Personal Data Protection Processing Information Notice

1. Data Controller

In accordance with the Turkish Personal Data Protection Law No.6698 (“the Law”), your personal data is processed by TFI TAB Gıda Yatırımları Anonim Şirketi (“TFI” or the “Company”) as data controller.

2. Methods of Collecting Your Personal Data, Purposes of Processing, Legal Basis, and Transfers

IF YOU CONTACT US BY PHONE
Phone Call Processes
Personal Data Purpose of Processing Legal Basis Method of Collection

Identity Information
(Name, Surname)

Contact Information
(Phone number, e-mail address)

Audio Records
(Voice Recordings)

  • Evaluation, resolution, and finalization of your requests, complaints, and suggestions
  • Conducting satisfaction processes
  • Managing internal company processes regarding sustainability reports
 Processing of data is necessary for the legitimate interests pursued by the data controller Collected partially through automated means via phone call recordings
The personal data processed in this process may be transferred to our group companies, affiliated companies managed by the same individuals, and legal advisors from whom we receive services, based on the purpose of legal proceedings and the condition of “necessity for the legitimate interests of the data controller.” Additionally, if subject to a legal dispute and/or requested by public institutions and organizations in accordance with the law, such data may be transferred to authorized public institutions and organizations based on the legal basis of “necessity for compliance with a legal obligation.”
VISITORS
Visitor Registration Processes
Personal Data Purpose of Processing Legal Basis Method of Collection

Identity Information
(Name, Surname)

Contact Information
(Phone number)

Physical Security
(Visit Information)

  • Ensuring physical space security
  • Maintaining visitor records
 Processing of data is necessary for the legitimate interests pursued by the data controller Collected partially through automated means via visitor logbook
The personal data processed in this process may be transferred, based on the same purposes and legal basis, to our suppliers from whom we receive services in this regard; to our group companies, affiliated companies managed by the same individuals, and legal advisors from whom we receive services, for the purpose of pursuing and conducting legal affairs and based on the legal basis of " Processing of data is necessary for the legitimate interests pursued by the data controller ."Additionally, the relevant data may be transferred to authorized public institutions and organizations in the event that they become the subject of a legal dispute and/or are lawfully requested by public authorities, on the legal basis of“necessity for compliance with a legal obligation.”
Securıty Camera Recordıngs
Personal Data Purpose of Processing Legal Basis Method of Collection

Physical Security
(CCTV Recordings)

  • Ensuring physical space security
 Processing of data is necessary for the legitimate interests pursued by the data controller Collected partially or fully via automated means through security cameras at the company
The personal data processed in this process may be transferred, based on the same purposes and legal basis, to our suppliers from whom we receive services in this regard; to our group companies, affiliated companies managed by the same individuals, and legal advisors from whom we receive services, for the purpose of pursuing and conducting legal affairs and based on the legal basis of “Processing of data is necessary for the legitimate interests pursued by the data controller ."Additionally, the relevant data may be transferred to authorized public institutions and organizations in the event that they become the subject of a legal dispute and/or are lawfully requested by public authorities, on the legal basis of “necessity for compliance with a legal obligation.”
ONLINE USERS
For details regarding personal data processed via cookies during your website visit, please review our Cookie Information Notice.
BUSINESS PARTNER / SUPPLIER REPRESENTATIVES AND EMPLOYEES
Contract Processes
Personal Data Purpose of Processing Legal Basis Method of Collection

Identity Information
(Name, Signature, ID Number, Info on ID, Signature Circular, Tax Number)

Contact Information
(Phone, Address, Email address, Fax number)

Financial Information
(Balance Sheet, Financial Performance Information)

Personnel Information
(Title, Position, and Employer Corporation)

  • Managing contract processes
  • Establishment and review of contract
  • Providing legal opinions when necessary
 Processing personal data of the parties of a contract is necessary Provided by you during business relations with our company (partially automated or manual)
In the event that your personal data processed during this process becomes the subject of a legal dispute and/or is lawfully requested by public institutions and organizations, it may be transferred: (i) to authorized public institutions and organizations based on the following condition “Necessity for compliance with a legal obligation.” and (ii) to our group companies, affiliated companies managed by the same individuals, and legal advisors from whom we receive services, for the purpose of pursuing and conducting legal affairs, based on the legal basis of “necessity for compliance with a legal obligation.”
Finance-Accounting Processes
Personal Data Purpose of Processing Legal Basis Method of Collection

