PERSONAL DATA PROTECTION

CCTV SYSTEMS CLARIFICATION NOTICE

Data Controller: Çalışdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti. (Address: Hadımköy Mahallesi İbni Sina Caddesi No:8/5 ARNAVUTKÖY/ISTANBUL Tel: 0212 674 16 25 Website: www.cagdaskagit.com, Email: [email protected] Mersis No: 0217038013300019) has prepared this clarification notice in accordance with the Law on Personal Data Protection No. 6698 (hereinafter referred to as "KVKK") and the Communiqué on the Procedures and Principles for Fulfillment of the Obligation to Inform (hereinafter referred to as "Communiqué") for the purpose of informing employees, customers, and visitors regarding internal CCTV system recordings.

KVKK Article 10; “The data controller or its authorized representative shall inform the relevant individuals about; the identity of the data controller and its representative, the purposes for processing personal data, to whom and for what purpose the personal data may be transferred, the method and legal basis for collecting personal data, and the rights specified in Article 11.”

DEFINITIONS IN THE LAW

Personal Data: Any information related to an identified or identifiable natural person.

Processing of Personal Data: Any operation performed on personal data, such as obtaining, recording, storing, maintaining, altering, reorganizing, disclosing, transferring, receiving, making available, classifying, or preventing the use of data, fully or partially by automatic means or through non-automatic means as part of a data recording system.

Data Controller: The real or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.

Data Recording System (VERBIS): A system in which personal data is processed according to specific criteria.

Explicit Consent: Consent based on being informed, expressed freely, and given for a specific matter.

Board: Refers to the Personal Data Protection Board.

CCTV SYSTEMS AND PERSONAL DATA

In accordance with this notice, personal data related to CCTV systems may be processed for the purposes and under the conditions outlined in this document. The personal data to be processed include:

1. Visual and Audio Data

Photographs, audio, and video recordings of a person.

ÇAĞDAŞ KAĞIT AMBALAJ SAN. VE TİC. LTD. ŞTİ.'S PURPOSES OF PROCESSING PERSONAL DATA

In accordance with Article 10 of the KVKK and Article 5 of the Communiqué, personal data within the scope of the CCTV systems may be processed for the following purposes in line with the processing conditions outlined in Article 4 of KVKK:

• To fulfill the obligations arising from the service contract, ensure the safety of employees and customers, manage, supervise, and perform the work,
• To organize all records and documents to be processed in electronic (internet/mobile, etc.) or physical environments,
• To provide information to public officials in case of public security matters as required by the legislation,
• To fulfill legal obligations and exercise rights arising from current regulations,
• In the context of judicial and administrative investigations, to fulfill the legal obligation to respond to official requests,
• To carry out business activities,
• To manage occupational health and safety processes,
• To manage assignment processes,
• To provide information to authorized persons, institutions, and organizations,
• To manage emergency situations,
• To manage organization and event processes,
• To manage information security processes,
• To carry out storage and archiving activities,
• To ensure the security of the physical premises.

METHOD AND LEGAL BASIS OF COLLECTING PERSONAL DATA

Personal data may be collected through audio and visual recording cameras 24/7 during legal relationships. Information on the CCTV system is available in the areas where cameras are located, and this clarification notice is shared via the link in the visual content.

According to Article 5 of the KVKK, personal data cannot be processed without the explicit consent of the relevant person, unless specified by law. The law specifies certain exceptions where explicit consent is not required, such as when processing personal data is necessary for the execution or performance of a contract, when it is mandatory to fulfill the data controller's legal obligations, when data is made public by the individual themselves, when processing is necessary to establish, exercise, or protect a right, or when it is necessary for the legitimate interests of the data controller, provided that it does not infringe on the individual's basic rights and freedoms.

TRANSFER OF PERSONAL DATA

Personal data related to the CCTV systems may be shared with suppliers, shareholders, authorized vendors, private law entities (such as security, auditing, events, health, occupational safety, law firms, etc.), independent auditing companies, domestic and international business partners, service providers for storage, archiving, IT support (such as servers, hosting, cloud computing), and legally authorized public institutions and private law entities, in accordance with the provisions of Article 8 and 9 of the KVKK, in line with the purposes outlined above and in compliance with legal and security regulations.

