{"id":11497,"date":"2026-07-23T14:38:56","date_gmt":"2026-07-23T11:38:56","guid":{"rendered":"https:\/\/rayvag.com.tr\/home\/kvkk-politikasi\/"},"modified":"2026-10-26T09:07:36","modified_gmt":"2026-10-26T06:07:36","slug":"kvkk-politikasi","status":"publish","type":"page","link":"https:\/\/rayvag.com.tr\/en\/home\/kvkk-politikasi\/","title":{"rendered":"KVKK Policy"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t

\n\t\t\t\t\tRAYVAG Vagon Sanayi A.\u015e. KVKK Policy\t\t\t<\/h3>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

1. PURPOSE<\/span><\/b><\/h1>

RAYVAG Wagon Industry and Trade Inc. <\/b>(\u201cRAYVAG\u201d or \u201cthe Company\u201d), we have placed great importance on the protection of personal data pertaining to all natural persons whose personal data we process through any means in the course of our commercial activities, as well as on the full compliance with our obligations under the Law on the Protection of Personal Data No. 6698 (\u201cKVKK\u201d or \u201cthe Law\u201d), effective as of the date the Law entered into force.<\/p>

The Personal Data Protection, Processing, and Privacy Policy (\u201cPolicy\u201d) has been prepared to inform you about the processes involved in the collection, processing, retention, and transfer of personal data by RAYVAG, as well as the principles we adhere to. This document is consistent with the policies in effect within RAYVAG. Information that is not required to be disclosed to the public and is not in the public interest has not been included.<\/p>

2. SCOPE<\/span><\/b><\/h1>

This policy applies to all personal data stored in digital or analog data recording systems\u2014for which RAYVAG<\/b> determines the purposes and means of processing and is responsible for their establishment and management\u2014and obtained from data subjects through automated or non-automated methods. These provisions apply to RAYVAG employees, job applicants, interns, suppliers and customers with whom RAYVAG has a business relationship\u2014including their employees and authorized representatives\u2014as well as visitors, subcontractor employees, and RAYVAG<\/p>

This covers all personal data storage and destruction activities for which RAYVAG<\/b> is recognized as the data controller.<\/p>

RAYVAG<\/b>\u2019s personal data processing activities, carried out in its capacity as a data processor, are governed by the provisions of the Law regarding the obligations of data processors.<\/p>

3. REFERENCES<\/span><\/b><\/h1>

\u2022 Law No. 6698 on the Protection of Personal Data (including amendments made by Law No. 7499)<\/p>

\u2022 Regulation on the Registry of Data Controllers<\/p>

\u2022 Regulation on the Erasure, Destruction, or Anonymization of Personal Data<\/p>

\u2022 Regulation on the Procedures and Principles Governing the Transfer of Personal Data Abroad<\/p>

\u2022 Communication on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Provide Information<\/p>

\u2022 Communication on the Procedures and Principles for Filing Requests with the Data Controller<\/p>

\u2022 Principle Decisions and Decisions of the Personal Data Protection Board<\/p>

\u2022 Board Decisions Regarding Adequate Measures to Be Taken by Data Controllers in the Processing of Special Category Personal Data<\/p>

\u2022 Provisions in other legislation regarding personal data and its processing<\/p>

4. DEFINITIONS AND ABBREVIATIONS<\/span><\/b><\/h1>

Abbreviation<\/span><\/b><\/p><\/td>

Definition<\/span><\/p><\/td><\/tr>

Explicit Consent<\/b><\/p><\/td>

Consent that is informed and freely given regarding a specific matter.<\/p><\/td><\/tr>

Buyer Group<\/b><\/p><\/td>

The category of natural or legal persons to whom the data controller transfers personal data.<\/p><\/td><\/tr>

Anonymization<\/b><\/p><\/td>

Ensuring that personal data is rendered incapable of being associated with an identified or identifiable natural person under any circumstances, even when combined with other data.<\/p><\/td><\/tr>

Binding Company Rules<\/b><\/p><\/td>

Rules approved by the Board that must be followed by companies within a group of enterprises engaged in a joint economic activity and that provide appropriate safeguards for the transfer of personal data abroad.<\/p><\/td><\/tr>

Relevant User<\/b><\/p><\/td>

Persons who process personal data within the data controller\u2019s organization or in accordance with the authority and instructions received from the data controller, excluding the person or unit responsible for the technical storage, protection, and backup of the data.<\/p><\/td><\/tr>

Destruction<\/b><\/p><\/td>

Data Subject: The erasure, destruction, or anonymization of personal data.<\/p><\/td><\/tr>

