This page presents the official Personal Data Protection and Processing Policy of Key Kütahya Endüstriyel Yatırımlar Holding A.Ş. The policy was prepared in Turkish; in the event of a translation, the Turkish text prevails.
COOKIE NOTICE REGARDING THE PROCESSING OF PERSONAL DATA
This Notice has been prepared by Key Kütahya Endüstriyel Yatırımlar Holding Anonim Şirketi (the “Company”), acting as data controller, within the scope of Article 10 of the Turkish Personal Data Protection Law No. 6698 (the “KVK Law”) and the Communiqué on the Procedures and Principles to be Followed in Fulfilment of the Obligation to Inform. Tracking technologies such as cookies, pixels and gifs (“Cookies”) are small text files placed on your devices, such as tablets, phones or computers, or codes running on your browser while you use online environments such as websites or mobile applications. Through Cookies, the servers of our websites and applications recognize your devices and, for example, enable the management of your language preferences and site traffic. Cookies also help us analyze the number and profile of visitors to our website or application, improve our software to provide a better experience, and, where you prefer, personalize advertisements displayed during your internet use. Pursuant to the KVK Law, your personal data relating to the Cookies used on https://thekeyholding.com/ (the “Website”) may be processed by the Company as data controller within the scope explained below.
Purposes and Legal Grounds for Processing Personal Data
Your collected personal data shall be processed for the purposes (“Purposes”) and legal grounds set out below, within the personal data processing conditions and purposes specified in Article 5 of the Law. Different types of Cookies are used on the Website for different purposes. Depending on the type of Cookie used, the data processing purposes and the processing condition under the KVK Law on which we rely may vary.
Strictly Necessary Cookies (Always Active)
Strictly necessary Cookies are placed on your device when you view the Website and are required for the proper operation of the online services offered. For the data processing activities we carry out through these Cookies, we rely on the processing conditions under Article 5 of the KVK Law: “processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of a contract” and “processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.”
Recipients and Purposes of Personal Data Transfers
Your personal data collected for the fulfilment of the Purposes above may be transferred, within the scope of our legitimate interests, to consultants from whom we receive services in Türkiye and to service providers that provide information technology infrastructure and technical services relating to Cookies. Where expressly provided by law and within the scope of fulfilling our legal obligations, your personal data may also be transferred to legally authorized public institutions and legally authorized private organizations in accordance with the personal data transfer rules under Article 8 of the KVK Law and the processing conditions under Article 5 of the KVK Law.
If you provide explicit consent, your personal data processed through Google Analytics Cookies (identifier and device data) may be transferred to Google LLC, located abroad, for reporting by analyzing user behavior on the Website, and to Meta Inc., located abroad, for the purpose of presenting personalized advertisements to users, in accordance with the rules on transfer of personal data abroad under Article 9 of the KVK Law and the processing conditions under Article 5 of the KVK Law.
Method of Personal Data Collection
Your personal data are collected electronically through the Cookies available on the Website, within the scope of fulfilling the Purposes set out above.
Rights of the Relevant Person Under Article 11 of the Law
We hereby inform you that you have the following rights under Article 11 of the KVK Law regarding your personal data:
To learn whether your personal data are processed.
To request information if your personal data have been processed.
To learn the purpose of processing your personal data and whether they are used in accordance with that purpose.
To know the third parties to whom your personal data are transferred in Türkiye or abroad.
To request correction of your personal data if they are processed incompletely or inaccurately, and to request that the correction be notified to third parties to whom the personal data have been transferred.
To request deletion or destruction of your personal data if the reasons requiring their processing cease to exist, even though they have been processed in accordance with the KVK Law and other relevant laws, and to request that such action be notified to third parties to whom the personal data have been transferred.
To object to any result against you arising from analysis of processed data exclusively through automated systems.
To request compensation for damages if you suffer damage due to unlawful processing of your personal data.