RETENTION PERIOD OF PERSONAL DATA

In accordance with the provisions of the Law on Protection of Personal Data (KVKK), personal data processed for the purposes stated in this “Clarification Text on the Processing of Personal Data” will be deleted, destroyed, or anonymized according to the Personal Data Retention and Destruction Policy when the purpose for processing is no longer required, as stated in Article 7/1 of the KVKK, and/or when the statutory retention periods for processing personal data have expired. Afterward, the data will either be deleted or anonymized for continued use.

RIGHTS OF THE DATA SUBJECT

The data subject has the right to learn whether their personal data is being processed, to request information if their data is processed, to know the purpose of processing their personal data and whether it is being used in accordance with the purpose, to know third parties to whom their personal data is transferred both domestically and internationally, to request rectification if their personal data is incomplete or incorrect, to request the deletion or destruction of personal data if the reasons for processing no longer exist, to request that third parties to whom the data was transferred be notified about the rectification, deletion, or destruction, to object to any result that would be detrimental to them arising from automated processing, and to request compensation for damages in case of unlawful processing of their data.

EXCEPTIONS TO THE RIGHT TO APPLY

According to Article 28/2 of the Law, the rights mentioned in Article 11 of the Law cannot be exercised, except for the right to request compensation for damages, in the following situations:

• Processing of personal data is necessary for the prevention of a crime or for a criminal investigation,
• The personal data has been made public by the data subject themselves.

APPLICATION METHOD AND FORM

The data subject may submit requests related to the rights listed above in accordance with the application procedures specified in the "Communiqué on the Procedures and Principles for Application to the Data Controller" to Çağdaş Kağıt Ambalaj San. ve Tic. Ltd. Şti.

Requests within the scope of the rights listed in Article 11 of the Law on Protection of Personal Data can be made by filling out the form available at www.cagdaskagit.com/kvkk and through one of the methods outlined below in accordance with the requirements of Article 13 of the KVKK and Article 5 of the Communiqué on the Procedures and Principles for Application to the Data Controller.

Applications made to the company will be responded to within 30 days from the date the request reaches the company, according to Article 13/2 of the KVKK. Responses will be delivered to the applicant either electronically or in writing, as required by Article 13 of the KVKK.

	APPLICATION METHOD	APPLICATION ADDRESS	INFORMATION TO INCLUDE IN THE APPLICATION
1. Written Application	In-person application with a wet signature or via Notary	Hadımköy Mahallesi İbni Sina Caddesi No:8/5 ARNAVUTKÖY/ISTANBUL	On the envelope/notification, write "Information Request Under the Law on the Protection of Personal Data".
2. Registered Electronic Mail (KEP)	Via Registered Electronic Mail (KEP)	[email protected]	In the subject of the email, write "Information Request Under the Law on the Protection of Personal Data".
3. Application via Company System Registered Email	Using the registered email address in the company system	[email protected]	In the subject of the email, write "Information Request Under the Law on the Protection of Personal Data".
4. Application via Email Address Not Registered in the Company System	Using an email address not registered in the company system, including a mobile signature/e-signature	[email protected]	In the subject of the email, write "Information Request Under the Law on the Protection of Personal Data".

If the request is accepted or rejected with an explanation, the response will be sent to the applicant either electronically or in writing. If the request is accepted, necessary actions will be taken immediately by our company.

COMMUNIQUE ON PROCEDURES AND PRINCIPLES FOR APPLICATION TO THE DATA CONTROLLER ARTICLE 7

FEE: No fee will be charged for written responses up to 10 pages, but for each additional page beyond 10 pages, a fee of 1 Turkish Lira per page may be charged. If the response is provided on a recording medium such as a CD or flash drive, a fee equivalent to the cost of the recording medium may be charged.