PRIVACY NOTICE ON THE PROTECTION OF PERSONAL DATA

This Privacy Notice has been prepared by KFD Yatırım Danışmanlık İnşaat Otomotiv İthalat İhracat ve Dış Ticaret Ltd. Şti. (the “Company”), acting as data controller, to inform you about the processing of personal data collected through our website pursuant to Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”).

This is an English translation provided for convenience. In the event of any discrepancy, the Turkish text of this notice prevails.

1. Personal Data We Process

The following personal data may be processed through our website or by automated means:

• Contact form: Full name, e-mail address, message content and the site language you submitted the form in (stored in the database used by the Company when the form is submitted)
• Newsletter subscription: E-mail address and preferred site language (in order to record your subscription request)
• Prevention of form abuse: Your IP address and e-mail address are stored temporarily in the database in irreversibly hashed form (HMAC-SHA256) in order to limit repeated submissions within short intervals; the record expires once the rate-limit window closes. This processing takes place independently of cookie consent, for information security purposes
• Cookie preference: Your choice is kept in your browser's local storage under the key kfd_cookie_consent; it is not an HTTP cookie
• Analytics (optional): Google Analytics is activated only if you consent to the analytics option in the cookie preferences panel; visit statistics and technical usage data
• Maps: The embedded Google Maps map on the contact page loads only with your consent; once loaded, cookies may be set by Google
• Automated collection: IP address, browser and device information, visit time, page navigation (within the scope of analytics consent and the hosting provider's server logs)

2. Purposes of Processing

• Establishing contact, providing proposals and responding to enquiries
• Evaluating messages, complaints or suggestions
• Recording and managing newsletter subscription requests
• Analysing and improving the website experience (only with analytics consent)
• Remembering your cookie preferences
• Preventing form abuse and automated submissions
• Conducting information security processes
• Fulfilling legal obligations

3. Legal Grounds for Processing

• Explicit consent (for analytics cookies, map display and behavioural analysis)
• Legitimate interest (site security, prevention of form abuse, core operation)
• Direct relation to the establishment or performance of a contract (contact requests)
• Fulfilment of a legal obligation

4. Cookies and Similar Technologies

The technologies used on our site are summarised below. The current list can also be viewed from the “Cookie Preferences” panel in the footer.

Analytics and map cookies are loaded only with your explicit consent. You may update your preferences at any time via the «Cookie Preferences» link in the footer; your preference is stored in localStorage.

5. Transfer of Personal Data and Cross-Border Transfers

Limited to the purposes stated above, your personal data may be transferred to the hosting and database infrastructure providers used by the Company, to Google Analytics for analysis (where consented), to Google for map display, and to authorised public institutions where required. Contact form and newsletter subscription requests are not sent to any external form-forwarding service.

Cross-border transfers: The website's hosting infrastructure and the database holding form records are located abroad (within the European Union region); accordingly, contact form and newsletter subscription records are processed abroad. Google Analytics and Google Maps services may likewise process data abroad.

6. Rights of the Data Subject

Under Article 11 of the KVKK, you have the right to:

• Learn whether your personal data is being processed
• Request information if it has been processed
• Learn the purpose of processing and whether the data is used in accordance with that purpose
• Know the third parties to whom the data is transferred, in Türkiye or abroad
• Request rectification if the data is incomplete or inaccurate
• Request erasure or destruction under Article 7 of the KVKK
• Request that these actions be notified to third parties
• Object to a result arising from analysis carried out solely by automated systems
• Claim compensation for damage arising from unlawful processing of your personal data

You may submit requests concerning these rights to info@kfd.com.tr. The Company will conclude your request free of charge within 30 (thirty) days at the latest.