- Identity data, for the purposes of:
  - Carrying out emergency management processes
  - Managing access authorisations
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Carrying out communication activities
  - Carrying out supply chain management processes
  - Providing information to authorised persons, institutions and organisations
  - Carrying out management activities
- Contact data, for the purposes of:
  - Carrying out emergency management processes
  - Managing access authorisations
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Carrying out communication activities
  - Carrying out supply chain management processes
  - Providing information to authorised persons, institutions and organisations
  - Carrying out management activities
- Personnel data, for the purposes of:
  - Carrying out activities in compliance with legislation
- Legal transaction data, for the purposes of:
  - Carrying out activities in compliance with legislation
  - Following up and carrying out legal affairs
  - Providing information to authorised persons, institutions and organisations
- Transaction security data, for the purposes of:
  - Carrying out information security processes
  - Carrying out audit / ethics activities
  - Managing access authorisations
  - Carrying out internal audit / investigation / intelligence activities
  - Carrying out / auditing business activities
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Financial data, for the purposes of:
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Following up and carrying out legal affairs
  - Carrying out / auditing business activities
  - Carrying out storage and archiving activities
  - Providing information to authorised persons, institutions and organisations
  - Carrying out management activities
- Visual and audio recording data, for the purposes of:
  - Carrying out storage and archiving activities
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Philosophical belief, religion, sect and other beliefs data, for the purposes of:
  - Following up and carrying out legal affairs
  - Carrying out storage and archiving activities
  - Ensuring the security of data controller operations
  - Carrying out management activities
- Health data, for the purposes of:
  - Carrying out emergency management processes
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Carrying out and auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out business continuity activities
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
  - Carrying out management activities
Potential buyers of products or services:
- Identity data, for the purposes of:
  - Carrying out communication activities
  - Carrying out goods / services sales processes
  - Carrying out customer relationship management processes
  - Carrying out activities aimed at customer satisfaction
  - Carrying out marketing analysis studies
  - Carrying out advertising / campaign / promotion processes
  - Carrying out contract processes
  - Following up requests / complaints
  - Carrying out marketing processes for products / services
  - Ensuring the security of data controller operations
- Contact data, for the purposes of:
  - Carrying out communication activities
  - Carrying out goods / services sales processes
  - Carrying out customer relationship management processes
  - Carrying out activities aimed at customer satisfaction
  - Carrying out marketing analysis studies
  - Carrying out advertising / campaign / promotion processes
  - Carrying out contract processes
  - Following up requests / complaints
  - Ensuring the security of movable property and resources
  - Carrying out marketing processes for products / services
  - Ensuring the security of data controller operations
- Physical premises security data, for the purposes of:
  - Ensuring the security of physical premises
  - Following up and carrying out legal affairs
  - Carrying out and auditing business activities
  - Providing information to authorised persons, institutions and organisations
  - Carrying out occupational health and safety activities
- Transaction security data, for the purposes of:
  - Carrying out information security processes
  - Managing access authorisations
  - Carrying out internal audit / investigation / intelligence activities
  - Carrying out / auditing business activities
  - Carrying out goods / services sales processes
  - Carrying out customer relationship management processes
  - Carrying out marketing analysis studies
  - Carrying out advertising / campaign / promotion processes
  - Carrying out contract processes
  - Carrying out strategic planning activities
  - Following up requests / complaints
  - Ensuring the security of data controller operations
- Marketing data, for the purposes of:
  - Managing access authorisations
  - Carrying out loyalty processes for the company / products / services
  - Receiving and evaluating suggestions for improving business processes
  - Carrying out goods / services sales processes
  - Carrying out customer relationship management processes
  - Carrying out activities aimed at customer satisfaction
  - Carrying out marketing analysis studies
  - Carrying out advertising / campaign / promotion processes
  - Carrying out contract processes
  - Carrying out strategic planning activities
  - Following up requests / complaints
  - Carrying out marketing processes for products / services
Interns:
- Identity data, for the purposes of:
  - Carrying out information security processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out fringe benefits and benefits processes for employees
  - Carrying out audit / ethics activities
  - Carrying out training activities
  - Managing access authorisations
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Ensuring the security of physical premises
  - Following up and carrying out legal affairs
  - Carrying out communication activities
  - Planning human resources processes
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out business continuity activities
  - Carrying out logistics activities
  - Carrying out goods / services production and operation processes
  - Carrying out performance evaluation processes
  - Carrying out storage and archiving activities
  - Carrying out contract processes
