The protection of personal data is among the foremost priorities of OPUS KİMYA A.Ş. (Our Company), located at Esentepe Mah. Ali Kaya Sk. No:1/B Polat Plaza B Block, Floor 11, 34394 Şişli / Istanbul / Turkey. We hereby inform you that your personal data is processed in accordance with the following principles:

• Compliance with the law and principles of good faith,

• ccuracy and, where necessary, keeping up-to-date,

• Processing for specific, explicit, and legitimate purposes,

• Being relevant, limited, and proportionate to the processing purposes,

• Retaining data securely for the periods prescribed by applicable legislation or for such period as is necessary and lawful for the purposes of processing.

This Policy is provided to inform you about the protection of personal data and to fulfill our obligation to provide information as the Data Controller pursuant to Article 10 of the Law on the Protection of Personal Data No. 6698 (KVKK).

Categories of Personal Data Processed

The personal data processed by the Company includes:

i. Identity Information: First name, Last name, Tax ID Number (VKN)/Turkish ID Number (TCKN)

ii. Contact Information: Phone number, mailing/billing address, email address

iii. Customer Transaction Information (Order history, request/complaint records, call center records, etc.)

iv. Financial Information: Includes card information related to payment and collection transactions, transaction reference numbers, billing information, tax information, bank account information, order amount, campaign and discount information, and current account records.

Our company does not process any special categories of personal data.

Purposes of Personal Data Processing

Your personal data is processed for the following purposes:

• Carrying out sales and collection activities,

• Preparation of all records, documents, and invoices serving as the basis for transactions,

• Measuring and improving service quality related to customer satisfaction and support processes, managing customer satisfaction processes, customer management, post-sales services, and the development of post-sales processes, as well as evaluating problem/error reports,

• Conducting communication activities,

• Conducting logistics operations,

• Conducting the accounting processes,

• Conducting the risk management processes,

• Conducting and improving operational activities,

• Conducting internal evaluations,

• Conducting security, operations, reporting, and statistical activities,

• Continuation of marketing activities,

• Providing information in response to requests from legal authorities regarding public safety matters,

• Complying with legal obligations and exercising rights arising from applicable legislation.

Additionally, sending commercial electronic communications and marketing activities are carried out only with your explicit consent.

Legal Basis for Processing Personal Data and Method of Collection

Your personal data is processed based on the following legal grounds in accordance with Article 5 of the KVKK:

a) Where explicitly provided for by law,

b) The necessity of processing personal data belonging to the parties to a contract, provided that such processing is directly related to the establishment or performance of the contract,

c) Where it is mandatory for the data controller to fulfill its legal obligations,

d) Where processing is mandatory for the establishment, exercise, or defense of a legal claim,

e) Where processing is mandatory for the legitimate interests of the data controller, provided that such processing does not infringe upon the fundamental rights and freedoms of the data subject.

In cases where your explicit consent is required (particularly for marketing activities and cross-border data transfers), your data is processed based on your explicit consent.

Your personal data is collected through (i) the website; (ii) email and communication channels; (iii) customer forms (interviews); (iv) sales and support processes; and (v) business partners and distributors, by verbal, written, or electronic means, using automated or non-automated methods.

Transfer of Personal Data 

Your personal data may be transferred to administrative and official authorities, independent audit firms, tax advisors, and other external professional consultants; transportation companies; audit/consulting firms; organizations with which we have agreements regarding the sending of commercial electronic communications; program partner organizations; suppliers; financial institutions; similar business partners; and domestic third parties in a manner limited and proportionate to the purposes set out under the heading “Purposes of Personal Data Processing”, in accordance with Article 8 of the KVKK.”

Data Transfer Abroad

Data obtained through the analytical and marketing tools used on our website (Google Analytics, Meta Pixel, etc.) may be transferred abroad because the servers of these service providers are located outside Turkey. These transfers are carried out based on one of the following conditions pursuant to Article 9 of the KVKK: the existence of your explicit consent, or the provision of adequate safeguards as determined by the Personal Data Protection Board..

Rights Under the Personal Data Protection Law

Pursuant to Article 11 of the KVKK, as the data subject, you have the following rights:

a) To learn whether personal data has been processed,

b) Request information regarding the processing of personal data if it has been processed,

c) To learn the purpose of the processing of personal data and whether they are being used in accordance with that purpose,

d) The right to know the third parties to whom personal data has been transferred, whether within or outside the country,

e) The right to request the correction of personal data if it has been processed inaccurately or incompletely,

f) To request the deletion or destruction of personal data if the legal grounds for processing no longer apply,

g) To request that the actions taken pursuant to subparagraphs (d) and (e) be notified to the third parties to whom the personal data has been transferred,

h) The right to object to a decision made solely through the automated processing of personal data that adversely affects the individual,

i) The right to request compensation for damages incurred due to the unlawful processing of personal data.

Requests within the scope of the KVKK may be submitted to our Company: (i) in writing; (ii) through a notary; (iii) via a registered electronic mail (KEP) address; or (iv) with a secure electronic signature.

Your requests will be concluded within 30 days at the latest. Information and documents verifying your identity may be requested during the application process.

Retention Periods for Personal Data

Your personal data is retained for the duration required by the purpose of processing and for the periods specified in applicable legislation. In this context:

•  Invoices, accounting, and tax records: 10 years (as required by the Tax Procedure Law)

• Order and customer transaction information: 3 years (as required by Consumer Protection Legislation)

•  Communication and marketing data: Until explicit consent is withdrawn or for a maximum of 3 years

•  Job application information: 2 years

Upon the expiration of the retention period or the cessation of the processing purpose, personal data is deleted, destroyed, or anonymized in accordance with the Company’s Personal Data Retention and Destruction Policy.

 

DATA SUBJECT REQUEST FORM 

GENERAL INFORMATION

Persons defined as personal data subjects under Law No. 6698 on the Protection of Personal Data (hereinafter referred to as “KVKK”) (hereinafter referred to as the “Applicant”) are granted the right to request information regarding the processing of their personal data pursuant to Article 11 of the KVKK.

Pursuant to the first paragraph of Article 13 of the KVKK, applications to be made to the Company, as data controller, in connection with these rights must be submittedin writing or through methods determined by the Personal Data Protection Board (hereinafter referred to as the “Board”).

In this context, applications to be made to the Company “in writing” may be transmitted to the Company, by printing out this form, through the following methods:

•      by the Applicant’s in-person submission

•      through a notary public,

•      By signing it with a “secure electronic signature” as defined in the Electronic Signature Law No. 5070 and sending it to the Company’s registered email address.

Information regarding each written application channel and how applications are to be submitted is provided below.

Application Method	Address for Submission	Information to Be Included in the Submission
In-Person Application	Esentepe Mah. Ali Kaya Sk. No:1B Polat Plaza B Block, Floor 11, 34394 Şişli / Istanbul	The envelope shall be marked "Request for Information Under the Law on the Protection of Personal Data".
Service of Process via           Notary	Esentepe Mah. Ali Kaya Sk. No:1B Polat Plaza B Block, Floor 11, 34394 Şişli / Istanbul	The envelope for service of process shall be marked "Request for Information Under the Personal Data Protection Law."
Via Registered           Electronic Mail (KEP)	opusofis@hs01.kep.tr	The subject line of the email shall read: "Request for Information Under the Personal Data Protection Law."