Personal Data Protection

**LOHAN FOOD PERSONAL DATA PROTECTION**

As Arz Management Consulting and Engineering Services Ltd. Şti, we show utmost sensitivity regarding the security of your personal data. With this awareness, we place great importance on the processing and safeguarding of all kinds of personal data of all individuals associated with our company, including those who benefit from our products and services, in compliance with the Law on the Protection of Personal Data No. 6698 ("KVKK") and the relevant legislation. In full awareness of this responsibility, as the "Data Controller" defined in the KVKK, we process your personal data within the framework described below and within the limits prescribed by the law.

**a. Data Controller and Representative**

In accordance with the KVKK, your personal data may be processed by our company as the data controller, within the scope explained below.

**b. Purpose of Processing Personal Data and Recipients of Data**

Your collected personal data may be processed and transferred for the following purposes:
- To ensure that you benefit from the products and services offered by our company and group companies,
- To customize the products and services offered by our company and group companies according to your preferences, usage habits, and needs, and to recommend them to you,
- To ensure the legal and commercial security of our company, group companies, and individuals who have a business relationship with our company (such as administrative operations related to communication carried out by our company, ensuring and auditing the physical security of company locations, business partner/customer/supplier (authorized or employees) evaluation processes, reputation research processes, legal compliance process, audit, financial affairs, etc.),
- To determine and implement the commercial and business strategies of our company, and to ensure the execution of our human resources policies.

For these purposes, your personal data may be processed and transferred to our business partners, suppliers, group companies, company officials, shareholders, legally authorized public institutions, and private individuals in accordance with the conditions and purposes of personal data processing specified in articles 5 and 6 of the KVKK.

**c. Methods and Legal Basis for Collecting Personal Data**

Your personal data may be collected by our company through different channels such as the website, mobile applications, call center, and physical channels. Your personal data is collected based on the legal reasons arising from the relevant legislation, contracts, requests, commercial practices, and good faith principles applied to offer you our commercial services and conduct our business activities. Your personal data collected for this legal reason can be processed and transferred within the scope of the purposes specified in this text in accordance with the personal data processing conditions and purposes outlined in articles 5 and 6 of the KVKK.

**d. Rights of the Personal Data Owner**

As personal data owners, if you submit your requests regarding your rights to us, our company will conclude the request as soon as possible, and within thirty days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, our company will charge the tariff determined by the Personal Data Protection Board. In this context, personal data owners have the right to:
- Learn whether personal data is processed,
- Request information if personal data has been processed,
- Learn the purpose of processing personal data and whether it is used in accordance with the purpose,
- Know the third parties to whom personal data is transferred, whether domestically or abroad,
- Request the correction of incomplete or inaccurate data and to request the notification of the correction to the third parties to whom the personal data has been transferred,
- Request the deletion or destruction of personal data if the reasons for processing are no longer valid, despite it being processed in accordance with the KVKK and other relevant legal provisions, and to request the notification of this deletion or destruction to the third parties to whom the personal data has been transferred,
- Object to any negative consequence resulting from the exclusive analysis of the processed data by automated systems,
- Request compensation if personal data has been processed unlawfully and as a result, the person has suffered damage.

In accordance with article 13, paragraph 1 of the KVKK, you are required to submit your request to exercise your rights “in writing” or through other methods determined by the Personal Data Protection Board. To exercise your rights mentioned above, you must send your request, including the necessary information to identify your identity and details about the right you wish to exercise, in writing or through other methods determined by the board, specifying the specific right you are seeking to use under article 11 of the KVKK. This will ensure that your request is responded to more quickly and effectively.