FIRAT OFFICE FURNITURE IMPORT EXPORT INDUSTRY AND TRADE LIMITED COMPANY Personal Data Policy

General information about the Personal Data Law

Law No. 6698 on the Protection of Personal Data (hereinafter referred to as the PDPL) was adopted on March 24, 2016, and published in the Official Gazette numbered 29677 dated April 7, 2016. Some parts of the PDPL came into effect on the date of publication, while others became effective on October 7, 2016.

Information as the data controller

Pursuant to Law No. 6698 PDPL and in the capacity of Data Controller, your personal data will be processed by us within the framework explained on this page; they will be recorded, stored, updated, disclosed/transferred to third parties where permitted by legislation, classified, and processed in the forms listed in the PDPL.

How your personal data may be processed

In accordance with Law No. 6698 PDPL, the personal data you share with our Company may be processed by us through any operation on data such as obtaining fully or partially, automatically or non-automatically (provided it is part of any data recording system), recording, storing, modifying, reorganizing, in short, through all kinds of operations performed on data. All operations performed on data within the scope of the PDPL are considered "processing of personal data."

Purposes and legal reasons for processing your personal data

The personal data you share,

• To fulfill the requirements of the services we provide to our customers, in accordance with the contract and technology requirements, and to improve the offered products and services;
  
  
• To record identity, address, and other necessary information to identify the owner of the transaction within the scope of Law No. 6563 on Regulation of Electronic Commerce, Law No. 6502 on Protection of the Consumer, the Regulation on Electronic Commerce Service Providers and Intermediary Service Providers published in the Official Gazette No. 29457 dated 26.08.2015 based on these regulations, the Distance Contracts Regulation published in the Official Gazette No. 29188 dated 27.11.2014, and other relevant legislation;
  
  
• To organize all records and documents that will serve as a basis for processing in payment systems, electronic contracts, or paper-based environments in the banking and electronic payment field; to comply with information retention, reporting, and notification obligations stipulated by legislation and other authorities;
  
  
• To provide information to public prosecutors, courts, and relevant public officials upon request and as required by legislation concerning public security issues and legal disputes;

Your personal data will be processed in accordance with Law No. 6698 PDPL and related secondary regulations. Information about third parties or organizations to whom your personal data may be transferred The persons/organizations to whom your personal data shared with our Company may be transferred for the purposes stated above include, primarily IdeaSoft Software Industry and Trade Inc., which provides our e-commerce infrastructure, suppliers, cargo companies, related service providers, program partner organizations we collaborate with as data processors, domestic/foreign organizations, and other third parties.

How your personal data is collected

Your personal data,

• Through forms on our Company's website and mobile applications such as name, surname, Turkish ID number, address, phone, business or private e-mail address; preferences on pages where login is performed using username and password, IP records of performed transactions, cookie data collected by the browser, browsing durations and details, location data;

• Verbally, written, or electronically via our sales and marketing department employees, branches, suppliers, other sales channels, paper forms, business cards, digital marketing, and call centers;

• Obtained physically or virtually, face-to-face or remotely, verbally, written or electronically from individuals who share personal data such as business cards, resumes (CV), offers for purposes like establishing commercial relations with our Company, applying for jobs, making offers;

• Additionally, data obtained indirectly from different channels such as websites, blogs, contests, surveys, games, campaigns and similar (micro) websites and social media; newsletter reading or clicking activities, data provided by publicly accessible databases, publicly shared profiles and data from social media platforms; can be processed and collected.

Your personal data obtained before the PDPL entered into force

Personal data obtained lawfully prior to the effective date of the PDPL, April 7, 2016, through membership, electronic communication consent, product/service purchase, and other means are also processed and retained in accordance with the terms and conditions set out in this document.

Transfer of your personal data abroad

Your personal data collected by any of the aforementioned methods may be transferred abroad, provided they remain within the scope of the PDPL and in accordance with contractual purposes, to service intermediaries located abroad (those accredited by the Personal Data Protection Board and countries with adequate protection of personal data).

Storage and protection of personal data

Your personal data will be confidentially stored in the database and systems of our Company in accordance with Article 12 of the PDPL; apart from legal obligations and the arrangements set forth in this document, your personal data will not be shared with any third parties. Our Company is obliged under Article 12 of the PDPL to prevent unlawful processing of personal data, prevent unauthorized access, and implement software measures such as access management and physical security measures for systems and databases containing personal data. If it is learned that personal data has been unlawfully obtained by others, the situation will be immediately reported in writing to the Personal Data Protection Board in accordance with legal regulations.

Keeping personal data accurate and up-to-date

Our Company has an obligation under Article 4 of the PDPL to keep your personal data accurate and up-to-date. In this context, to fulfill our obligations arising from the applicable legislation, our Customers must share their accurate and up-to-date data or update it via the website/mobile application.

Rights of the personal data owner under Law No. 6698 PDPL

Article 11 of Law No. 6698 PDPL, effective from October 7, 2016, grants the following rights to Personal Data Owners regarding their data with our Company (data controller): The Personal Data Owner may apply to our Company with respect to themselves to;

1. Learn whether personal data is processed,
2. Request information if personal data has been processed,
3. Learn the purpose of processing personal data and whether they are used accordingly,
4. Know the third parties to whom personal data is transferred domestically or abroad,
5. Request correction of personal data if processed incompletely or inaccurately,
6. Request deletion or destruction of personal data under the conditions set forth in Article 7 of the PDPL,
7. Request that correction, deletion, or destruction procedures be notified to third parties to whom personal data has been transferred,
8. Object to a result against oneself arising solely from automatic processing of personal data through exclusively automatic systems,
9. Request compensation for damages in case of harm due to unlawful processing of personal data,