This page presents the official Personal Data Protection and Processing Policy of Key Kütahya Endüstriyel Yatırımlar Holding A.Ş. The policy was prepared in Turkish; in the event of a translation, the Turkish text prevails.
KEY KÜTAHYA ENDÜSTRİYEL YATIRIMLAR HOLDING A.Ş.
PERSONAL DATA PROTECTION AND PROCESSING POLICY
Prepared by: Legal Counsel
Version:
1.0
Approval:
Approved by the Chairperson of the Board of Directors of Key Kütahya Endüstriyel Yatırımlar Holding A.Ş.
Effective Date:
05/11/2025
The Policy has been prepared in Turkish. Even if translated into any other language, the Turkish text shall prevail.
Definitions
| Family Members and Relatives | Spouses, children and relatives of data subjects whose personal data are processed within the scope of activities carried out by the Company. |
|---|---|
| Application Form | The application form available on the Company’s websites, which may be used by the Data Subject to submit requests to the Company. |
| Employees | The employees of the Company. |
| Employee Candidates | Real persons who have applied for a job at the Company by any means or submitted their curriculum vitae. |
| Other Related Persons | Real persons whose personal data are processed and who are not otherwise defined within the scope of the Policy. |
| Employees, Shareholders and Officials of Cooperating Institutions/Organizations | Employees, shareholders and real persons authorized to represent the institutions or organizations with which the Company has a business relationship while carrying out its activities, whether or not a contract exists. |
| Personal Data | Any information relating to an identified or identifiable real person. |
| Company | Key Kütahya Endüstriyel Yatırımlar Holding A.Ş. |
| Company Shareholders | Real persons who are shareholders of the Company. |
| Company Officials | Real persons authorized to represent the Company. |
| Data Subject | The real person whose personal data are processed. |
| Visitors | Real persons who visit the Company’s buildings, facilities or websites. |
Purpose of the Policy
This Personal Data Protection and Processing Policy (the “Policy”) has been prepared to establish the principles adopted by the Company for the protection and processing of personal data and to determine the procedures to be followed in personal data processing activities carried out by the Company.
Scope of the Policy
This Policy applies to personal data processed by the Company through automated means or, provided that they are part of any data recording system, through non-automated means. The Policy covers the processing activities relating to employees, employee candidates, visitors, shareholders, officials, business partners, suppliers and other third parties whose personal data are processed by the Company.
Security of Personal Data
The Company takes all necessary technical and administrative measures to ensure an appropriate level of security in order to prevent unlawful processing of personal data, prevent unlawful access to personal data, and ensure the preservation of personal data.
Processing of Personal Data
Personal data are processed by the Company in accordance with the Constitution, the KVK Law and other applicable legislation. The Company processes personal data for specific, explicit and legitimate purposes and only to the extent required by those purposes.
Principles Applicable to the Processing of Personal Data
The Company processes personal data in compliance with the following principles: lawfulness and fairness; accuracy and, where necessary, being up to date; processing for specific, explicit and legitimate purposes; relevance, limitation and proportionality in relation to the purposes for which data are processed; and retention for the period stipulated by legislation or required for the purpose of processing.
Lawfulness and Fairness
The Company carries out personal data processing activities in accordance with the law, honesty rules and the legitimate expectations of data subjects.
Accuracy and, Where Necessary, Being Up to Date
The Company takes reasonable measures to ensure that processed personal data are accurate and up to date where necessary.
Processing for Specific, Explicit and Legitimate Purposes
The Company clearly identifies the purposes of personal data processing before beginning any processing activity and ensures that such purposes are legitimate.
Processing in a Relevant, Limited and Proportionate Manner
Personal data are processed only to the extent necessary for the specified purposes. Processing that is unrelated to or excessive for the stated purpose is avoided.
Retention for the Period Stipulated by Legislation or Required for the Processing Purpose
The Company retains personal data only for the period required by applicable legislation or for the purpose for which the data are processed. When the retention period expires or the purpose of processing ceases to exist, personal data are deleted, destroyed or anonymized in accordance with applicable rules.
Personal Data Processing Conditions
The Company processes personal data when at least one of the processing conditions set out under the KVK Law exists. Where required by law, explicit consent of the data subject is obtained.
Processing of General Personal Data
General personal data may be processed where explicit consent is available or where one of the legal processing conditions under Article 5 of the KVK Law applies.
Explicit Consent of the Data Subject
Where none of the legal processing conditions applies, personal data are processed based on the explicit consent of the data subject.
Expressly Provided for by Laws
Personal data may be processed where processing is expressly provided for by applicable laws.
Inability to Obtain Explicit Consent Due to Actual Impossibility
Personal data may be processed where it is mandatory for the protection of the life or physical integrity of a person who is unable to express consent due to actual impossibility or whose consent is not legally valid.
Direct Relation to the Establishment or Performance of a Contract
Personal data may be processed where processing is necessary for the establishment or performance of a contract, provided that it is directly related to the parties to the contract.
Necessity for the Company to Fulfil Its Legal Obligation
Personal data may be processed where processing is mandatory for the Company to fulfil its legal obligations.
Data Made Public by the Relevant Person
Personal data made public by the data subject may be processed to the extent compatible with the purpose for which they were made public.
Necessity for the Establishment, Exercise or Protection of a Right
Personal data may be processed where processing is mandatory for the establishment, exercise or protection of a right.
Necessity for the Legitimate Interests of the Company
Personal data may be processed where processing is mandatory for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the data subject.
Processing of Special Categories of Personal Data
Under the KVK Law, certain personal data are regulated separately because, if learned, they may cause discrimination against or victimization of the relevant person. These data are defined as special categories of personal data.
