PERSONAL DATA PROTECTION AND PROCESSING POLICY 30.10.2026

INTRODUCTION

Through this policy, Arven Global Gıda, Otomat, Dijital Kilit ve Bilişim Teknojileri Ltd. Şti. ("Arven Global") aims to carry out all its Personal Data Processing activities in the processing and protection of Personal Data in compliance with the applicable legislation under Law No. 6698 on the Protection of Personal Data ("Law") and its secondary regulations on the protection of Personal Data, and to ensure that the Personal Data it obtains is appropriately protected.

PURPOSE

This policy contains general explanations covering all Personal Data Processing activities carried out by Arven Global under the Law and all Data Subjects whose Personal Data is Processed. This Policy has been prepared with the aim of ensuring that compliance activities to be carried out within Arven Global for the purpose of complying with the Law regarding the Processing and protection of Personal Data are managed and coordinated at the highest level. In line with the principles set out herein, Arven Global will make the necessary arrangements in its internal operations to comply with this Policy and will establish the necessary system to raise the awareness of its Employees and business partners.

DEFINITIONS

The terms and explanations used in the Policy are set out below. Any terms not defined in this Policy shall be construed as defined in the Law and its secondary regulations.
Explicit Consent: Consent relating to a specific matter, based on information and expressed with free will.
Employee: Arven Global's employees, sub-employer employees, and interns.
Data Subject: The natural person or persons whose Personal Data is processed.
Law: Law No. 6698 on the Protection of Personal Data.
Personal Data: Any information relating to an identified or identifiable natural person.
Processing of Personal Data: Any operation performed upon Personal Data, such as collection, recording, storage, retention, alteration, reorganization, disclosure, transfer, takeover, making retrievable, classification, or preventing its use, whether wholly or partly by automated means, or by non-automated means provided that they form part of a Data Recording System.
Board:The Personal Data Protection Board.
Automated Data Processing: Data processing activity/activities carried out by devices with a processor, such as computers, telephones, tablets, and watches, occurring spontaneously without human intervention, within the scope of pre-prepared algorithms through software or hardware features.
Special Category Personal Data: Data relating to a person's race, ethnic origin, political opinion, philosophy, belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data.
Data Recording System: A recording system in which Personal Data is structured and processed according to specific criteria.

PRINCIPLES APPLICABLE TO THE PROCESSING OF PERSONAL DATA

Arven Global processes Personal Data in accordance with the general principles and provisions set out in the legislation in order to ensure compliance with the Law. In this context, the principles and requirements that must be taken into account by Arven Global in all Personal Data Processing activities are as follows:
Carrying Out Personal Data Processing Activities in Accordance with the Law and the Rules of Good Faith
Arven Global acts in accordance with the law and the rules of good faith within the scope of its Personal Data Processing activities. In this regard, Arven Global applies the principles of proportionality and necessity in the processing of Personal Data, taking care to process only as much Personal Data as is appropriate for the purposes of data processing.
Ensuring That Personal Data Is Accurate and, Where Necessary, Kept Up to Date
Arven Global takes care to ensure that the Personal Data it processes is accurate and up to date, and takes the necessary measures in this regard. Arven Global develops systems that allow Data Subjects to correct and update their Personal Data.
Processing for Specified, Explicit, and Legitimate Purposes
Arven Global processes Personal Data in a manner suitable for achieving the specified purposes and avoids processing Personal Data that is unrelated to or not required for the purpose. Arven Global does not carry out Personal Data Processing activities aimed at fulfilling a new purpose that arises after the Personal Data has been obtained.
Being Relevant, Limited, and Proportionate to the Purposes for Which They Are Processed
Arven Global retains Personal Data only for the periods stipulated by law or limited to the purpose for which it is processed. In this context, if a period is specified in the relevant legislation for the retention of Personal Data, Arven Global acts in accordance with that period. If no period has been specified, it retains Personal Data for the period necessary for the purpose for which it is processed.
Retention for the Period Stipulated in the Relevant Legislation or Required for the Purpose for Which It Is Processed
Arven Global retains Personal Data only for the periods stipulated by law or limited to the purpose for which it is processed. In this context, if a period is specified in the relevant legislation for the retention of Personal Data, Arven Global acts in accordance with that period. If a period has been specified, it retains Personal Data for the period necessary for the purpose for which it is processed.

