SUNPET PACKAGING TIC. A.As Ş. (to be referred to as "the Company" in this text), in our capacity as the data controller; your personal data that you have shared with us within the scope of our commercial relations or within the context of our business relationship with you; we inform you that the personal data you share will be saved, stored, stored, reorganized, shared with the institutions authorized to request this personal data by law, and transferred, transferred, classified and processed to domestic or foreign third parties in accordance with the conditions stipulated by the KVKK, within the framework of the purpose requiring their processing and in a limited and measured manner related to this purpose, maintaining the accuracy of the personal data you share and the most up-to-date version as you have informed us, and in other ways listed in the KVKK.
The purpose of this Privacy Notice is to explain how and for what purposes we process your personal data. Please read this Notice carefully, referring to the section that corresponds to your role within our company (for example, if you are an employee, you can review the purposes and methods of processing and transfer stated there).

PROCESSING AND COLLECTION OF YOUR PERSONAL DATA

The company directly from the data owners or indirectly 3. it collects personal data verbally, physically or electronically from persons or sources where it is made public and processes this personal data. All collected data is individually disclosed to the data subjects and submitted for their approval through an explicit consent form in light of our stated purposes herein.

FOR WHAT REASONS DO WE COLLECT YOUR PERSONAL DATA?

We request such data from you for the following reasons;

– The collection of your personal data by the Company may be necessary to carry out processes required by law. Failure to provide this personal data may result in your inability to benefit from certain rights under the Labor Law and relevant legislation.

– In order for the Company to fulfill its legal obligations within the framework of relevant legislation, it may be necessary for your personal data to be collected by the Company. Failure by the Company to fulfill its legal obligations may result in sanctions being imposed and may prevent your legal obligations from being fulfilled through the Company.

– Personal data may need to be collected by the Company in order to fulfill the employment contract between you and the Company. Failure to share the personal data we obtain here may result in the inability to maintain a healthy business relationship with the Company, the inability to fulfill certain processes established by the Company for your benefit, or the difficulty in fulfilling such processes for you.

– The company may collect your personal data in order to protect its legitimate interests while always prioritizing your rights. Since the company's purposes for collecting your personal data are the same as the processing purposes, what these legitimate interests are is explained under the heading "To Ensure the Company's Legitimate Interests, in Particular" within the section titled "Purposes for Processing Your Personal Data".

PURPOSES FOR PROCESSING YOUR PERSONAL DATA FOR OUR EMPLOYEES

Your personal data may be processed by the Company for the purposes and reasons specified below, which include but are not limited to the following legal grounds: Fulfilling the purpose required for the performance of the employment contract, specifically:

• Proof of employment relationship
• Recording information about wages and salaries
* Tracking and monitoring sick leave
• Conducting payroll processes for employees
* Tracking absence, preparing necessary warning letters in case of violations of work and workplace rules, managing legal processes
• Tracking and monitoring employee compliance with computer, internet, email and phone usage rules as specified in the employment contract and personnel regulations and limited to the purposes
* Examining employee compliance with company policies Labor Law, In order to fulfill the requirements under the Occupational Health and Safety Law, the Social Security Law and relevant legislation, the Personal Data Protection Law, relevant legislation and other laws and regulations, specifically:
• Information retention and reporting requirements stipulated by legislation, relevant regulatory bodies and other authorities, compliance with information obligations
• Execution of court decisions
• Processing of personal data related to marital status in order to fulfill obligations arising from social security legislation
• Investigation and investigation of information security violations
• Ability to conduct information security audits
• Authorization for access to software and files
• Ability to develop and execute software
• Ensuring physical security of the workplace
• Ensuring and monitoring occupational health and safety
• Computer systems, viruses, etc. Jul. Protection against threats To ensure security within the company, specifically;
• SUN PET AMBALAJ SAN. TİC. A.Sh. it may also occur(theft, incident that may occur at the place of work, dispute, etc. detection, unauthorized entry detection, etc.) areas of operation, areas where employees may be seen stranded, taking images with cameras placed at building/department entry-exit points
• Authorizing and controlling access to areas that employees can access, especially due to the necessity arising from the performance of employment contracts with stakeholders;
* Providing training to employees To ensure the legitimate interests of the company, in particular;
• To conduct relations with employees; Dec pay, mandatory FIVE cuts o improving employee relations and motivation o conducting shift management and monitoring o monitoring training processes, organizing trainings o improving efficiency o management, improvement and organization related to social and benefits o managing door and system entrances and exits o providing transportation (service) services to personnel o implementing promotion processes o making salary payments, making mandatory FIVE cuts o improving shift management and motivation o improving shift management and motivation o improving shift management and motivation o improving shift management and motivation o improving shift management and motivation o improving shift management and motivation o improving shift management and motivation o improving employee performance o improving employee performance o improving employee performance o improving employee performance o improving employee performance o improving employee performance o improving employee performance o improving employee performance o improving employee performance o improving employee performance o improving employee performance o Improving employee performance o Improving employee performance o Improving employee performance o Improving employee performance o Improving employee performance o Improving employee performance o Improving employee performance o Improving employee performance o Improving employee performance o Improving employee performance o Improving employee performance; o maintaining accounting records o ensuring the operation of company systems and maintaining workplace order
• For the company to carry out its operations; o preparing internal reports and keeping records o representing the company, acting on behalf of the company 3. conducting contact with persons o Examination of employees' publicly available information in order to identify special risks for the company o issuance of power of attorney o Protection of Company's business secrets so that the company can protect its economic existence o detailed examination of the Company's workforce depending on the confidentiality commitment o timely identification of illegalities Your personal data will be stored for the maximum period specified in the relevant legislation or necessary for the purpose for which they were processed, and in any case until the legal time-out periods.