Relevant Person<\/b><\/p><\/td>

A natural person whose personal data is processed.<\/p><\/td><\/tr>

Contact Person<\/b><\/p><\/td>

The natural person designated by the data controller\u2014whether a legal entity established in Turkey or a representative of a legal entity not established in Turkey\u2014at the time of registration in the Registry, for the purpose of communicating with the Authority regarding the obligations of the data controller under the Law and secondary regulations.<\/p><\/td><\/tr>

Law\/KVKK<\/b><\/p><\/td>

Law No. 6698 on the Protection of Personal Data.<\/p><\/td><\/tr>

Recording Medium<\/b><\/p><\/td>

Any medium containing personal data that is processed fully or partially automatically, or processed by non-automated means provided that it forms part of a data filing system.<\/p><\/td><\/tr>

Personal Data<\/b><\/p><\/td>

Any information relating to an identified or identifiable natural person.<\/p><\/td><\/tr>

Personal Data Processing Inventory<\/b><\/p><\/td>

An inventory in which data controllers detail the personal data processing activities they carry out in accordance with their business processes; this inventory links these activities to the purposes of processing, the category of data, the group of recipients to whom the data is transferred, and the group of data subjects, and specifies the maximum retention period, the personal data intended for transfer to foreign countries, and the measures taken regarding data security.<\/p><\/td><\/tr>

Processing of Personal Data<\/b><\/p><\/td>

Any operation performed on personal data, such as the collection, recording, storage, retention, modification, reorganization, disclosure, transfer, acquisition, making available, classification, or restriction of use of such data, whether carried out by fully or partially automated means or by non-automated means provided that it forms part of a data filing system.<\/p><\/td><\/tr>

Board<\/b><\/p><\/td>

Personal Data Protection Board.<\/p><\/td><\/tr>

Organization<\/b><\/p><\/td>

Personal Data Protection Authority.<\/p><\/td><\/tr>

Sensitive Personal Data<\/b><\/p><\/td>

Data regarding an individual\u2019s race, ethnic origin, political views, philosophical beliefs, religion, denomination, or other beliefs; attire; membership in associations, foundations, or labor unions; health; sexual life; criminal convictions; and security measures, as well as biometric and genetic data.<\/p><\/td><\/tr>

Periodic Destruction<\/b><\/p><\/td>

The process of deleting, destroying, or anonymizing personal data\u2014as specified in the policy on the retention and disposal of personal data and to be carried out automatically at regular intervals\u2014in the event that all conditions for the processing of personal data set forth in the Law cease to exist.<\/p><\/td><\/tr>

Standard Contract<\/b><\/p><\/td>

A contract announced by the Board that includes matters such as data categories, the purposes of data transfer, recipients and groups of recipients, technical and administrative measures to be taken by the data recipient, and additional safeguards for special-category personal data, and that provides appropriate safeguards for cross-border transfers.<\/p><\/td><\/tr>

Data Processor<\/b><\/p><\/td>

A natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.<\/p><\/td><\/tr>

Data Recording System<\/b><\/p><\/td>

A record-keeping system in which personal data is processed according to specific criteria.<\/p><\/td><\/tr>

VERBIS<\/b><\/p><\/td>

The information system (Data Controllers Registry Information System) created and managed by the Presidency, which is accessible online and is used by data controllers when submitting applications to the Registry and for other Registry-related procedures.<\/p><\/td><\/tr>

Data Controller<\/b><\/p><\/td>

A natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.<\/p><\/td><\/tr><\/tbody><\/table>

5. GENERAL PRINCIPLES GOVERNING THE PROCESSING OF PERSONAL DATA<\/span><\/b><\/h1>

Personal data is processed in accordance with the general principles set forth in the Act.<\/p>

5.1. Compliance with the Law and Principles of Integrity<\/span><\/b><\/h2>

In accordance with this principle, personal data processing activities are carried out in compliance with all relevant legislation\u2014primarily the Constitution and the Personal Data Protection Law (KVKK)\u2014and in accordance with the principles of good faith. RAYVAG takes the necessary measures to ensure transparency and accountability.<\/p>

5.2. Accuracy and Timeliness When Necessary<\/span><\/b><\/h2>

RAYVAG takes the necessary measures to ensure the accuracy of personal data at the time of collection. When reprocessing is required, it makes every reasonable effort to ensure the data remains up-to-date. It establishes appropriate methods to enable data subjects to correct or update their personal data and makes every effort to ensure access is provided easily and at minimal cost.<\/p>