Special categories of personal data are determined under Article 6 of the KVK Law. Accordingly, data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, are special categories of personal data.
Key Kütahya Endüstriyel Yatırımlar Holding processes special categories of personal data where at least one of the conditions set out under Article 6 of the KVK Law exists. In the processing of special categories of personal data, there must be a valid legal processing condition for the relevant processing activity and the other obligations stipulated under the KVK Law must be fulfilled.
Within this scope, Key Kütahya Endüstriyel Yatırımlar Holding may process special categories of personal data in the following cases:
- Where the explicit consent of the relevant person is obtained,
- Where expressly provided for by laws,
- Where processing is mandatory for the protection of the life or physical integrity of the person or another person who is unable to express consent due to actual impossibility or whose consent is not legally valid,
- Where the processing relates to personal data made public by the relevant person and is in accordance with the intention of making such data public,
- Where processing is mandatory for the establishment, exercise or protection of a right,
- Where processing is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services by persons under a confidentiality obligation or by authorized institutions and organizations,
- Where processing is mandatory for fulfilling legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance,
- Where processing is carried out by foundations, associations and other non-profit organizations or formations established for political, philosophical, religious or trade union purposes, provided that it is in accordance with their legislation and purposes, limited to their fields of activity and not disclosed to third parties, and relates to their current or former members or persons who are in regular contact with such organizations or formations.
Where none of the above conditions exists, special categories of personal data are not processed.
In the processing of special categories of personal data, adequate measures determined by the Personal Data Protection Board must also be taken. Key Kütahya Endüstriyel Yatırımlar Holding takes the technical and administrative measures required under the Law and applicable legislation in the processing of special categories of personal data and acts in accordance with the adequate measures determined by the Board.
Processing by Key Kütahya Endüstriyel Yatırımlar Holding of Data Processed by Its Affiliates
Personal data processed by Key Kütahya Endüstriyel Yatırımlar Holding affiliates may also be processed by Key Kütahya Endüstriyel Yatırımlar Holding for the purposes of conducting the affiliates’ activities in line with their goals and strategies, protecting the rights, interests and reputation of the affiliates, ensuring necessary coordination among group companies, and fulfilling obligations arising from applicable legislation, provided that the conditions stipulated under applicable legislation exist and the processing is limited to the relevant processing activity.
Where personal data processed by affiliates are transferred to Key Kütahya Endüstriyel Yatırımlar Holding, such transfer must comply with the conditions stipulated under the KVK Law regarding the transfer of personal data.
Where special categories of personal data are transferred by affiliates to Key Kütahya Endüstriyel Yatırımlar Holding, the transfer must also be based on one of the conditions for processing special categories of personal data set out under Article 6 of the KVK Law and the adequate measures required for the processing of special categories of personal data must be implemented.
Key Kütahya Endüstriyel Yatırımlar Holding affiliates inform the relevant persons, within the scope of the obligation to inform under Article 10 of the KVK Law, that their personal data may be processed by Key Kütahya Endüstriyel Yatırımlar Holding and may be transferred where the conditions stipulated under applicable legislation exist.
Transfer of Personal Data
Personal data may be transferred to business partners, suppliers, service providers, legally authorized public institutions and legally authorized private persons where required for the Company’s activities and in accordance with the transfer conditions under the KVK Law.
Purposes of Personal Data Processing
The Company may process personal data for purposes including carrying out corporate activities, managing business processes, fulfilling legal obligations, managing human resources processes, conducting application and communication processes, ensuring information security, protecting Company rights and interests, and maintaining relations with business partners, suppliers and visitors.
Rights of the Data Subject and Application to the Company
Data subjects may submit their requests regarding their personal data to the Company in accordance with the KVK Law and the applicable application procedures.
Rights of the Data Subject
Data subjects have the right to learn whether their personal data are processed; request information if they have been processed; learn the purpose of processing and whether data are used in accordance with that purpose; know the third parties to whom data are transferred; request correction of incomplete or inaccurate data; request deletion or destruction of data under the conditions set out by law; request notification of correction, deletion or destruction to third parties to whom data have been transferred; object to results arising against them through automated processing; and request compensation for damages caused by unlawful processing.
KVKK Application Methods
Relevant persons may submit their requests within the scope of their rights regulated under Article 11 of the KVK Law to the Data Controller in accordance with Article 13 of the KVK Law and the Communiqué on the Procedures and Principles of Application to the Data Controller through the following methods:
- In writing,
- Through registered electronic mail (KEP),
- With secure electronic signature,
- With mobile signature,
- Through the electronic mail address previously notified by the relevant person to the Data Controller and registered in the Data Controller’s system, or
- Through software or an application developed for application purposes.
Written applications may be made in person, through a notary public, or through methods that ensure delivery of the written application such as registered mail with return receipt. If a person other than the Data Subject submits an application, a special power of attorney issued through a notary public on behalf of the person submitting the application must be available.
Applications must include information that enables identification of the relevant person and the subject of the request; depending on the nature of the request, necessary information and documents must be attached to the application.
Relevant persons may access the KVKK Data Subject Application Form prepared to facilitate applications at https://keyholding.com.tr/assets/legal/kvkk-basvuru-formu.pdf and may submit the completed form to the Data Controller using one of the application methods specified above.
The Data Controller concludes applications as soon as possible and no later than thirty days, depending on the nature of the request.
Responding to Applications
The Company evaluates applications as soon as possible and no later than the period stipulated by legislation, depending on the nature of the request. If the transaction requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.
Exceptions to the Data Subject’s Right to Apply
In cases where the KVK Law or other applicable legislation restricts the right to apply, the Company may reject the request by explaining the reason in accordance with the law.