  - Ensuring the security of movable property and resources
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
  - Carrying out management activities
- Contact data, for the purposes of:
  - Carrying out information security processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out fringe benefits and benefits processes for employees
  - Managing access authorisations
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Following up and carrying out legal affairs
  - Carrying out communication activities
  - Planning human resources processes
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out business continuity activities
  - Carrying out storage and archiving activities
  - Providing information to authorised persons, institutions and organisations
- Location data, for the purposes of:
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out audit / ethics activities
  - Carrying out activities in compliance with legislation
  - Carrying out assignment processes
  - Carrying out internal audit / investigation / intelligence activities
  - Carrying out communication activities
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out logistics activities
  - Carrying out after-sales support services for goods / services
  - Carrying out goods / services sales processes
  - Carrying out customer relationship management processes
  - Carrying out activities aimed at customer satisfaction
  - Carrying out performance evaluation processes
  - Following up requests / complaints
  - Ensuring the security of movable property and resources
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Personnel data, for the purposes of:
  - Carrying out information security processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out fringe benefits and benefits processes for employees
  - Carrying out audit / ethics activities
  - Carrying out training activities
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Ensuring the security of physical premises
  - Carrying out assignment processes
  - Following up and carrying out legal affairs
  - Carrying out communication activities
  - Planning human resources processes
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out business continuity activities
  - Carrying out logistics activities
  - Carrying out performance evaluation processes
  - Carrying out storage and archiving activities
  - Ensuring the security of movable property and resources
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Legal transaction data, for the purposes of:
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out audit / ethics activities
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Following up and carrying out legal affairs
  - Carrying out internal audit / investigation / intelligence activities
  - Carrying out business continuity activities
  - Providing information to authorised persons, institutions and organisations
- Physical premises security data, for the purposes of:
  - Carrying out emergency management processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out audit / ethics activities
  - Ensuring the security of physical premises
  - Following up and carrying out legal affairs
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out performance evaluation processes
  - Providing information to authorised persons, institutions and organisations
- Transaction security data, for the purposes of:
  - Carrying out information security processes
  - Carrying out audit / ethics activities
  - Managing access authorisations
  - Carrying out internal audit / investigation / intelligence activities
  - Carrying out / auditing business activities
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Financial data, for the purposes of:
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out fringe benefits and benefits processes for employees
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Following up and carrying out legal affairs
  - Carrying out / auditing business activities
  - Carrying out storage and archiving activities
  - Providing information to authorised persons, institutions and organisations
- Professional experience data, for the purposes of:
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out fringe benefits and benefits processes for employees
  - Carrying out activities in compliance with legislation
  - Carrying out assignment processes
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Receiving and evaluating suggestions for improving business processes
  - Carrying out the remuneration policy
  - Ensuring the security of data controller operations
  - Carrying out talent / career development activities
  - Providing information to authorised persons, institutions and organisations
- Visual and audio recording data, for the purposes of:
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out audit / ethics activities
  - Carrying out assignment processes
  - Carrying out internal audit / investigation / intelligence activities
  - Carrying out storage and archiving activities
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Philosophical belief, religion, sect and other beliefs data, for the purposes of:
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Following up and carrying out legal affairs
  - Carrying out storage and archiving activities
- Health data, for the purposes of:
  - Carrying out emergency management processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out fringe benefits and benefits processes for employees
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Carrying out assignment processes
  - Following up and carrying out legal affairs
  - Planning human resources processes
  - Carrying out and auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out business continuity activities
  - Carrying out goods / services production and operation processes
  - Carrying out performance evaluation processes
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Criminal conviction and security measures data, for the purposes of:
  - Carrying out employee candidate / intern / student selection and placement processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out activities in compliance with legislation
  - Following up and carrying out legal affairs
  - Carrying out business continuity activities