Identity Information
(Name, Surname, Signature, ID Number, Tax Number)

Financial Information
(Bank Account, IBAN, Bond Info, Letter of Guarantee, Check Info, Invoice Info, Reconciliation Data, Tax Plate, Trade Registry Info, Activity Certificate)

Contact Information
(Phone, Address, Email address, Fax number)

  • Processing payments
  • Reconciliation of current accounts
  • Billing and tracking receivables/payables
  • Fulfilling legal obligations
  • Managing accounting and financial processes
  • E-archive and e-invoice processes
  • Expressly provided for by the laws.
  • It is necessary for compliance with a legal obligation to which the data controller is subject.
 Provided during business relations with our company (partially automated or manual)
The personal data processed in this process may be transferred based on the legal basis of “being necessary for the legitimate interests of the data controller” to: (i) the banks we receive services from, for the purpose of processing payments, (ii) the accounting, finance, and tax consultants we work with, for the purpose of managing accounting and financial affairs, and (iii) our group companies, affiliated companies managed by the same individuals, and legal advisors from whom we receive services, for the purpose of pursuing and conducting legal affairs. In addition, your personal data will be transferred to public institutions and organizations for the purpose of fulfilling our legal obligations and based on the relevant legal basis.
Communication Processes
Personal Data Purpose of Processing Legal Basis Method of Collection

Identity Information
(Name, Surname, Signature)

Contact Information
(Phone, Address, Email address)

Personnel Information
(Role, Title, Position, and Employer Corporation)

  • Business and communication management
  • Planning and execution of corporate communication activities
  • Processing of data is necessary for the legitimate interests pursued by the data controller
  • Processing of personal data of the parties of a contract is necessary
 Provided during business relations with our company (partially automated or manual)
The personal data processed in this process may be transferred, for the same purposes, to our group companies and affiliated companies managed by the same individuals, based on the legal basis of “being necessary for the legitimate interests of the data controller.
Business and Project Processes
Personal Data Purpose of Processing Legal Basis Method of Collection

Identity Information
(Name, Surname)

Contact Information
(E-mail address)

Personnel Information
(Role, Title, Position, and Employer Corporation)

Transaction Security Information
(Username, records of actions performed on the application, log records)

Other
(Project-specific Info and Activities)

  • Executing necessary projects and operations within the scope of business processes
  • Monitoring, managing, and executing sustainability projects
  • Processing of data is necessary for the legitimate interests pursued by the data controller
  • Processing of personal data of the parties of a contract is necessary
 Provided during business relations with our company (partially automated or manual)
The personal data processed in this process may be transferred, for the same purposes, to our group companies and affiliated companies managed by the same individuals, based on the legal basis of “being necessary for the legitimate interests of the data controller.
Legal and Audit Processes
Personal Data Purpose of Processing Legal Basis Method of Collection

Identity Information
(Name, Signature, ID Number, Info on ID, Signature Circular, Tax Number)

Contact Information
(Phone, Address, Email address, Fax number)

Financial Information
(Balance Sheet, Financial Performance, Bank Info, IBAN, Bonds, Guarantees, Checks, Invoices, Reconciliation, Tax Info, Trade Registry, Activity Certificate)

Personnel Information
(Role, Title, Position, and Employer Corporation)

Transaction Security Information Info
(Username, Activity Log records)

Legal Transaction Info
(Correspondence with Judicial Authorities, Case Details, Signature, Signature Circular)

Diğer
(Contract Information: Party details that may be included in contracts, full name, signature, Turkish ID number, information on the identity document, signature circular details, tax number)

