Data Protection Notice

1. Data Controller

Under Turkish Personal Data Protection Law no. 6698 (the "Law"), your personal data is processed by Elit Arge Danismanlik Bilisim Teknolojileri A.S. (the "Company") as data controller, within the scope described below.

2. Categories of Personal Data

Depending on your relationship with the Company, the following categories may be processed:

• Identity data: name, surname, job title.
• Contact data: e-mail address, telephone number, business address.
• Customer transaction data: enquiry, quotation, contract and support records.
• Transaction security data: website access records, IP address, log records.
• Professional experience data: CV content where a job application is made.

3. Purposes of Processing

• Responding to enquiries and complaints and conducting communication activities.
• Preparing quotations and managing contract processes and after-sales support.
• Managing procurement and supply chain processes.
• Conducting information security processes and securing the website.
• Providing information to authorised public bodies and meeting legal obligations.
• Managing job application processes.

4. Legal Grounds

Your personal data is processed on the legal grounds set out in Article 5 of the Law: processing being directly related to the conclusion or performance of a contract, being mandatory for the controller to fulfil a legal obligation, being mandatory for the establishment, exercise or protection of a right, and being necessary for the legitimate interests of the controller provided that the fundamental rights of the data subject are not harmed. Where none of these grounds apply, your explicit consent is sought.

5. Method of Collection

Your personal data is collected through contact and application forms on the website, e-mail, telephone, contract processes, tender files and physical documents, by partly automated and non-automated means.

6. Transfers

Your personal data may be transferred to authorised public institutions in order to meet legal obligations, to suppliers and business partners involved in performing the service, and to hosting and IT service providers, in accordance with Articles 8 and 9 of the Law. Transfers abroad are made only where the conditions set out in the Law are met.

7. Retention

Your personal data is retained for the periods prescribed by legislation and for as long as the purpose of processing requires; at the end of that period it is erased, destroyed or anonymised in line with our Personal Data Retention and Destruction Policy.

8. Your Rights

Under Article 11 of the Law you have the right to learn whether your personal data is processed, to request information if it has been processed, to learn the purpose of processing and whether the data is used in accordance with that purpose, to know the third parties to whom data is transferred at home or abroad, to request correction of incomplete or inaccurate data, to request erasure or destruction, to request that such actions be notified to third parties, to object to a result arising against you from analysis solely by automated systems, and to claim compensation for damage arising from unlawful processing.

9. How to Apply

You may submit your requests in writing to the Company address together with information verifying your identity, or send them from the e-mail address registered in our systems to info@elitarge.com. Applications are concluded as soon as possible and at the latest within thirty days, depending on the nature of the request.