Supplier employees:
- Identity data, for the purposes of:
  - Carrying out information security processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out fringe benefits and benefits processes for employees
  - Carrying out audit / ethics activities
  - Carrying out training activities
  - Managing access authorisations
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Ensuring the security of physical premises
  - Following up and carrying out legal affairs
  - Carrying out communication activities
  - Planning human resources processes
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out business continuity activities
  - Carrying out logistics activities
  - Carrying out goods / services production and operation processes
  - Carrying out performance evaluation processes
  - Carrying out storage and archiving activities
  - Carrying out contract processes
  - Ensuring the security of movable property and resources
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
  - Carrying out management activities
- Contact data, for the purposes of:
  - Carrying out information security processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out fringe benefits and benefits processes for employees
  - Managing access authorisations
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Following up and carrying out legal affairs
  - Carrying out communication activities
  - Planning human resources processes
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out business continuity activities
  - Carrying out storage and archiving activities
  - Providing information to authorised persons, institutions and organisations
- Personnel data, for the purposes of:
  - Carrying out information security processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out fringe benefits and benefits processes for employees
  - Carrying out audit / ethics activities
  - Carrying out training activities
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Ensuring the security of physical premises
  - Carrying out assignment processes
  - Following up and carrying out legal affairs
  - Carrying out communication activities
  - Planning human resources processes
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out business continuity activities
  - Carrying out logistics activities
  - Carrying out performance evaluation processes
  - Carrying out storage and archiving activities
  - Ensuring the security of movable property and resources
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Legal transaction data, for the purposes of:
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out audit / ethics activities
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Following up and carrying out legal affairs
  - Carrying out internal audit / investigation / intelligence activities
  - Carrying out business continuity activities
  - Providing information to authorised persons, institutions and organisations
- Physical premises security data, for the purposes of:
  - Carrying out emergency management processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out audit / ethics activities
  - Ensuring the security of physical premises
  - Following up and carrying out legal affairs
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out performance evaluation processes
  - Providing information to authorised persons, institutions and organisations
- Transaction security data, for the purposes of:
  - Carrying out information security processes
  - Carrying out audit / ethics activities
  - Managing access authorisations
  - Carrying out internal audit / investigation / intelligence activities
  - Carrying out / auditing business activities
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Financial data, for the purposes of:
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out fringe benefits and benefits processes for employees
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Following up and carrying out legal affairs
  - Carrying out / auditing business activities
  - Carrying out storage and archiving activities
  - Providing information to authorised persons, institutions and organisations
- Professional experience data, for the purposes of:
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out fringe benefits and benefits processes for employees
  - Carrying out activities in compliance with legislation
  - Carrying out assignment processes
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Receiving and evaluating suggestions for improving business processes
  - Carrying out the remuneration policy
  - Ensuring the security of data controller operations
  - Carrying out talent / career development activities
  - Providing information to authorised persons, institutions and organisations
- Visual and audio recording data, for the purposes of:
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out audit / ethics activities
  - Carrying out assignment processes
  - Carrying out internal audit / investigation / intelligence activities
  - Carrying out storage and archiving activities
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Philosophical belief, religion, sect and other beliefs data, for the purposes of:
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Following up and carrying out legal affairs
  - Carrying out storage and archiving activities
- Health data, for the purposes of:
  - Carrying out emergency management processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out fringe benefits and benefits processes for employees
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Carrying out assignment processes
  - Following up and carrying out legal affairs
  - Planning human resources processes
  - Carrying out and auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out business continuity activities
  - Carrying out goods / services production and operation processes
  - Carrying out performance evaluation processes
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Criminal conviction and security measures data, for the purposes of:
  - Carrying out employee candidate / intern / student selection and placement processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out activities in compliance with legislation