  • Fulfilling legal obligations arising from legislation
  • Establishment/termination/cancellation of contractual relationships
  • Meeting obligations towards authorized institutions
  • Exercising legal rights in case of disputes
  • Managing negotiation and resolution of disputes
  • Retaining documents required under legal regulations
  • Providing requested information
  • Conducting reporting and audit activities
  • It is necessary for compliance with a legal obligation to which the data controller is subject.
  • Data processing is necessary for the establishment, exercise or protection of any right.
  • Processing of personal data of the parties of a contract is necessary
  • Processing of data is necessary for the legitimate interests pursued by the data controller
 Şirketimizle ticari ilişki kurulması sırasında tarafımıza bildirmeniz yoluyla (kısmen otomatik ve otomatik olmayan yollarla)
The personal data processed in this process may be transferred, based on the legal basis of “Processing of data is necessary for the legitimate interests pursued by the data controller”; (i) to the tax consultants from whom we receive services for the purpose of carrying out tax processes, and (ii) to our group companies, affiliated companies managed by the same real persons, and legal consultants from whom we receive services for the purpose of conducting and following up legal affairs. In addition, your personal data may also be transferred to public institutions and organizations based on the purpose and legal basis of fulfilling our legal obligations.
COMPANY SHAREHOLDER / COMPANY SHAREHOLDER REPRESENTATIVES / MEMBERS OF THE BOARD OF DIRECTORS
Corporate Governance Processes
Personal Data Purpose of Processing Legal Basis Method of Collection

Identity Information
(Name-surname, gender, mother's name, father's name, Turkish ID number, nationality, other identity information)

Contact Information
(Email address, residential address, mobile phone number, (if any) Registered Electronic Mail (REM) address)

Visual Records
(Photograph)

Personnel Information
(Title, position)

Legal Transaction Information
(Power of attorney information, manner, form, and duration of granted authority)

  • Issuance of power of attorney and signature circulars for individuals to whom power of attorney or signing authority will be granted by the company
  • Conducting the preparation of signature circulars
  • Conducting and supervision of business activities
  • Monitoring and management of legal affairs
  • Processing of data is necessary for the legitimate interests pursued by the data controller
  • Data processing is necessary for the establishment, exercise or protection of any right.
 Through verbal communication or email from you, and through the use of existing data in company systems (partially automated and non-automated means)
The personal data processed in this process may be transferred, based on the legal basis of “ Processing of data is necessary for the legitimate interests pursued by the data controller,” to: (i) tax consultants from whom we receive services for the purpose of executing tax processes, (ii) our group companies, affiliated companies managed by the same real persons, and legal consultants from whom we receive services for the purpose of conducting and following up legal affairs. In addition, such personal data may be transferred to public institutions and organizations based on the purpose and legal basis of fulfilling our legal obligations.
Board of Directors and General Assembly Meetings Processes
Personal Data Purpose of Processing Legal Basis Method of Collection

Identity Information
(Name-surname, gender, mother’s name, father’s name, Turkish ID number, nationality, other identity information)

Contact Information
(Email address, residential address, mobile phone number, (if any) REM address)

Visual Records
(Photograph)

Personnel Information
(Title, position)

Legal Transaction Information
(Power of attorney information, manner, form, and duration of granted authority)

  • Preparation of board and general assembly resolutions,
  • Execution of signature processes
  • Execution of registration processes before trade registry offices
  • Conducting activities in accordance with legislation
  • Monitoring and management of legal affairs
  • It is necessary for compliance with a legal obligation to which the data controller is subject.
  • Data processing is necessary for the establishment, exercise or protection of any right.
 Via your submission and/or directly from you within the scope of Board of Directors and General Assembly meetings (partially automated and non-automated means)
The personal data processed in this process may be transferred, based on the legal basis of “Processing of data is necessary for the legitimate interests pursued by the data controller” to: (i) tax consultants from whom we receive services for the purpose of executing tax processes, (ii) our group companies, affiliated companies managed by the same real persons, and legal consultants from whom we receive services for the purpose of conducting and following up legal affairs, and (iii) independent audit firms from whom we receive services for the purpose of conducting audit processes. In addition, such personal data may be transferred to public institutions and organizations based on the purpose and legal basis of fulfilling our legal obligations.

3. Your Rights Regarding Your Personal Data

We would like to remind you that under Article 11 of the Law on the Protection of Personal Data (KVKK), you have the following rights:

You can submit your requests regarding the above-mentioned rights to our Company by filling out the Data Subject Application Form, which can be accessed at www.tabfoods.com, or by sending an email to kvkk@tabfoods.com, in accordance with the Communique On The Principles And Procedures For The Request To Data Controller. Your application will be concluded free of charge as soon as possible and within thirty days at the latest, depending on the nature of your request. If the process requires an additional cost, you may be charged a fee according to the tariff determined by the Personal Data Protection Board.