MILAS CHAMBER OF COMMERCE AND INDUSTRY
INFORMATION NOTICE ON PROTECTION OF PERSONAL DATA

PURPOSE AND SCOPE OF THE INFORMATION NOTICE

At MİTSO, your personal data is processed and protected by Milas Chamber of Commerce and Industry as the data controller within the scope of Law No. 6698 on Protection of Personal Data ("PDPL" or "Law"). Your personal data is processed in accordance with the reasons, purposes and methods explained below within the scope of PDPL and relevant legislation.

This information notice has been prepared regarding personal data processed belonging to natural persons visiting the Website. Additionally, you can access our cookie policy that will be used when you visit our website at www.muglaticaretborsasi.org.tr.

SUBJECT OF THE INFORMATION NOTICE

MİTSO Information Notice on Processing of Personal Data has been prepared pursuant to Article 10 of PDPL titled "Data Controller's Obligation to Inform" in order to inform you in the most transparent manner about: the identity of the data controller, the method of collection and legal reason for your personal data, for what purpose this data will be processed, to whom and for what purpose it may be transferred, and what your rights are as listed in Article 11 of PDPL. For more detailed information on related subjects, please visit the organization's website www.muglaticaretborsasi.org.tr.

ABOUT THE PURPOSES FOR PROCESSING YOUR DATA, WITH WHOM AND FOR WHAT PURPOSES IT IS SHARED, AND TRANSFER ABROAD

By our organization, due to its activities; your verbal, written or electronic personal data is collected and processed due to the legislation to which our organization is subject (Milas Chamber of Commerce and Industry Internal Directive, Turkish Union of Chambers and Commodity Exchanges and Chambers and Commodity Exchanges Law, Regulations, Principles, Circulars and Ministry Opinions Issued Pursuant to Law No. 5174, Turkish Code of Obligations, Turkish Commercial Code, Consumer Protection Law, Labor Law, Revenue Administration regulations and regulations of other related institutions) and contracts to which we are party. Your personal data will be used for the purposes listed below.

Our organization undertakes not to use your personal data outside the above activities and purposes, and not to share your personal data with third parties except for legal obligations and cases required by official institutions.

Our organization may transfer your personal data in the following cases; with the explicit consent of WEBSITE VISITORS or pursuant to our legislative obligations, due to legal obligations to MİTSO business partners (you can learn detailed information about which MİTSO business partners are from our website), our affiliated units, our joint ventures, public institutions and organizations to which we are obliged to provide information and documents due to our legal obligations, institutions, suppliers, occupational safety units, business partners and banks with which we have agreements due to our activities and legal obligations, provided that adequate measures are taken and ensured to be taken.

Personal data belonging to WEBSITE VISITORS is not transferred abroad.

For more detailed information on the subject, you can review the "Personal Data Processing, Storage and Disposal Policy" available at www.mitso.org.tr.

PURPOSE OF PROCESSING YOUR PERSONAL DATA, COLLECTION METHOD, LEGAL REASON

1. IDENTITY INFORMATION: Name – Surname,

Purpose of Processing: Execution of Information Security Processes, Execution of Activities in Compliance with Legislation, Ensuring Security of Data Controller Operations, Providing Information to Authorized Persons, Institutions and Organizations, Execution of Communication Activities, Execution of Customer Relations Management Processes, Execution of Marketing Analysis Studies

Method of Data Collection: Collected through web applications, information systems and electronic devices and documents declared by you.

Legal Reason for Processing Your Data: Explicitly stipulated in laws as specified in Article 5 of PDPL (Art. 5 para 2/a), Being mandatory for the data controller to fulfill its legal obligation (Art. 5 para 2/c) and Being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (Art. 5 para 2/f)

2. CONTACT INFORMATION: E-Mail Address

Purpose of Processing: Execution of Information Security Processes, Execution of Activities in Compliance with Legislation, Ensuring Security of Data Controller Operations, Providing Information to Authorized Persons, Institutions and Organizations, Execution of Communication Activities, Execution of Customer Relations Management Processes, Execution of Marketing Analysis Studies

Method of Data Collection: Collected through web applications, information systems and electronic devices and documents declared by you.

Legal Reason for Processing Your Data: Explicitly stipulated in laws as specified in Article 5 of PDPL (Art. 5 para 2/a), Being mandatory for the data controller to fulfill its legal obligation (Art. 5 para 2/c) and Being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (Art. 5 para 2/f)

3. TRANSACTION SECURITY INFORMATION: IP address, Website login/logout information, Password information, Log records, Device IMEI number, Device MAC address

Purpose of Processing: Execution of Information Security Processes, Execution of Activities in Compliance with Legislation, Ensuring Security of Data Controller Operations, Providing Information to Authorized Persons, Institutions and Organizations, Execution of Communication Activities, Execution of Customer Relations Management Processes, Execution of Marketing Analysis Studies

Method of Data Collection: Collected through web applications, information systems and electronic devices and documents declared by you.