  - Following up and carrying out legal affairs
  - Carrying out business continuity activities
Supplier officials:
- Identity data, for the purposes of:
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Following up and carrying out legal affairs
  - Carrying out communication activities
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out goods / services procurement processes
  - Carrying out goods / services sales processes
  - Carrying out goods / services production and operation processes
  - Carrying out contract processes
  - Providing information to authorised persons, institutions and organisations
  - Following up requests / complaints
  - Ensuring the security of movable property and resources
  - Carrying out supply chain management processes
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Contact data, for the purposes of:
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Following up and carrying out legal affairs
  - Carrying out communication activities
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Carrying out goods / services procurement processes
  - Carrying out goods / services sales processes
  - Carrying out goods / services production and operation processes
  - Carrying out contract processes
  - Providing information to authorised persons, institutions and organisations
  - Following up requests / complaints
  - Ensuring the security of movable property and resources
  - Carrying out supply chain management processes
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Legal transaction data, for the purposes of:
  - Following up and carrying out legal affairs
  - Carrying out contract processes
  - Providing information to authorised persons, institutions and organisations
- Physical premises security data, for the purposes of:
  - Ensuring the security of physical premises
  - Following up and carrying out legal affairs
  - Carrying out and auditing business activities
  - Carrying out occupational health and safety activities
  - Providing information to authorised persons, institutions and organisations
- Risk management data, for the purposes of:
  - Carrying out goods / services procurement processes
  - Carrying out risk management processes
  - Carrying out contract processes
  - Ensuring the security of data controller operations
- Financial data, for the purposes of:
  - Carrying out goods / services procurement processes
  - Carrying out goods / services sales processes
  - Carrying out finance and accounting affairs
  - Carrying out contract processes
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Customer transaction data, for the purposes of:
  - Carrying out finance and accounting affairs
  - Carrying out supply chain management processes
Real persons purchasing products or services, or officials of legal entities purchasing products or services:
- Identity data, for the purposes of:
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Following up and carrying out legal affairs
  - Carrying out communication activities
  - Carrying out / auditing business activities
  - Carrying out goods / services procurement processes
  - Carrying out after-sales support services for goods / services
  - Carrying out goods / services sales processes
  - Carrying out customer relationship management processes
  - Carrying out activities aimed at customer satisfaction
  - Carrying out marketing analysis studies
  - Carrying out advertising / campaign / promotion processes
  - Carrying out contract processes
  - Providing information to authorised persons, institutions and organisations
  - Following up requests / complaints
  - Ensuring the security of movable property and resources
  - Carrying out supply chain management processes
  - Carrying out marketing processes for products / services
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Contact data, for the purposes of:
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Following up and carrying out legal affairs
  - Carrying out communication activities
  - Carrying out / auditing business activities
  - Carrying out goods / services procurement processes
  - Carrying out after-sales support services for goods / services
  - Carrying out goods / services sales processes
  - Carrying out customer relationship management processes
  - Carrying out activities aimed at customer satisfaction
  - Carrying out marketing analysis studies
  - Carrying out advertising / campaign / promotion processes
  - Carrying out contract processes
  - Providing information to authorised persons, institutions and organisations
  - Following up requests / complaints
  - Ensuring the security of movable property and resources
  - Carrying out supply chain management processes
  - Carrying out marketing processes for products / services
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Customer transaction data, for the purposes of:
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Carrying out goods / services sales processes
  - Carrying out marketing analysis studies
  - Carrying out contract processes
  - Providing information to authorised persons, institutions and organisations
  - Following up requests / complaints
  - Carrying out supply chain management processes
  - Ensuring the security of data controller operations
- Physical premises security data, for the purposes of:
  - Ensuring the security of physical premises
  - Following up and carrying out legal affairs
  - Carrying out and auditing business activities
  - Providing information to authorised persons, institutions and organisations
  - Carrying out occupational health and safety activities
- Transaction security data, for the purposes of:
  - Carrying out information security processes
  - Managing access authorisations
  - Carrying out internal audit / investigation / intelligence activities
  - Carrying out / auditing business activities
  - Carrying out goods / services procurement processes
  - Carrying out after-sales support services for goods / services
  - Carrying out goods / services sales processes
  - Carrying out customer relationship management processes
  - Carrying out marketing analysis studies
  - Carrying out advertising / campaign / promotion processes
  - Carrying out contract processes
  - Carrying out strategic planning activities
