COLOR PRISMA KIMYA SANAYI TICARET ANONIM SIRKETI PERSONAL DATA PROCESSING POLICY

1. Purpose and Scope

The purpose of the Personal Data Processing Policy (“Policy”) is to establish the rules regarding the personal data processed by COLOR PRISMA KIMYA SANAYI TICARET ANONIM SIRKETI (“Color Prisma”) during the use of the website www.colorprisma.com.tr  (“Website”), which is provided and operated by Color Prisma, in its capacity as the data controller. Under this Policy, the aim is to ensure that the personal data of Data Subjects (natural persons whose personal data are processed during the use of the Website, hereinafter referred to as “Data Subject” or “Related Person”) are processed in accordance with the Personal Data Protection Law No. 6698 (“KVKK” or “Law”) and other relevant legislation.

2. Definitions

Explicit Consent: Refers to the consent given freely and based on information for a specific subject. Data Subject / Relevant Person: Refers to the natural person whose personal data is processed, and whose identity is or can be determined. Personal Data: Refers to any information relating to an identified or identifiable natural person. Special Categories of Personal Data: Refers to data regarding a person’s race, ethnic origin, political opinions, philosophical beliefs, religion, sect, or other beliefs, appearance, membership in associations, foundations, or trade unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data. Processing of Personal Data: Refers to any operation performed on personal data, whether by automated means or not, including but not limited to obtaining, recording, storing, preserving, changing, organizing, disclosing, transferring, acquiring, making accessible, classifying, or preventing the use of such data, as part of a data recording system. Board: Refers to the Personal Data Protection Board. Authority: Refers to the Personal Data Protection Authority. KVKK / Law: Refers to the Personal Data Protection Law No. 6698. Data Controller: Refers to the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

3. Individuals Whose Personal Data Are Processed

As COLOR PRISMA, under this Policy, we process the personal data of customers, potential customers, employees, job applicants, suppliers, potential suppliers, and visitors.

4. Our Basic Principles Regarding the Processing of Your Personal Data as COLOR PRISMA

As COLOR PRISMA, while processing your personal data, we base our practices on the KVKK, regulations, communiqués, decisions of the Personal Data Protection Board, and guidelines issued by the Authority. Additionally, we adopt local and/or international best practices to ensure the protection of your data privacy. The general principles that must be followed in the processing of personal data are regulated in Article 4 of the KVKK. In this context, as COLOR PRISMA, we adhere to the general principles established in the KVKK when processing your personal data. These principles are as follows:

• Processing in Compliance with Law and the Principles of Integrity: COLOR PRISMA processes personal data in accordance with the general principles of law, international agreements, the Constitution, and all other applicable laws and secondary regulations, especially the Personal Data Protection Law, while ensuring adherence to the principle of integrity.
• Ensuring the Accuracy and, When Necessary, the Currency of Personal Data: COLOR PRISMA takes the necessary measures to ensure that the personal data it processes is accurate and up to date. In order to reflect the true state of the data, individuals are informed and given the opportunity to update their personal data. In this regard, COLOR PRISMA has established and operates mechanisms to allow data subjects to correct inaccuracies in their personal data and to verify its accuracy.
• Processing for Specific, Explicit, and Legitimate Purposes: COLOR PRISMA processes personal data solely for specific, explicit, and legitimate purposes, within the scope of the clear and lawful purposes defined before the commencement of personal data processing activities. The company does not engage in any data processing activities outside of these purposes. In this context, the company processes personal data only in connection with the relationship established with the data subjects, and only when necessary for these purposes.
• Adequate, Relevant, and Limited to the Purpose of Processing: COLOR PRISMA processes personal data only to the extent necessary for the execution of its activities and in a manner that is suitable for achieving the defined purposes. Therefore, COLOR PRISMA processes personal data in a way that is aligned with the achievement of the specified purposes and avoids processing personal data that is unrelated to or unnecessary for the fulfillment of the purpose. For example, personal data processing activities are not carried out for the purpose of addressing potential future needs.
• Retention for the Duration Required by the Relevant Legislation or for the Purpose for Which They Were Processed: COLOR PRISMA retains personal data only for as long as required by the relevant legislation or for the duration necessary to fulfill the purpose for which the data was processed.
• Data Minimization

5. Personal Data Processed by COLOR PRISMA and Data Categories

As COLOR PRISMA, we process the personal data listed below in the course of your use of this Website Personal Data Related to a Person’s Race, Ethnic Origin, Political Opinion, Philosophical Belief, Religious Affiliation or Other Beliefs, Appearance and Dress, Membership in Associations, Foundations or Trade Unions, Health, Sexual Life, Sexual Identity, Criminal Convictions and Security Measures, as well as Biometric and Genetic Data.

