Personal Data Protection (KVKK) Information Notice

1. Data Controller

Under Turkish Law No. 6698 on the Protection of Personal Data, your personal data may be processed by KEYKON A.Ş. in its capacity as the data controller.

2. Personal Data Processed

The following personal data may be processed through our website, our communication channels or our job application processes:

• Full name
• Phone number
• Email address
• Company name
• Title / role information
• Message, request or application content
• CV and information submitted within job applications
• IP address
• Browser, device and usage information
• Site visit and activity logs

Education, experience, certifications, competencies and contact information contained in CVs submitted for career applications may also be processed as part of the application-evaluation process.

3. Purposes of Processing Personal Data

Your personal data may be processed for the following purposes:

• Responding to communication requests
• Evaluating quote, project and service requests
• Running corporate communication processes
• Receiving and evaluating job applications
• Conducting candidate-evaluation and human-resources processes
• Managing customer, supplier and business-partner relationships
• Ensuring the security of the website
• Improving the site usage experience
• Conducting company operations
• Fulfilling legal obligations
• Providing information to authorised persons, institutions and organisations

4. Methods of Personal Data Collection

Your personal data may be collected through the following channels:

• Website visits
• Email correspondence
• Phone conversations
• Contact requests
• Career applications
• CV submissions
• Technical records, log records and cookies
• Other communication channels established directly with the company

Your personal data may be processed by electronic or physical means, through automated or non-automated methods.

5. Legal Bases for Processing Personal Data

Your personal data may be processed on the following legal bases in line with the personal-data processing conditions set out in Law No. 6698:

• Where expressly provided for by laws
• Where directly related to the conclusion or performance of a contract
• Where the data controller must fulfil a legal obligation
• Where processing is mandatory for the establishment, exercise or protection of a right
• Where processing is necessary for the legitimate interests of the data controller, provided the fundamental rights and freedoms of the data subject are not harmed
• With the explicit consent of the data subject where required

6. Transfer of Personal Data

Your personal data may be shared with the following persons, institutions and organisations, limited to the purposes of processing and in accordance with the applicable legislation:

• Authorised public institutions and organisations
• Legal, financial and administrative advisors
• IT, hosting, email and technical-infrastructure service providers engaged by the company
• Business partners, suppliers and subcontractors
• Relevant departments within human resources and recruitment processes
• Other authorised parties with whom information must be shared under law

Your personal data is not shared with or sold to third parties for commercial purposes without authorisation.

7. Personal Data in Job Applications

CVs and personal information submitted for career-application purposes are processed only within the scope of candidate-evaluation and human-resources processes.

Applicants' personal data may be retained for position suitability, communication, evaluation, interview processes and consideration for suitable future positions.

Applicants are advised to avoid sharing special-category personal data in their CVs. Non-essential personal information should not be included in the CV.

8. Storage of Personal Data

Your personal data is retained for the period required by the processing purposes and within the legal retention periods set out in the applicable legislation.

When the retention period ends or the processing purpose ceases, your personal data is deleted, destroyed or anonymised in accordance with the applicable legislation.

9. Security of Personal Data

KEYKON A.Ş. takes due care to implement the necessary administrative and technical measures to prevent unlawful processing, unauthorised access, loss, alteration or disclosure of personal data.

Within this scope, access rights are restricted, appropriate technical measures are applied to store data securely and personal data is managed so that it is accessible only to authorised persons.

10. Rights of the Data Subject

Under Law No. 6698, data subjects have the following rights:

• To learn whether their personal data is being processed
• To request information if personal data has been processed
• To learn the purpose of processing and whether the data is used in line with that purpose
• To know the third parties to whom personal data has been transferred domestically or abroad
• To request correction of incomplete or inaccurate data
• To request deletion or destruction of personal data under the conditions set out in the legislation
• To request that correction, deletion or destruction be notified to third parties to whom data has been transferred
• To object to outcomes produced solely by automated analysis that work to the detriment of the data subject
• To claim compensation for damages arising from unlawful processing of personal data

11. Applications and Contact

You may submit requests regarding your rights under the KVKK to KEYKON A.Ş.

Your applications are evaluated and concluded within the periods set out in the applicable legislation.

12. Updates

KEYKON A.Ş. reserves the right to update this KVKK Information Notice in line with legal regulations, company policies or changes to website operations.

The updated notice takes effect from the date it is published on the website.