Cookie Settings Through Browser Settings
You may change your cookie preferences at any time by clicking the “Edit Cookie Preferences” area in the footer of the Website. To do this, switch the buttons in the cookie management panel to “on” or “off” according to your preference and click “Save Choices.” Then refresh the page for your settings to take effect. You may also partially control Cookies through your browser settings. Information on managing Cookies in commonly used browsers is available through the following links:
Google Chrome (https://support.google.com/accounts/answer/61416
Mozilla Firefox (https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop
Microsoft Internet Explorer (https://support.microsoft.com/en-us/windows/delete-and-manage-cookies-168dab11-0753-043d-7c16-ede5947fc64d
Safari (https://help.apple.com/safari/mac/9.0/#/sfri40732
Opera (https://help.opera.com/en/latest/web-preferences/
KEY KÜTAHYA ENDÜSTRİYEL YATIRIMLAR HOLDİNG A.Ş.
PERSONAL DATA PROTECTION AND PROCESSING POLICY
Prepared by: Legal Counsel
Version:
1.0
Approval:
Approved by the Chairperson of the Board of Directors of Key Kütahya Endüstriyel Yatırımlar Holding A.Ş.
Effective Date:
05/11/2025
The Policy has been prepared in Turkish. Even if translated into any other language, the Turkish text shall prevail.
Definitions
| Family Members and Relatives | Spouses, children and relatives of data subjects whose personal data are processed within the scope of activities carried out by the Company. |
|---|---|
| Application Form | The application form available on the Company’s websites, which may be used by the Data Subject to submit requests to the Company. |
| Employees | The employees of the Company. |
| Employee Candidates | Real persons who have applied for a job at the Company by any means or submitted their curriculum vitae. |
| Other Related Persons | Real persons whose personal data are processed and who are not otherwise defined within the scope of the Policy. |
| Employees, Shareholders and Officials of Cooperating Institutions/Organizations | Employees, shareholders and real persons authorized to represent the institutions or organizations with which the Company has a business relationship while carrying out its activities, whether or not a contract exists. |
| Personal Data | Any information relating to an identified or identifiable real person. |
| Company | Key Kütahya Endüstriyel Yatırımlar Holding A.Ş. |
| Company Shareholders | Real persons who are shareholders of the Company. |
| Company Officials | Real persons authorized to represent the Company. |
| Data Subject | The real person whose personal data are processed. |
| Visitors | Real persons who visit the Company’s buildings, facilities or websites. |
Purpose of the Policy
This Personal Data Protection and Processing Policy (the “Policy”) has been prepared to establish the principles adopted by the Company for the protection and processing of personal data and to determine the procedures to be followed in personal data processing activities carried out by the Company.
Scope of the Policy
This Policy applies to personal data processed by the Company through automated means or, provided that they are part of any data recording system, through non-automated means. The Policy covers the processing activities relating to employees, employee candidates, visitors, shareholders, officials, business partners, suppliers and other third parties whose personal data are processed by the Company.
Security of Personal Data
The Company takes all necessary technical and administrative measures to ensure an appropriate level of security in order to prevent unlawful processing of personal data, prevent unlawful access to personal data, and ensure the preservation of personal data.
Processing of Personal Data
Personal data are processed by the Company in accordance with the Constitution, the KVK Law and other applicable legislation. The Company processes personal data for specific, explicit and legitimate purposes and only to the extent required by those purposes.
Principles Applicable to the Processing of Personal Data
The Company processes personal data in compliance with the following principles: lawfulness and fairness; accuracy and, where necessary, being up to date; processing for specific, explicit and legitimate purposes; relevance, limitation and proportionality in relation to the purposes for which data are processed; and retention for the period stipulated by legislation or required for the purpose of processing.
Lawfulness and Fairness
The Company carries out personal data processing activities in accordance with the law, honesty rules and the legitimate expectations of data subjects.
Accuracy and, Where Necessary, Being Up to Date
The Company takes reasonable measures to ensure that processed personal data are accurate and up to date where necessary.