SHARING OUR EMPLOYEES' PERSONAL DATA WITH THIRD PARTIES WITHIN THE COUNTRY

For the purpose of your security and the fulfillment of our Company's obligations under the laws, your personal data, Labor Law, Occupational Health and Safety Law, Social Insurance and General Health Insurance Law, Law on the Regulation of Publications Made on the Internet and Combating Crimes Committed Through These Publications, Turkish Commercial Code, Personal Data Protection Law No. 6698 and, but not limited to, relevant institutions or organizations to the extent permitted and required by the provisions of other legislation, including but not limited to the Turkish Commercial Code, the Law on the Protection of Personal Data, the Law on the Protection of Personal Data, the Law on the Protection of Personal Data, the Law on the Protection of Personal Data, the Law on the Protection of Personal Data, the Law on the Protection of Personal Data, the Law on the Protection of Personal Data, the Law on the Protection of Personal Data, the Law on the Protection of Personal Data, the Law on; Personal data may be shared with public legal entities such as the Personal Data Protection Authority, the Ministry of Finance, the Ministry of Customs and Trade, the Ministry of Labor and Social Security, the Turkish Employment Agency (İş-Kur), and the Information Technologies and Communications Authority. For example, employees' personal data is shared with the Social Security Institution in order to pay employee and employer contributions. Your personal data may be shared with third parties such as companies to which the Company provides services, human resources consulting companies from which the Company receives services, information technology companies, professional advisors, lawyers, accountants, occupational health and safety institutions, and entities with whom the Company has commercial, administrative, or contractual relationships. The contact information and/or identification details of those acting on behalf of our company may be shared with third parties.

SHARING OUR EMPLOYEES' PERSONAL DATA WITH THIRD PARTIES ABROAD

Your personal data may be transferred abroad to the Company's controlling shareholder and its group companies. Your personal data may be transferred to persons /companies in accordance with the Personal Data Protection Law, especially if the Company has a legitimate interest that does not infringe the fundamental rights and freedoms of the person concerned in the sharing of data, or if it requires the performance of an employment contract, in countries that have adequate protection or may not have adequate protection, depending on the situation, and personal data may be processed by these persons /companies in the manner defined above.

PURPOSES FOR PROCESSING SUPPLIER EMPLOYEE DATA

• Your personal data may be processed by the company for the purposes and reasons specified below, among others, but not limited to these.

• Keeping financial and accounting records
• Fulfilling legal obligations
* Security review and audit
• Creating claims and complaints about criminal offenses
• Conducting information security audits and ensuring confidentiality
* Providing and organizing training • Occupational health and safety To ensure the legitimate interests of the company, especially for; o Company management, business operations, o Implementation of company policies. Your personal data will be retained for the maximum period specified in the relevant legislation or necessary for the purpose for which it was processed, and in any case, for the statutory statute of limitations.