CONDITIONS FOR THE PROCESSING OF PERSONAL DATA

As a rule, Personal Data is processed based on one or more of the Personal Data Processing conditions set out in Articles 5 and 6 of the Law. In this context, Arven Global assesses whether its Personal Data Processing activities fall within the scope of one of these conditions and halts any Personal Data Processing activity that is not based on one of these conditions. These conditions are set out below.
Processing of Personal Data
The conditions set out in Article 5 of the Law, which Arven Global relies on when processing Personal Data, are as follows.
  • The Data Subject's Explicit Consent has been obtained,
  • It is expressly stipulated by law,
  • It is mandatory for the protection of the life or physical integrity of the Data Subject or of another person, where the Data Subject is unable to give consent due to actual impossibility or whose consent is not legally valid,
  • It is necessary to process the Personal Data of the parties to a contract, provided that it is directly related to the establishment or performance of the contract,
  • It is necessary for the establishment, exercise, or protection of a right,
  • It is mandatory for Arven Global to process the Personal Data in order to fulfill its legal obligations,
  • The Personal Data has been made public by the Data Subject,
  • Data processing is mandatory for Arven Global's legitimate interests, provided that this does not harm the fundamental rights and freedoms of the Data Subject.
Of the Personal Data Processing conditions listed above, "the existence of the Data Subject's Explicit Consent" is relied upon only when none of the other data processing conditions applies. For example, if the processing of Personal Data is based on the condition that "it is necessary to process the Personal Data of a party to a contract, provided that it is directly related to the establishment or performance of the contract," Arven Global does not seek the Explicit Consent of the data subjects to process the relevant Personal Data.
Processing of Special Category Personal Data
While Article 5 of the Law regulates the conditions for the Processing of Personal Data, Article 6 of the Law regulates the conditions for the Processing of Special Category Personal Data. Special Category Personal Data is specified in the Law on a numerus clausus (exhaustive) basis. Due to the sensitivity of Special Category Personal Data, the data processing conditions also differ from those applicable to ordinary Personal Data.
Arven Global carries out its Special Category Personal Data Processing processes within the framework of the policy it has established, taking into account the adequate measures determined by the Board regarding the Processing of Special Category Personal Data.
Pursuant to Article 6 of the Law, Arven Global processes Special Category Personal Data where at least one of the following data processing conditions is present:
  • The Data Subject's Explicit Consent exists,
  • It is expressly stipulated by law,
  • It is mandatory for the protection of the life or physical integrity of the person themselves or another person, where the person is unable to give consent due to actual impossibility or whose consent is not legally valid,
  • It relates to Personal Data that has been made public by the Data Subject and is in accordance with their intention to make it public,
  • It is mandatory for the establishment, exercise, or protection of a right,
  • It is necessary for purposes of protecting public health, preventive medicine, medical diagnosis, treatment, and care services, and for planning, management, and financing of health services, by persons or authorized public institutions and organizations bound by an obligation of confidentiality,
  • It is mandatory for fulfilling legal obligations in the fields of employment, occupational health and safety, social security, social services, and social assistance,
  • It is carried out by foundations, associations, or other non-profit organizations or entities established for political, philosophical, religious, or trade-union purposes, in accordance with the legislation to which they are subject and their purposes, limited to their fields of activity, and not disclosed to third parties, directed towards their current or former members and affiliates or persons in regular contact with such organizations and entities.
Transfer of Personal Data
Arven Global may transfer the Personal Data it obtains for its Personal Data Processing purposes to third parties. The data transfers carried out by Arven Global vary according to each Personal Data Processing activity. Within the scope of its obligation to inform, Arven Global discloses to data subjects, through privacy notices, which third parties the Personal Data will be transferred to within the scope of each Personal Data Processing activity.
When transferring Personal Data to third parties, Arven Global attaches great importance to acting in accordance with the rules set out in Articles 8 and 9 of the Law and any additional regulations determined by the Board. In the process of transferring Personal Data, it carries out the transfer by taking the necessary security measures appropriate to the nature of the Personal Data.
In the process of transferring Special Category Personal Data, where one of the transfer conditions for Special Category Personal Data exists, the transfer may be carried out taking that transfer condition into account. Otherwise, the Explicit Consent of the Data Subject is sought for the transfer.
In order to carry out its activities in the most efficient manner and to benefit from the opportunities offered by technology, Arven Global also transfers your Personal Data abroad through information technology, while taking the necessary technical and administrative measures.

