Privacy Notice

1. Data Controller

As LIKROM ANALİTİK ÇÖZÜMLER PAZ. SAN. VE TİC. A.Ş. (“Likrom” or the “Company”), acting as data controller under Law No. 6698 on the Protection of Personal Data (the “KVKK”), we attach importance to processing and protecting your personal data lawfully.

This Privacy Notice has been prepared in relation to the processing of the personal data of natural persons who contact Likrom, use our website, request information about our products and services, are customers or business partners, or attend events and organisations held by Likrom.

2. Personal Data Processed

Depending on the nature of the activity, the following categories of personal data may be processed:

• Identity data: Name, surname and similar information,
• Contact data: Telephone number, email address, address and your other contact details,
• Customer and transaction data: Information relating to requests, quotations, orders, contracts and sales processes,
• Request and communication data: Information relating to the requests, questions, suggestions and complaints you submit to us,
• Transaction security data: IP address, technical information on the use of the website, access records and log records,
• Marketing data: Preference and interest information regarding products and services, and information obtained within the scope of marketing activities,
• Professional data: The organisation you work for, your title and role information,
• Visual and audio records: Visual and audio records obtained in compliance with the legislation at events, meetings or organisations,
• Job application data: In the event of a job application, the CV and the information required in the candidate evaluation process.

Detailed information on the cookies used on our website is provided separately in the Cookie Policy.

3. Purposes of Processing Personal Data

Your personal data may be processed for the following purposes, in accordance with the conditions set out in Articles 5 and 6 of the KVKK:

• Responding to your requests for information about our products and services,
• Carrying out request, quotation, order and sales processes,
• Providing products and services and fulfilling contractual obligations,
• Carrying out after-sales support and customer relations processes,
• Improving the quality of products and services,
• Carrying out communication processes with customers and business partners,
• Planning and carrying out commercial activities and business processes,
• Managing processes conducted with business partners and suppliers,
• Fulfilling legal and financial obligations,
• Responding to requests from authorised public institutions and organisations,
• Carrying out information security processes,
• Ensuring the security of the website and the information technology infrastructure,
• Planning and implementing our Company's commercial and business strategies,
• Planning and carrying out events, fairs, meetings and organisations,
• Evaluating job applications and carrying out human resources processes,
• Fulfilling statutory retention and archiving obligations,
• Ensuring the legal, commercial and operational security of our Company and of the persons and organisations with which it has a business relationship.

Your personal data may also be used in marketing and commercial communication activities relating to our products and services, only where necessary and where the relevant legal conditions are met.

For processing activities that require explicit consent, your activity-specific explicit consent is obtained separately from the duty to inform. Acceptance of this Privacy Notice does not by itself constitute explicit consent.

4. Legal Grounds for Processing Personal Data

Depending on the nature of the specific processing activity, your personal data may be processed on the following legal grounds:

• It is expressly provided for by law,
• It is directly related and necessary for the conclusion or performance of a contract,
• It is mandatory for our Company to fulfil its legal obligation,
• Processing is mandatory for the establishment, exercise or protection of a right,
• Processing is mandatory for the legitimate interests of our Company, provided that it does not harm your fundamental rights and freedoms,
• The explicit consent of the data subject is present.

Where special categories of personal data must be processed, we act in accordance with the relevant conditions set out in Article 6 of the KVKK.

5. Methods of Collecting Personal Data

Your personal data may be collected by automated or non-automated means through;

• The Likrom website,
• The contact and information request forms on our website,
• Email, telephone and other communication channels,
• Contractual and commercial relationship processes,
• Fairs, congresses, meetings, training sessions and similar organisations,
• Job applications,
• Business partners, suppliers and other third parties,
• Physical visits,
• Cookies and technical tools on the website.

Your personal data is obtained on the legal ground required within the scope of the relevant activity and in accordance with the duty to inform set out in Article 10 of the KVKK.

6. Transfer of Personal Data

In accordance with the conditions set out in Articles 8 and 9 of the KVKK and with the necessary security measures in place, your personal data may be transferred to;

• Authorised public institutions and organisations,
• Legally authorised private persons and organisations,
• Our business partners,
• Our suppliers,
• The consultants and service providers from which we receive services,
• Information technology, software, hosting, infrastructure and technical service providers,
• Legal, financial advisory, audit and similar professional service providers,
• Other authorised third parties, where necessary for carrying out our Company's activities.