DATA CATEGORY	PERSONEL DATA
Identity Information	Name, Surname, Signature, Turkish Citizenship ID Number, Identity Card Serial Number, Passport Number, Place of Birth, Date of Birth, Age, Registered Place of Residence, Nationality, Gender, Father’s Name, Mother’s Name, Marital Status
Contact Information	Address, Email, Mobile Phone Number, Registered Electronic Mail Address (KEP)
Professional Experience Information	Occupation Information, Diploma Information, Attended Course/Certification Program Information, Professional Certifications, Professional Identities, Title Defining Experience, and Professional Title
Transaction Security Information	Username and Password, Cookies, Log Records, Access Records, Traffic Data, IP Address Information Distributed Within Internal Networks, Start and End Times of Use, and Information Showing the Unique Network Device Number (MAC Address) of Computers Using These IP Addresses, Target IP Address, and Information on the Allocation Method of One or More IP Addresses to Users Through Ports in the Internet Access Service Provided, and the Real IP and Port Information Assigned to the User.
Marketing and Analysis Related Information	Information and Records Collected Regarding the Person’s Complaints About Products and Services, Information and Records Collected Regarding the Person’s Requests About Products and Services, Information and Evaluations Obtained Within the Scope of Promotional and Marketing Activities
Risk Management	Information Processed for Managing Commercial, Technical, and Administrative Risks, etc.
Special Categories of Personal Data
Request/Complaint Management Information	Personal Data Related to the Receipt and Evaluation of Any Requests or Complaints Addressed to the Company

6. Our Method of Collecting Personal Data as COLOR PRISMA

As COLOR PRISMA, we collect your personal data through automatic methods, in the course of using the Website, via cookies, and by having you fill out the forms on the site or submit your requests and complaints.

7. Our Purposes for Processing Personal Data and Legal Grounds as COLOR PRISMA

According to Article 5 of the Personal Data Protection Law (KVKK), the legal grounds for processing personal data by the Data Controller are outlined. These legal grounds include:

• The existence of a legitimate reason explicitly specified in laws for processing personal data,
• The necessity to process personal data to protect the life or physical integrity of a person who is incapable of expressing consent due to physical impossibility or whose consent is not legally valid,
• The necessity of processing personal data to establish or fulfill a contract, directly related to the parties of the contract,
• The necessity of processing personal data for COLOR PRISMA, in its capacity as the Data Controller, to fulfill its legal obligations,
• The personal data that has been made public by the Data Subject themselves,
• The necessity of processing personal data for the establishment, exercise, or protection of a legal claim,
• The necessity of processing personal data for the legitimate interests of the Data Controller, provided that it does not violate the fundamental rights and freedoms of the Data Subject.

As COLOR PRISMA, our purposes for processing your personal data and the legal grounds for doing so are outlined below.

PURPOSES OF PROCESSING PERSONAL DATA	LEGAL GROUNDS
Management of Requests/Suggestions/Complaints
•     Receiving Requests, Suggestions, and Complaints through the Website, •     Evaluating and Resolving Requests, Suggestions, and Complaints	The necessity of processing personal data for the legitimate interests of the Data Controller, provided that it does not harm the fundamental rights and freedoms of the Data Subject.
Management of Human Resources Processes
Management of Human Resources Application Processes	The necessity of processing personal data related to the parties of a contract, provided that it is directly related to the establishment or performance of the contract.
Information Security & Cybersecurity & Information Technology Infrastructure
•     The use of cloud technologies and infrastructures within the scope of providing fast, secure, and cost-effective services. •     Monitoring and archiving of log records. •     Protection of the company’s reputation and the trust it evokes in commercial life and among consumers.	The necessity of processing personal data for the Data Controller to fulfill its legal obligations. The necessity of processing personal data for the legitimate interests of the Data Controller, provided that it does not harm the fundamental rights and freedoms of the Data Subject.
Conducting Promotional and Marketing Activities
•     Conducting promotional activities regarding the products and services of COLOR PRISMA and/or its group companies. •     Performing newsletter and news sharing on behalf of COLOR PRISMA and/or its group companies. •     Planning and executing advertising activities related to goods and/or services offered by group companies. •     Managing investment and R&D (Research and Development) processes. •     Planning and implementing the company’s commercial and/or business strategies.	•     The necessity of processing personal data for the legitimate interests of the Data Controller, provided that it does not harm the fundamental rights and freedoms of the Data Subject. •     Explicit Consent