SHARING SUPPLIER EMPLOYEE DATA WITH THIRD PARTIES WITHIN THE COUNTRY

Within the framework of the provisions of Articles 5 and 6 of the Law on the Protection of Personal Data , in order to fulfill our legal obligations, the lawyers from whom the companies receive legal services, the Common Health and Safety Unit, the Ministry of Labor and Social Security, the Social Security Institution, the Turkish Employment Agency, law enforcement agencies, T.C. It is shared with all relevant public institutions and organizations, including the courts.

PURPOSES FOR PROCESSING CUSTOMER DATA

Your personal data may be transferred abroad to the Company's controlling shareholder and its group companies. Your personal data may be transferred to persons /companies in accordance with the Personal Data Protection Law, especially if the Company has a legitimate interest that does not infringe the fundamental rights and freedoms of the person concerned in the sharing of data, or if it requires the performance of an employment contract, in countries that have adequate protection or may not have adequate protection, depending on the situation, and personal data may be processed by these persons /companies in the manner defined above.

PURPOSES FOR PROCESSING SUPPLIER EMPLOYEE DATA

Your personal data provided by the company;

• Conducting emergency management processes
• Conducting information security processes
• Conducting audit/Ethical activities
• Conducting training and mentoring activities
• Conducting activities in accordance with legislation
• Conducting financial and accounting affairs
• Conducting inter-member cooperation processes
• Conducting communication activities
• Managing customer relationship management processes
• Conducting activities aimed at customer satisfaction
• Organization and event management
• Conducting marketing and analysis studies Dec
• Conducting advertising campaign promotion processes
• Conducting social responsibility and civil society activities
* Conducting contract processes
* Conducting sponsorship activities
* Conducting strategic planning activities
* Tracking requests and complaints
* Conducting supply chain management processes
• Conducting marketing processes of products and services
* Conducting investment processes
* Conducting talent, career development activities
* Authorized person, Providing information to institutions and organizations
• Conducting management activities
• Creating and tracking visitor records

For the purposes and legal reasons stated herein; however, they may also be processed for similar purposes and reasons, without being limited to these. Your personal data will be retained for the reasonable and maximum period specified in the relevant legislation or necessary for the purpose for which it was processed, and in any case, for the statutory statute of limitations.

SHARING OUR CUSTOMERS' PERSONAL DATA WITH THIRD PARTIES WITHIN THE COUNTRY

In order for our Company to fulfill its legal obligations, your personal data may be shared in accordance with legal obligations with relevant institutions or organizations such as the Personal Data Protection Authority, Information Technologies and Communication Authority, in particular, but not limited to, the Law on the Protection of Personal Data No. 6698, in accordance with the provisions of all kinds of legislation to which our Company is subject within the borders of the Republic of Turkey; public legal entities such as the Personal Data Protection Authority, in accordance with legal obligations.

SHARING OUR CUSTOMERS' PERSONAL DATA WITH THIRD PARTIES ABROAD

Your personal data will be processed within the framework of Article 9 of the Law and upon your express consent, provided that;

• For personal data security, we have taken all necessary technical and administrative measures, and the data is stored on servers with data security features.
• According to requests, it is transferred abroad to other individuals or institutions.

PURPOSES FOR PROCESSING PERSONAL DATA OF CANDIDATES FOR EMPLOYMENT

• Your personal data may be processed by the company for the purposes and legal reasons specified below, but not limited to these.
• Registration in the visitor logbook upon entering our company.
• Ensuring the security of the company, visitors and employees.
• SUN PET PACKAGING SAN. tic. A.Sh. it may also occur (theft, incident that may occur at the place of work, dispute, etc. Through cameras placed in areas such as access control, unauthorized entry detection, etc.) operation areas, areas containing lockers for employees' personal belongings, fire escape routes, building/section entry-exit points, and rest rooms, camera recordings are taken of employees and individuals visiting the company.

Your personal data will be retained for the period specified in the relevant legislation or for the duration necessary for the purpose for which it was processed.