The purpose of the transfer is to carry out contractual and commercial processes, provide services, manage information technology and operational processes, fulfil legal and financial obligations, ensure information security and conduct our Company's commercial activities.

7. Transfer of Personal Data Abroad

Where your personal data must be processed through service providers, technical infrastructures or other recipients located abroad, or must be transferred abroad, the transfer is carried out in accordance with Article 9 of the KVKK and the conditions set out in the relevant secondary legislation.

Where a transfer abroad is required, the legal mechanism applicable to the specific case is applied: an adequacy decision, appropriate safeguards, or one of the exceptional transfer conditions set out in the Law.

Depending on the nature of the transfer abroad, standard contracts, binding corporate rules or other appropriate safeguard mechanisms provided for in the legislation may be used.

Where our Company transfers personal data abroad, it acts in accordance with the obligations set out in the KVKK and the relevant legislation.

8. Retention Period of Personal Data

Your personal data is retained for the period required by the relevant processing purpose and to the extent required by that purpose.

However, where a longer retention period is provided for in the relevant legislation, or where retaining the data for a longer period is necessary due to our Company's legal obligations, limitation periods, the pursuit of disputes and similar legitimate reasons, personal data may be retained for the period provided for in the legislation or required by the relevant legal ground.

Upon expiry of the retention period, or where the reasons requiring the processing of personal data cease to exist, your personal data is deleted, destroyed or anonymised in accordance with the KVKK and the relevant legislation.

9. Security of Personal Data

Likrom takes the necessary technical and administrative measures to prevent the unlawful processing of and access to personal data, the unlawful transfer of personal data, and the loss of or damage to personal data.

In this context, taking into account the nature of the personal data and the risks of the processing activity, access authorisations, information security measures, technical controls, retention and destruction processes and other necessary security measures are implemented.

10. Your Rights Under the KVKK

Under Article 11 of the KVKK, as a data subject you have the right to;

• Learn whether your personal data is processed,
• Request information if your personal data has been processed,
• Learn the purpose of processing your personal data and whether it is used in accordance with that purpose,
• Know the third parties in Türkiye or abroad to whom your personal data is transferred,
• Request the correction of your personal data if it has been processed incompletely or inaccurately,
• Request the deletion or destruction of your personal data where the conditions set out in the KVKK are met,
• Request that the correction, deletion or destruction of your personal data be notified to the third parties to whom it has been transferred,
• Object to an outcome to your detriment arising from the analysis of the processed data exclusively by automated systems,
• Claim compensation for damage you suffer as a result of the unlawful processing of your personal data.

11. Applying to Exercise Your Rights

You may submit your requests regarding your rights under the KVKK to;

LIKROM ANALİTİK ÇÖZÜMLER PAZ. SAN. VE TİC. A.Ş.

Address: Yukarı Dudullu Mahallesi, Tavukçuyolu Caddesi, No: 243, 34775 Ümraniye / Istanbul

Email: kvkk@likrom.com

using whichever of the application methods set out in the KVKK and the relevant secondary legislation is appropriate.

In order to verify that the application has been made by the data subject, the application may need to include the necessary identity and contact details.

Your application must contain;

• Name and surname,
• Signature, if the application is made in writing,
• Turkish ID number for citizens of the Republic of Türkiye; nationality, passport number or ID number, if any, for foreigners,
• Residence or workplace address for the purpose of notification,
• Email address, telephone and fax number for notification, if any,
• The subject of the request.

Applications are concluded as soon as possible and within thirty days at the latest, depending on their nature. Where the application requires an additional cost, the fee set out in the tariff determined under the KVKK may be charged.

If your application is rejected, if you find the response insufficient or if no response is provided within the applicable period, you may file a complaint with the Personal Data Protection Board within the framework of the conditions set out in the KVKK.

12. Entry Into Force

This Privacy Notice enters into force as of the date on which it is published.

Likrom may update this Privacy Notice in line with changes in the legislation or changes in its personal data processing activities.

Data Controller:

LIKROM ANALİTİK ÇÖZÜMLER PAZ. SAN. VE TİC. A.Ş.

Address: Yukarı Dudullu Mahallesi, Tavukçuyolu Caddesi, No: 243, 34775 Ümraniye / Istanbul

Email: info@likrom.com

Website: www.likrom.com

This English text is a courtesy translation of the Turkish Privacy Notice; in case of any discrepancy, the Turkish version prevails.