8. Our Conditions for Processing Special Categories of Personal Data as COLOR PRISMA

Special categories of personal data are regulated under Article 6 of the Personal Data Protection Law (KVKK). Special categories of personal data are listed in a limited manner under the KVKK, and it is not possible to expand this list. According to the KVKK, the lawful grounds for processing special categories of personal data are listed below. Accordingly;

1. The explicit consent of the Data Subject,
2. Explicitly stipulated by law,
3. It is necessary for the protection of the life or physical integrity of the Data Subject or another person, where the Data Subject is incapable of giving consent due to physical impossibility or where consent is not legally valid,
4. The processing of personal data that has been made public by the Data Subject, in accordance with the Data Subject’s intention to disclose,
5. It is necessary for the establishment, exercise, or defense of legal claims,
6. It is necessary for persons or authorized institutions and organizations who are under an obligation of confidentiality to process the data for public health protection, preventive medicine, medical diagnosis, treatment, and care services, as well as the planning, management, and financing of health services,
7. It is necessary for the fulfillment of legal obligations related to employment, occupational health and safety, social security, social services, and social assistance,
8. It is necessary for foundations, associations, and other non-profit organizations established for political, philosophical, religious, or union purposes, to be in accordance with their relevant legislation and objectives, limited to their activities, and not disclosed to third parties,

special categories of personal data may be processed. As COLOR PRISMA, we do not directly collect your special categories of personal data through the Website. However, in the event that special categories of personal data are shared by you, we rely on the applicable legal grounds specified above, based on the specific circumstances of the case.

9. The Transfer of Your Personal Data by COLOR PRISMA

As COLOR PRISMA, if the transfer of your personal data within the country is required under the scope of this Policy, we will transfer the data in compliance with Article 8 of the Law. If the transfer of your personal data abroad is required, we will ensure compliance with Article 9 of the Law, and in any case, we will adhere to the general principles set forth by the Law. In the case of transferring personal data within Turkey in accordance with Article 8 of the KVKK, one of the following legal grounds must be met;

• The explicit consent of the data subject,
• The existence of a legal basis explicitly stipulated in the laws for the processing of personal data,
• The processing of personal data being necessary for the protection of the life or physical integrity of the data subject or another person, where the data subject is unable to express their consent due to practical impossibility or where their consent is not legally valid,
• The processing of personal data being necessary in direct connection with the establishment or performance of a contract,
• The processing being necessary for the data controller, COLOR PRISMA, to fulfill its legal obligations,
• The personal data having been made public by the data subject themselves,
• The processing of personal data being necessary for the establishment, exercise, or protection of a legal claim,
• The processing of personal data being necessary for the legitimate interests pursued by the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed.

In the case of transferring personal data abroad under Article 9 of the KVKK, one of the following legal grounds must be met;

• The existence of one of the legal bases for processing personal data set out in Articles 5 and 6 of the Law, and the presence of an adequacy decision regarding the country to which the data will be transferred, the sectors within that country, or international organizations.
• If there is no adequacy decision or if countries with sufficient protection have not been declared, the legal grounds specified in Articles 5 and 6 of the Law must still be present. Additionally, it must be ensured that the data subject has the ability to exercise their rights in the country to which their personal data is being transferred, access to legal remedies, and that the safeguards provided in the Law are upheld.

These safeguards include:

• The existence of an agreement between public institutions and organizations abroad or international organizations, and public institutions and organizations in Turkey, or professional organizations with the status of public institutions, which is not classified as an international treaty, and the authorization granted by the Board for such transfer,
• Binding corporate rules approved by the Authority.
• A written commitment containing provisions ensuring adequate protection for the transfer of personal data abroad.
• The signing of standard contractual clauses for the transfer of personal data abroad as determined by the Authority.