  - Following up requests / complaints
  - Ensuring the security of data controller operations
- Risk management data, for the purposes of:
  - Carrying out goods / services sales processes
  - Carrying out goods / services production and operation processes
  - Carrying out risk management processes
  - Carrying out contract processes
  - Ensuring the security of data controller operations
- Financial data, for the purposes of:
  - Carrying out finance and accounting affairs
  - Carrying out goods / services procurement processes
  - Carrying out storage and archiving activities
  - Carrying out goods / services sales processes
  - Carrying out contract processes
  - Providing information to authorised persons, institutions and organisations
- Marketing data, for the purposes of:
  - Managing access authorisations
  - Carrying out loyalty processes for the company / products / services
  - Receiving and evaluating suggestions for improving business processes
  - Carrying out after-sales support services for goods / services
  - Carrying out goods / services sales processes
  - Carrying out customer relationship management processes
  - Carrying out activities aimed at customer satisfaction
  - Carrying out marketing analysis studies
  - Carrying out advertising / campaign / promotion processes
  - Carrying out contract processes
  - Carrying out strategic planning activities
  - Following up requests / complaints
  - Carrying out marketing processes for products / services
- Customer transaction data, for the purposes of:
  - Carrying out goods / services procurement processes
  - Carrying out after-sales support services for goods / services
  - Carrying out customer relationship management processes
  - Carrying out activities aimed at customer satisfaction
  - Carrying out contract processes
  - Providing information to authorised persons, institutions and organisations
Parents / guardians / representatives:
- Identity data, for the purposes of:
  - Carrying out information security processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Following up and carrying out legal affairs
  - Carrying out communication activities
  - Planning human resources processes
  - Carrying out / auditing business activities
  - Carrying out business continuity activities
  - Carrying out storage and archiving activities
  - Carrying out contract processes
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Contact data, for the purposes of:
  - Carrying out information security processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Following up and carrying out legal affairs
  - Carrying out communication activities
  - Planning human resources processes
  - Carrying out / auditing business activities
  - Carrying out business continuity activities
  - Carrying out storage and archiving activities
  - Carrying out contract processes
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Legal transaction data, for the purposes of:
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Following up and carrying out legal affairs
  - Carrying out business continuity activities
  - Providing information to authorised persons, institutions and organisations
- Physical premises security data, for the purposes of:
  - Carrying out emergency management processes
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Ensuring the security of physical premises
  - Following up and carrying out legal affairs
  - Carrying out / auditing business activities
  - Carrying out occupational health and safety activities
  - Providing information to authorised persons, institutions and organisations
- Transaction security data, for the purposes of:
  - Carrying out information security processes
  - Carrying out audit / ethics activities
  - Managing access authorisations
  - Carrying out internal audit / investigation / intelligence activities
  - Carrying out / auditing business activities
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Financial data, for the purposes of:
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Carrying out fringe benefits and benefits processes for employees
  - Carrying out activities in compliance with legislation
  - Carrying out finance and accounting affairs
  - Following up and carrying out legal affairs
  - Carrying out / auditing business activities
  - Carrying out storage and archiving activities
  - Providing information to authorised persons, institutions and organisations
- Visual and audio recording data, for the purposes of:
  - Carrying out internal audit / investigation / intelligence activities
  - Carrying out storage and archiving activities
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
- Philosophical belief, religion, sect and other beliefs data, for the purposes of:
  - Fulfilling obligations arising from employment contracts and legislation for employees
  - Following up and carrying out legal affairs
  - Carrying out storage and archiving activities
Visitors:
- Identity data, for the purposes of:
  - Carrying out emergency management processes
  - Ensuring the security of physical premises
  - Following up and carrying out legal affairs
  - Carrying out communication activities
  - Carrying out occupational health and safety activities
- Physical premises security data, for the purposes of:
  - Ensuring the security of physical premises
  - Following up and carrying out legal affairs
  - Carrying out occupational health and safety activities
  - Ensuring the security of data controller operations
  - Providing information to authorised persons, institutions and organisations
Employees’ relatives:
- Identity data, for the purposes of:
  - Carrying out emergency management processes
  - Carrying out communication activities
  - Carrying out occupational health and safety activities
- Contact data, for the purposes of:
  - Carrying out emergency management processes
  - Carrying out communication activities
  - Carrying out occupational health and safety activities
- Physical premises security data, for the purposes of:
  - Ensuring the security of physical premises
  - Following up and carrying out legal affairs
  - Carrying out occupational health and safety activities
  - Providing information to authorised persons, institutions and organisations