THE OBLIGATION TO INFORM DATA SUBJECTS AND THE RIGHTS OF DATA SUBJECTS

The Obligation to Inform Data Subjects
When obtaining Personal Data, Arven Global informs the persons whose data will be processed about how their data will be processed. In this context, in every process in which a Personal Data Processing activity is carried out, Arven Global first identifies the channels through which Personal Data is collected, and privacy notices specific to each channel are provided.
Where Personal Data is not obtained directly from the Data Subject, Arven Global carries out activities to inform the Data Subject;
  • within a reasonable period from the time the Personal Data is obtained,
  • if the Personal Data is to be used for the purpose of communicating with the Data Subject, at the time the first communication is established,
  • if the Personal Data is to be transferred, at the latest at the time of the first transfer of the Personal Data,
in accordance with the timelines above.
The Obligation to Respond to Applications from Data Subjects
Data Subjects may exercise their rights set out in Article 11 of the Law regarding their own data.
  • To learn whether their Personal Data is being processed,
  • To request information if their Personal Data has been processed,
  • To learn the purpose for which their Personal Data is processed and whether it is used in accordance with that purpose,
  • To know the third parties in the country or abroad to whom their Personal Data has been transferred,
  • To request the correction of Personal Data if it has been processed incompletely or incorrectly, and to request that this action be notified to third parties to whom the Personal Data has been transferred,
  • To request the deletion or destruction of Personal Data, even though it has been processed in accordance with the Law and other relevant legislation, in the event that the reasons requiring its processing no longer exist, and to request that this action be notified to third parties to whom the Personal Data has been transferred,
  • To object to a result arising against the person themselves due to the analysis of their processed data exclusively through automated systems,
  • To request compensation for damages in the event of damage due to the unlawful processing of Personal Data.
    • Data subjects may choose the following methods to exercise their rights:
  • Submitting their requests to kvkk@arvenglobal.com using the email address previously registered in our system,
  • Data Subjects may also choose other methods specified in the Communiqué on the Procedures and Principles of Application to the Data Controller to submit their requests.
Depending on the nature of the request, Arven Global responds to the relevant request free of charge as soon as possible and within thirty days at the latest; however, if the transaction requires an additional cost, a fee may be charged to the Data Subject in accordance with the tariff to be determined by the Board.
When evaluating requests, Arven Global verifies whether the person making the request is the genuine rights holder. As a result of the evaluation, it may accept the applications and take the necessary actions, or it may reject the applications with justification.

DESTRUCTION OF PERSONAL DATA

Even though it has been processed in accordance with the applicable legislation, if the reasons requiring the processing of the Personal Data it has processed no longer exist, Arven Global deletes, destroys, or anonymizes the relevant Personal Data, either on its own initiative and/or upon the request of the Data Subject.
In this context, a Personal Data Retention and Destruction Policy has been prepared. Arven Global reserves the right not to fulfill the Data Subject's request in cases where it has a right and/or obligation to retain Personal Data pursuant to the relevant legislation. Where Personal Data is also processed by non-automated means, provided that it forms part of a Data Recording System, a system of physically destroying the Personal Data in a manner that renders it unusable thereafter is applied when the data is deleted/destroyed. When Arven Global engages a person or organization to Process Personal Data on its behalf, the Personal Data is securely deleted by such persons or organizations in a manner that can never be recovered again. Arven Global may anonymize Personal Data that has been lawfully processed once the reasons requiring its Processing no longer exist.

ENTRY INTO FORCE AND AMENDMENTS

This policy has been prepared by Arven Global, reviewed by Arven Global's KVKK (Personal Data Protection) unit, and approved by Arven Global, and has entered into force.
This policy is reviewed by Arven Global whenever necessary or, in any case, at least once a year, and if amendments are made, such amendments are likewise approved by Arven Global.
This Policy has been prepared and entered into force in accordance with the applicable legislation, primarily the Law. While Arven Global will make every effort to update this Policy in line with changes that may occur in the applicable legislation, in the event of any conflict between the applicable legislation and the provisions of this Policy due to such changes, the provisions of the applicable legislation shall prevail.