Personal Data Protection Disclosure Statement
Your privacy is respected and your data security is prioritized by AFC Consulting. In this context, this text has been prepared to inform and enlighten you in accordance with the Law on the Protection of Personal Data No. 6698 (“Law”) and other relevant legislation.

1. IDENTITY OF THE DATA CONTROLLER
Your personal data may be processed by AFC Consulting as the data controller, within the scope explained below, in accordance with the Law on the Protection of Personal Data No. 6698 (“Law”).

2. PURPOSE OF PROCESSING PERSONAL DATA
a) Your personal data will be processed to carry out the necessary operational activities within our company to ensure that the products and services offered by our company can be provided to you,
b) To conduct necessary activities with relevant departments and business partners to recommend products and services that match your consumption and purchasing motivation,
c) To manage human resources by our company, ensure the rights of real persons, take necessary steps for the commercial decisions of our company, and secure the legal safety of the real and legal persons we have business relations with, as well as our company,
d) To monitor finance and accounting operations,
e) To plan and execute business continuity activities,
f) To plan, audit, and implement information security processes,
g) To establish and manage information technology infrastructure,
h) To plan and carry out corporate communication activities,
i) To plan and execute logistics activities,
j) To plan and implement access rights to information for business partners and suppliers,
k) Event management,
l) To plan and execute business activities,
m) To plan and execute supply chain management processes,
n) To plan and execute corporate governance activities,
o) To plan and execute activities related to efficiency, productivity, and relevance analyses of business operations,
p) To plan and execute corporate sustainability activities,
q) To monitor contract processes and/or legal claims,
r) To plan and execute product and/or service sales processes,
s) To plan and execute customer relationship management processes,
t) To plan and/or execute post-sales support service activities,
u) To collect and evaluate customer complaints, requests, and suggestions,
v) To plan and execute additional services supporting sales,
w) To plan loyalty and campaign management processes and customer satisfaction activities and/or execution.

3. CASES WHERE PERSONAL DATA CAN BE PROCESSED WITHOUT CONSENT
Your personal data may be processed by AFC Consulting, as the Data Controller, without obtaining your explicit consent in the following cases:
a) When it is mandatory to protect the life or physical integrity of the person who is unable to express consent due to actual impossibility or whose consent is not legally valid, either for themselves or someone else,
b) When processing personal data of the parties to a contract is necessary for the performance of that contract,
c) When it is mandatory for the data controller to fulfill legal obligations,
d) When the personal data has been made public by the data subject themselves,
e) When data processing is necessary for the establishment, exercise, or protection of a right,
f) When data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject,

4. METHOD OF PROCESSING PERSONAL DATA

The processing of your personal data refers to any operation performed on the data, whether fully or partially automated or non-automated as part of any data recording system, including obtaining, recording, storing, preserving, modifying, reorganizing, disclosing, transferring, acquiring, making accessible, classifying, or preventing the use of the data. In accordance with the Law, your personal data may be processed by AFC Consulting as the Data Controller within the scope explained in this text.

5. TO WHOM AND HOW THE PROCESSED PERSONAL DATA WILL BE TRANSFERRED

The personal data collected may be transferred to our business partners, suppliers, shareholders, legally authorized public institutions, and private individuals for the purposes of ensuring the legal and commercial security of our company and those we have business relationships with; enabling our relevant departments to carry out necessary activities to provide you with the products and services offered by our company; customizing and recommending our products and services according to your preferences, usage habits, and needs; determining and implementing our company's commercial and business strategies; and managing our human resources policies, all within the framework of the personal data processing conditions and purposes specified in Articles 8 and 9 of the Law on the Protection of Personal Data.

6. METHOD AND LEGAL BASIS FOR COLLECTING PERSONAL DATA

Your personal data is collected by our company through various channels and based on different legal grounds for the purpose of conducting our commercial activities. The personal data collected on this legal basis may also be processed and transferred for the purposes specified in Articles 5 and 6 of the Law on the Protection of Personal Data, as well as for the purposes outlined in sections (b) and (c) of this text.

7. RIGHTS OF THE DATA SUBJECT

ChatGPT: The rights of the Data Subject listed in Article 11 of the Law on the Protection of Personal Data (KVK Law) may be exercised by submitting your requests regarding your rights as Data Subjects to our Company through the methods outlined below in this Disclosure Statement. Our Company will process and conclude your request free of charge as soon as possible, and at the latest within thirty days, depending on the nature of the request. However, if a fee is prescribed by the Personal Data Protection Board, the fee determined by our Company’s tariff will be charged. Within this scope, data subjects have the right to;
a) To learn whether personal data is being processed,
b) To request information if personal data has been processed,
c) To learn the purpose of processing personal data and whether it is used in accordance with its purpose,
d) To know the third parties to whom personal data is transferred, either domestically or abroad,
e) To request correction of incomplete or inaccurate personal data and to request that the third parties to whom the data has been transferred be notified of the correction,
f) To request the deletion or destruction of personal data if the reasons requiring its processing have ceased to exist, despite the data being processed in accordance with the Law on the Protection of Personal Data and other relevant legislation, and to request that the third parties to whom the data has been transferred be notified of this action,
g) To object to the emergence of a result against the person through the exclusive analysis of processed data by automatic systems,
h) To demand compensation in case of damage due to unlawful processing of personal data.
Pursuant to Article 13, paragraph 1 of the Law on the Protection of Personal Data, you can submit your requests to exercise the rights listed above in writing to our Company. The channels and procedures for submitting your written requests to our Company under Article 11 of the Law on the Protection of Personal Data are explained below.