2. To Whom and for What Purposes Processed Personal Data May Be Transferred

Your personal data processed by our Company may be transferred, for the purpose of fulfilling the processing purposes set out above, to:

The Company’s business partners and shareholders
Persons or organisations permitted by the provisions of the Tax Procedure Law, Social Security Institution legislation, the Court of Accounts, the Law on the Prevention of Laundering of Proceeds of Crime, the Law on the Prevention of Money Laundering, the Turkish Commercial Code, the Code of Obligations, Law No. 4077 on the Protection of Consumers, Electronic Communications Law No. 5809, the Law on the Regulation of Electronic Commerce and other legislation
Legally authorised public institutions and organisations, real persons or private law legal entities, mediators, lawyers, and administrative and judicial authorities

In the processes of storing, retaining and transferring your personal data processed by our Company and of carrying out the Company’s commercial activities, and for the purpose of fulfilling the processing purposes set out above, your personal data may be transferred, where there is an adequacy decision issued by the Personal Data Protection Board, where there is a standard contract approved by the Board, or in the cases specified in paragraph 6 of Article 9 of the Law, to the following recipients resident abroad:

Cloud-based servers
E-mail servers
Support service providers
Service providers
Business partners
Employers or customers
Official institutions of foreign countries
Trade fair, transportation or accommodation service providers

3. Method and Legal Grounds for Collecting Personal Data

Your personal data is collected:

through applications made to our company’s official e-mail address, by automatic, semi-automatic and non-automatic means that are all part of a data recording system, directly by you or by persons authorised to act on your behalf;

verbally, in writing or electronically through Company personnel, institutions to which we provide or from which we receive support services, real and / or legal persons with whom we transact under any legislation or contract, and directly through automated systems (the official e-mail channel);

on the basis of the following legal grounds set out in Articles 5 and 6 of the Law:

It is expressly provided for by law
It is necessary for our Company to fulfil its legal obligations
Processing is necessary, provided that it is directly related to the establishment or performance of a contract
Processing is necessary for the legitimate interests of our Company, provided that it does not harm your fundamental rights and freedoms
It has been made public by you
Processing is necessary for the establishment, exercise or protection of a right
Your explicit consent has been obtained
It is necessary to protect the life or physical integrity of yourself or another person, where you are unable to give your consent due to actual impossibility or where your consent is not legally valid
It is necessary to fulfil legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance

4. Rights of Personal Data Subjects

As personal data subjects, if you submit your requests regarding your rights listed in Article 11 of the Law using the methods set out below, the Company will conclude your request as soon as possible and within thirty days at the latest, depending on the nature of the request. No fee will be charged for responses of up to ten pages; a processing fee of 1 Turkish Lira will be charged for each page exceeding ten pages. If the response to the application is provided on a recording medium such as a CD or flash drive, the fee that may be requested by our Company will not exceed the cost of the recording medium.

Under Article 11 of the Law, data subjects have the right to:

Learn whether their personal data is being processed
Request information if their personal data has been processed
Learn the purpose of processing their personal data and whether it is used in accordance with that purpose
Know the third parties to whom their personal data is transferred, domestically or abroad
Request the rectification of personal data if it has been processed incompletely or inaccurately, and request that the action taken in this regard be notified to the third parties to whom the personal data has been transferred
Request the erasure or destruction of personal data if the reasons requiring its processing no longer exist, even though it has been processed in accordance with Law No. 6698 and other relevant laws, and request that the action taken in this regard be notified to the third parties to whom the personal data has been transferred
Object to a result arising against them through the analysis of the processed data exclusively by automated systems
Request compensation for damages if they suffer damage due to the unlawful processing of their personal data

5. Data Subject Application Procedure

Your application must include:

Your name, surname and, if the application is in writing, your signature
Your T.R. identity number if you are a citizen of the Republic of Türkiye, or, if you are a foreign national, your nationality, passport number or identity number, if any
Your residential or business address for notification purposes
Your e-mail address, telephone and fax number for notification purposes, if any
The subject of your request

The above information is MANDATORY, and any information and documents relating to the matter, if any, must also be attached to the application.

You can access the application form at https://www.bolci.com.tr.

Applications you wish to submit in writing may be delivered, together with the necessary documents, to the address of our Company, the data controller, at Organize Sanayi Bölgesi 1. Cadde No:38 Merkez/Bolu, Türkiye.
Applications you wish to submit by e-mail may be sent to [email protected].
Applications you wish to submit via KEP (Registered Electronic Mail) may be sent to our KEP address [email protected].

Depending on the nature of your request, information and documents enabling your identity to be verified must be provided to us completely and accurately. If the requested information and documents are not duly provided, there may be shortcomings in carrying out the research into your request fully and properly, and we reserve our legal rights. Therefore, your application must be sent to us completely and must contain the requested information and documents in line with the nature of your request.

You may submit your requests regarding the matters above, pursuant to paragraph 1 of Article 13 of Law No. 6698 and the Communiqué on the Procedures and Principles for Applications to the Data Controller, published in Official Gazette No. 30356 dated 10.03.2018, in Turkish and in writing, or by using a registered electronic mail (KEP) address, a secure electronic signature, a mobile signature, or an e-mail address previously notified to the Company and registered in our system. Applications will only provide information about the applicant; no information will be given about third parties. The Company reserves the right to verify your identity before responding.

Personal Data Protection Law

BOLÇİ ÇİKOLATA ANONİM ŞİRKETİPERSONAL DATA PROTECTION PRIVACY NOTICE