• In the absence of an adequacy decision or where adequate safeguards for the transfer of personal data cannot be provided by the parties to the transfer, personal data may be transferred abroad in exceptional circumstances, as specified below:
  • The data subject gives explicit consent for the transfer of personal data abroad, after being informed of the potential risks.
  • The transfer abroad is necessary for the performance of a contract between the data subject and the data controller or for the application of pre-contractual measures taken at the request of the data subject.
  • The transfer abroad is necessary for the establishment or performance of a contract between the data controller and another natural or legal person in the interest of the data subject.
  • The transfer abroad is necessary for the fulfillment of a public interest of superior importance.
  • The transfer of personal data abroad is necessary for the establishment, exercise, or protection of a legal right.
  • The transfer of personal data is necessary to protect the life or physical integrity of the data subject or another person due to the impossibility of obtaining consent or where consent is not legally valid.
  • Transfer of personal data may take place from a public or legitimate interest registry, provided that the conditions for accessing the registry under the relevant legislation are met and the legitimate interest holder requests the transfer.

COLOR PRİSMA may transfer your personal data to third parties (including cloud service providers) with whom it cooperates or from whom it receives support or services, in order to fulfill the purposes of data processing in accordance with Articles 8 and 9 of the Law. In addition to these transfers, your personal data may also be shared with third parties for the improvement and development of the Website, as well as for the resolution of software-related errors. If necessary, personal data obtained from the Website may also be shared with judicial and administrative authorities or institutions for the purpose of conducting legal processes, upon request.

10. Deletion of Your Personal Data by COLOR PRISMA

COLOR PRISMA, in accordance with the provisions of the Law on Personal Data Protection (KVKK), stores your personal data in line with the retention periods specified in relevant legal regulations and ensures that the data is deleted after these periods have expired. Accordingly, your personal data is either automatically or upon your request, deleted, anonymized, or destroyed by COLOR PRISMA.

11. Measures Taken by COLOR PRISMA to Ensure the Security of Your Personal Data

As COLOR PRISMA, we take all necessary administrative and technical measures to ensure that your personal data is not processed unlawfully, to prevent unauthorized access to your personal data, and to ensure that your personal data is securely stored. We continuously review the technical and administrative measures taken to ensure the security of personal data, and in case new measures need to be implemented, we promptly take the necessary actions.

12. Your Rights as the Data Subject

You can exercise your rights under Article 11 of the Personal Data Protection Law (KVKK) by applying to the Data Controller, COLOR PRISMA. Accordingly, your rights are as follows:

• To learn whether your personal data is being processed,
• If your personal data has been processed, to request information about how it has been processed,
• To learn the purpose of processing your personal data and whether it is used for the intended purpose,
• To learn the recipients to whom your personal data has been transferred, either domestically or abroad,
• To request correction of your personal data if it is incomplete or incorrect,
• To request deletion or destruction of your personal data if the conditions specified in KVKK are met,
• To request notification of third parties to whom your personal data has been shared, regarding the correction, deletion, or destruction of your personal data,
• To object to any result that would be to your detriment by solely automated processing of your personal data,
• In the case of damage resulting from unlawful processing of your personal data under KVKK, to request compensation for the damage.

You can submit your requests within the scope of Article 11 of the KVKK, in accordance with the procedures and principles specified in the “Regulation on the Procedures and Principles for Application to the Data Controller”, to COLOR PRISMA, the Data Controller, at the following address “Bergama OSB Mah. 9. Cad. 7/2 Bergama / İzmir”  in writing. Additionally, for any questions or information requests, you can contact COLOR PRISMA Department via email at bilgi@colorprisma.com

13. Responsibility in the Implementation of the Policy

COLOR PRISMA carries out the personal data processing activities mentioned in this Policy in compliance with the Personal Data Protection Law (KVKK) and is responsible for the implementation of this Policy.

14. Modification and Update of the Policy

COLOR PRISMA reserves the right to modify this Policy at any time and in any manner it deems appropriate. The new version of the Policy will come into effect when it is published on the Website or when the Data Subjects are informed through other communication methods, unless otherwise stated.

15. Publication of the Policy

This Policy will enter into force on the date it is published.