Legal Reason for Processing Your Data: Explicitly stipulated in laws as specified in Article 5 of PDPL (Art. 5 para 2/a), Being mandatory for the data controller to fulfill its legal obligation (Art. 5 para 2/c) and Being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (Art. 5 para 2/f)

4. MARKETING INFORMATION: Mandatory Cookie records

Purpose of Processing: Execution of Information Security Processes, Execution of Activities in Compliance with Legislation, Ensuring Security of Data Controller Operations, Providing Information to Authorized Persons, Institutions and Organizations, Execution of Communication Activities, Execution of Customer Relations Management Processes, Execution of Marketing Analysis Studies

Method of Data Collection: Collected through web applications, information systems and electronic devices and documents declared by you.

Legal Reason for Processing Your Data: Explicitly stipulated in laws as specified in Article 5 of PDPL (Art. 5 para 2/a), Being mandatory for the data controller to fulfill its legal obligation (Art. 5 para 2/c) and Being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject (Art. 5 para 2/f)

YOUR RIGHTS UNDER PDPL

Regarding your personal data, you have the following rights according to PDPL Art. 11 and relevant legislation:

• a. To learn whether personal data is processed,
• b. To request information if personal data has been processed,
• c. To learn the purpose of processing personal data and whether they are used in accordance with this purpose,
• d. To know the third parties to whom personal data is transferred domestically or abroad,
• e. To request correction of personal data if it has been processed incompletely or incorrectly, and to request notification of the transaction made in this context to third parties to whom personal data has been transferred,
• f. To request deletion or destruction of personal data in the event that the reasons requiring processing no longer exist, even though it has been processed in accordance with PDPL and other relevant laws, and to request notification of the transaction made in this context to third parties to whom personal data has been transferred,
• g. To object to a result arising against the person due to analysis of processed data exclusively through automated systems,
• h. To request compensation for damages in case of loss due to unlawful processing of personal data.
• i. To request deletion / destruction within the framework of the conditions stipulated in Article 7 of PDPL,

You can use your above-mentioned rights at any time by applying to our KEP address given below and filling out the "Data Controller Application Form" available on our website (www.mitso.org.tr) and sending it to our address by physical mail. Applications made outside the listed application methods will not be considered.

MEASURES TAKEN BY US FOR PROTECTION OF PERSONAL DATA

As MİTSO, we protect your personal data by taking all possible measures. As MİTSO, the protection of your personal data is an important issue for our corporate identity. In this regard, our organization takes necessary technical and administrative measures to maintain personal data in a reliable environment, to prevent unauthorized access to personal data or loss of this information, to prevent misuse of personal data, and to prevent disclosure, modification or destruction of personal data by third parties.

Our organization undertakes to take necessary measures immediately in case of any data breach or suspicion of breach, and to immediately notify you who have the status of data subject and the Personal Data Protection Board.

ABOUT CURRENCY AND ACCURACY OF PERSONAL DATA

Those who share their personal data with our University acknowledge and declare that they know the accuracy and up-to-date maintenance of this information is important both in terms of Law No. 6698 on Protection of Personal Data and other relevant legislation, and that all responsibilities arising from providing incorrect information will belong entirely to them.

You can make necessary notifications regarding changes and/or updates to your shared personal data to the KEP address, E-mail address or organization address specified below by physical mail.

DELETION, DESTRUCTION OR ANONYMIZATION OF PROCESSED PERSONAL DATA

Your personal data will be processed in compliance with data processing periods in all relevant laws and other legislation to which our organization and the centers and units affiliated to our organization are subject, limited to the purposes specified in this information notice. In case of changes in data processing periods in laws, the newly determined periods will be taken as basis.

Your personal data, as a requirement of the purpose limitation principle, is processed for the period required for processing in accordance with PDPL Art. 7/para.1, Turkish Penal Code Art. 138, measures taken and in any case Higher Education Law applications and customs of educational life, limited to the purposes explained in this Information Notice, and after the expiry of these periods, is deleted, destroyed or anonymized.

IDENTITY OF DATA CONTROLLER

Milas Chamber of Commerce and Industry
Hq: Milas Chamber of Commerce and Industry | Hayıtlı Mah. 23 Nisan Bulvarı No:172 Milas/MUĞLA
Tel: +90 252 5121118

APPLICATION TO DATA CONTROLLER

To exercise your rights above and achieve your other purposes, you can submit your complaints and applications to us:

• By sending to the organization headquarters with documents verifying your identity,
• By applying in person to one of MİTSO branches, provided that you verify your identity,
• By sending to our KEP address mitso@hs01.kep.tr using Registered Electronic Mail (KEP) address and secure electronic signature or mobile signature,
• By sending from the electronic mail address previously notified and registered in our system as data subject to our address info@mitso.org.tr.

Pursuant to the Communiqué on Procedures and Principles of Application to Data Controller, it is mandatory that the data subject's application includes name, surname, signature if the application is in writing, Turkish ID number (passport number if the applicant is a foreigner), residence or workplace address for notification purposes, electronic mail address for notification if any, telephone and fax number, and information regarding the subject of request.

The data subject must clearly and understandably indicate the requested matter in the application that will be made to exercise the above-mentioned rights and contains explanations regarding the right requested to be exercised. Information and documents related to the application must be attached to the application.

Although the subject of the request must be related to the applicant's own person, if acting on behalf of another person, the applicant must be specifically authorized for this purpose and this authorization must be documented (special power of attorney). Additionally, the application must include identity and address information and documents verifying identity must be attached to the application.

Requests made by unauthorized third parties on behalf of others will not be considered.