Processing for Specific, Explicit and Legitimate Purposes
The Company clearly identifies the purposes of personal data processing before beginning any processing activity and ensures that such purposes are legitimate.
Processing in a Relevant, Limited and Proportionate Manner
Personal data are processed only to the extent necessary for the specified purposes. Processing that is unrelated to or excessive for the stated purpose is avoided.
Retention for the Period Stipulated by Legislation or Required for the Processing Purpose
The Company retains personal data only for the period required by applicable legislation or for the purpose for which the data are processed. When the retention period expires or the purpose of processing ceases to exist, personal data are deleted, destroyed or anonymized in accordance with applicable rules.
Personal Data Processing Conditions
The Company processes personal data when at least one of the processing conditions set out under the KVK Law exists. Where required by law, explicit consent of the data subject is obtained.
Processing of General Personal Data
General personal data may be processed where explicit consent is available or where one of the legal processing conditions under Article 5 of the KVK Law applies.
Explicit Consent of the Data Subject
Where none of the legal processing conditions applies, personal data are processed based on the explicit consent of the data subject.
Expressly Provided for by Laws
Personal data may be processed where processing is expressly provided for by applicable laws.
Inability to Obtain Explicit Consent Due to Actual Impossibility
Personal data may be processed where it is mandatory for the protection of the life or physical integrity of a person who is unable to express consent due to actual impossibility or whose consent is not legally valid.
Direct Relation to the Establishment or Performance of a Contract
Personal data may be processed where processing is necessary for the establishment or performance of a contract, provided that it is directly related to the parties to the contract.
Necessity for the Company to Fulfil Its Legal Obligation
Personal data may be processed where processing is mandatory for the Company to fulfil its legal obligations.
Data Made Public by the Relevant Person
Personal data made public by the data subject may be processed to the extent compatible with the purpose for which they were made public.
Necessity for the Establishment, Exercise or Protection of a Right
Personal data may be processed where processing is mandatory for the establishment, exercise or protection of a right.
Necessity for the Legitimate Interests of the Company
Personal data may be processed where processing is mandatory for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the data subject.
Processing of Special Categories of Personal Data
Special categories of personal data are processed only in accordance with the KVK Law and applicable secondary legislation. The Company applies enhanced technical and administrative safeguards for these data.
Transfer of Personal Data
Personal data may be transferred to business partners, suppliers, service providers, legally authorized public institutions and legally authorized private persons where required for the Company’s activities and in accordance with the transfer conditions under the KVK Law.
Purposes of Personal Data Processing
The Company may process personal data for purposes including carrying out corporate activities, managing business processes, fulfilling legal obligations, managing human resources processes, conducting application and communication processes, ensuring information security, protecting Company rights and interests, and maintaining relations with business partners, suppliers and visitors.
Rights of the Data Subject and Application to the Company
Data subjects may submit their requests regarding their personal data to the Company in accordance with the KVK Law and the applicable application procedures.
Rights of the Data Subject
Data subjects have the right to learn whether their personal data are processed; request information if they have been processed; learn the purpose of processing and whether data are used in accordance with that purpose; know the third parties to whom data are transferred; request correction of incomplete or inaccurate data; request deletion or destruction of data under the conditions set out by law; request notification of correction, deletion or destruction to third parties to whom data have been transferred; object to results arising against them through automated processing; and request compensation for damages caused by unlawful processing.
Exercise of Data Subject Rights
Applications may be submitted to the Company in writing or through other methods determined by the Personal Data Protection Board. Applications must include information necessary to identify the applicant and clearly state the request.
Responding to Applications
The Company evaluates applications as soon as possible and no later than the period stipulated by legislation, depending on the nature of the request. If the transaction requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged.
Exceptions to the Data Subject’s Right to Apply
In cases where the KVK Law or other applicable legislation restricts the right to apply, the Company may reject the request by explaining the reason in accordance with the law.