As Sunpet Packaging Sanayi ve Ticaret A.Ş. ("Sunpet Packaging" or the "Company"), acting in our capacity as the Data Controller pursuant to the Turkish Personal Data Protection Law No. 6698 ("KVKK"), we attach the utmost importance to the security and confidentiality of your personal data.
This Public Disclosure Text has been prepared to inform you about the purposes for which your personal data is collected, the legal grounds for processing, the methods of collection, the parties with whom your personal data may be shared, and your rights under the applicable legislation.
Your personal data may be collected, recorded, stored, preserved, updated, classified, processed, transferred, or otherwise handled in accordance with the KVKK and other applicable legislation.
The Company processes personal data in accordance with the principles of lawfulness, fairness, transparency, accuracy, purpose limitation, data minimization, storage limitation, and confidentiality.
Please read this Public Disclosure Text carefully and review the section applicable to your relationship with the Company (e.g., employee, customer, supplier, visitor, or job applicant).

Collection and Processing of Personal Data

- The Company collects personal data directly from data subjects or indirectly through authorized third parties and publicly available sources using verbal, written, physical, or electronic means.
- Personal data is processed only for specific, explicit, and legitimate purposes and only to the extent necessary to achieve those purposes.
- Where required by law, processing is based on explicit consent or another legal basis under the KVKK.

Why Do We Collect Your Personal Data?

- To comply with legal obligations.
- To establish and manage contractual relationships.
- To carry out business operations securely and efficiently.
- To protect the Company's legitimate interests where permitted by law.
- To ensure information security and business continuity.
- To improve products and services.
- To fulfil obligations arising from applicable legislation.

Processing of Employees' Personal Data

- Employment relationship management.
- Payroll, benefits, attendance, performance and career management.
- Compliance with labour, tax, social security and occupational health and safety legislation.
- Information security and workplace safety.
- Training and employee development.
- Protection of the Company's legitimate interests.

Processing of Suppliers' Personal Data

- Supplier relationship and contract management.
- Procurement and purchasing processes.
-Supplier relationship and contract management.
-Procurement and purchasing processes.
-Compliance with legal and financial obligations.
-Information security and business continuity.
-Occupational health and safety where applicable.
– Bilgi güvenliği ve iş sürekliliği.
– Uygulanabildiği hallerde iş sağlığı ve güvenliği.

Processing of Customers' Personal Data

- Customer relationship management.
- Sales and marketing activities.
- Contract execution and legal compliance.
- Protection of the Company's legitimate interests.

Processing of Job Applicants' Personal Data

- Recruitment and candidate evaluation.
- Interview and recruitment process management.
- Retention only for legally permitted periods or with consent for future opportunities.

Visitor Personal Data

- Visitor registration.
- Physical security.
- Access control.
- CCTV monitoring where legally permitted.

International Transfer of Personal Data

- Personal data may be transferred abroad only in accordance with Article 9 of the KVKK and applicable safeguards.

Rights of Data Subjects

- Request information on processing.
- Request correction.
- Request deletion where legally applicable.
- Learn recipients of transfers.
- Object to certain automated decisions.
- Claim compensation for unlawful processing.

Exceptions

- Rights may be limited in the circumstances set out in Article 28 of the KVKK.

How to Exercise Your Rights

- Applications may be submitted in writing, via KEP, secure electronic signature, mobile signature, or other methods accepted by the Personal Data Protection Authority. The Company will respond within the statutory period.