SHARING OUR CUSTOMERS' PERSONAL DATA WITH THIRD PARTIES WITHIN THE COUNTRY

Your personal data may be processed by the Company for the purposes and reasons specified below, including but not limited to the following legal grounds.Calling potential employees for interviews and conducting interviews. Meeting requests from administrative and official authorities as necessary. Ensuring security for the company. For the purpose of safeguarding the company's legitimate interests, specifically: To determine the employment of potential employees. o Conducting research, observation and recording of the person's declared experience, educational status, competencies during job interviews o Determining the availability of training, qualifications and skills appropriate to the job conditions of the relevant department in which the employee candidate to be employed will be assigned o Examining publicly available information of the employee candidate in order to identify special risks in terms of certain functions related to the job To ensure the management of the company and to carry out its activities; In the event that employment is not offered following this interview, the candidate may be invited to interview for a suitable position in the future; the management of these recruitment processes; their recording; and their improvement; and the ensuring of human resources management efficiency. Your personal data will be retained for the maximum period specified in relevant legislation or necessary for the purpose for which it was processed, and in any case, for the statutory statute of limitations.

SHARING EMPLOYEE CANDIDATES' PERSONAL DATA WITH THIRD PARTIES DOMESTICALLY AND ABROAD

Companies may, upon request in line with their interests from the parent company with which they have a business relationship, or as required by the parent company's commercial agreement, transfer the data of candidates to be employed to work in relevant operations to the parent company, either domestically or to a country outside the EU that provides adequate protection or does not have such a status, in accordance with the Personal Data Protection Law.

YOUR RIGHTS PURSUANT TO ARTICLE 11 OF THE PERSONAL DATA PROTECTION LAW

Pursuant to Article 11 of the Personal Data Protection Law, you may personally inquire about your personal data from us, provided you identify yourself;

• You have the right to know whether the company processes personal data about you; if it does, to request information regarding this;
• You have the right to learn the purpose for which your personal data is processed and whether it is used in accordance with that purpose;
• You have the right to know whether your personal data is transferred domestically or internationally and to whom it is transferred.

Additionally, you have the right to request the Company correct any inaccurate or incomplete personal data and to notify recipients to whom your data has been transferred or to whom it may have been transferred. Within the terms stipulated in Article 7 of the Personal Data Protection Law, you may request the Company to delete and destroy your personal data. You may also request that the third parties to whom the data has been transferred or to whom it may be transferred be informed regarding this deletion and destruction process. You may object to the results of your personal data analysis generated exclusively using an automated system if these results are against your interests. If you suffer damage due to the unlawful processing of your personal data, you may request compensation for the damage.

EXCEPTIONS TO THE RIGHT OF APPLICATION

Pursuant to Article 28 of the KVK Law, personal data owners will not be able to assert their rights regarding the following matters;

• Processing of personal data for purposes such as research, planning and statistics by anonymizing them with official statistics,
• Processing of personal data for art, history, literature or scientific purposes or within the scope of freedom of expression, provided that they do not violate national defense, national security, public safety, public order, economic security, privacy of private life or personal rights or do not constitute a crime,
• Processing of personal data for national defense, national security, public security, Processing carried out within the scope of preventive, protective, and intelligence activities conducted by public institutions and organizations entrusted with duties and authorities by law to maintain public order or ensure economic security,
• Processing of personal data by judicial authorities or enforcement agencies regarding investigation, prosecution, adjudication, or execution proceedings.

Pursuant to Article 28/2 of the KVK Law, personal data subjects will not be able to assert their rights, except for demanding compensation for damage, in the following cases;

• The processing of personal data is necessary for the prevention of crime or criminal investigation, the processing of personal data made public by the personal data owner himself,
• The processing of personal data is necessary for the execution of supervisory or regulatory duties and disciplinary investigation or prosecution by authorized and authorized public institutions and professional organizations and public institutions based on the authority granted by law,
• The processing of personal data is necessary for the protection of the economic and financial interests of the state in relation to budget, tax and financial issues.

Your requests contained in your application will be concluded free of charge within thirty days at the latest, depending on the nature of the request. However, if the process requires additional costs for the Company, the fee specified in the tariff set by the Personal Data Protection Board in the Communiqué on Procedures and Principles for Applications to Data Controllers may be charged. Regarding matters concerning the processing of your personal data, you must submit your application in person in written form, by filling out the application form available on the Company's website, or by delivering it to our Company using a registered electronic mail (KEP) address, secure electronic signature, or mobile signature.