5.3. Processing for Specific, Clear, and Legitimate Purposes<\/span><\/b><\/h2>

Personal data shall be processed only for specified, explicit, and legitimate purposes. Personal data shall not be processed for purposes that are contrary to applicable laws and regulations or incompatible with the Company\u2019s business activities. All personal data processing activities shall be conducted in a transparent and accountable manner.RAYVAG\u2019s purposes for processing personal data include the manufacture, maintenance, repair, and overhaul of railway locomotives and rolling stock; the management of tendering and contractual processes; the maintenance of customer and supplier relationships; the management of human resources and personnel records; the fulfilment of occupational health and safety obligations; ensuring the security of physical premises, including visitor records and CCTV footage; the management of quality assurance and certification processes; the execution of accounting and financial operations; the handling of legal matters and ensuring compliance with applicable laws and regulations; responding to requests from administrative and judicial authorities; and ensuring information security.<\/p>

5.4. Relevance to the Purpose for Which They Are Processed, and Being Limited and Proportionate<\/span><\/b><\/h2>

Every effort is made to ensure that the personal data collected or processed is kept to a minimum in terms of both quantity and detail. When collecting personal data, the purposes for which it is processed are taken into account; personal data that is unrelated to the purpose or not necessary to achieve the purpose is not processed. Only the minimum amount of data necessary to achieve the purpose is processed. Personal data is not collected or retained for potential future needs.<\/p>

5.5. Retained for the Period Specified in the Relevant Legislation or as Necessary for the Purpose for Which They Were Processed<\/span><\/b><\/h2>

The maximum periods for which personal data may be retained for the purpose for which it is processed are specified. If the relevant legislation stipulates a retention period, the data is retained for that period; otherwise, it is retained for as long as necessary for the purpose for which it is processed.<\/p>

When determining the maximum retention period for personal data necessary for the purpose for which it is processed;<\/p>

a) The period generally accepted as standard practice in the sector in which the data controller operates, within the scope of the purpose of processing the relevant category of data,<\/p>

b) The period during which the legal relationship established with the data subject will continue, which necessitates the processing of personal data falling within the relevant data category,<\/p>

c) The period during which the legitimate interest that the data controller will derive, depending on the purpose of processing the relevant category of data, will be valid in accordance with the law and the principles of good faith,<\/p>

d) The period during which the risks, costs, and liabilities arising from the retention of the relevant data category will continue to exist under the law, depending on the purpose of processing,<\/p>

e) Whether the maximum period to be determined is suitable for ensuring that the relevant data category is accurate and, where necessary, kept up to date,<\/p>

f) The period during which the data controller is required to retain personal data falling within the relevant data category pursuant to its legal obligation,<\/p>

(g) The statute of limitations period established by the data controller for asserting a right related to personal data falling within the relevant data category,<\/p>

is taken into account.<\/p>

5.6. Conditions for the Processing of Personal Data<\/span><\/b><\/h2>

The conditions for processing personal data are governed by the Law. Sensitive personal data and non-sensitive personal data are treated separately with regard to the conditions for processing.<\/p>

Data regarding an individual\u2019s race, ethnic origin, political views, philosophical beliefs, religion, denomination, or other beliefs; attire; membership in associations, foundations, or labor unions; health; sex life; criminal convictions; and security measures, as well as biometric and genetic data, are considered special-category personal data.<\/p>

5.6.1. Conditions for the Processing of Non-Sensitive Personal Data<\/span><\/b><\/h3>

The basic rule is that personal data must not be processed without the explicit consent of the data subject.<\/p>

The law sets forth the conditions under which personal data that is not of a sensitive nature may be processed even without the data subject\u2019s explicit consent in certain circumstances:<\/p>

a) Where expressly provided for by law,<\/p>

b) Where it is necessary to protect the life or physical integrity of a person who, due to actual impossibility, is unable to express consent, or whose consent is not legally valid, or of another person,<\/p>

(c) Provided that it is directly related to the conclusion or performance of a contract, the processing of personal data belonging to the parties to the contract is necessary,<\/p>

(d) It is necessary for the data controller to fulfill its legal obligation,<\/p>

e) The information has been made public by the individual concerned,<\/p>

f) Data processing is necessary for the establishment, exercise, or protection of a right,<\/p>

g) The processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not infringe upon the fundamental rights and freedoms of the data subject.<\/p>

5.6.2. Conditions for the Processing of Special Category Personal Data<\/span><\/b><\/h3>

The processing of special-category personal data is prohibited. However, the processing of such data;<\/p>

a) The data subject\u2019s explicit consent,<\/p>

b) Where expressly provided for by law,<\/p>

c) Where a person is unable to express consent due to actual impossibility, or where the person\u2019s consent is not legally valid, and it is necessary to protect the life or physical integrity of that person or another person,<\/p>

d) It relates to personal data that the data subject has made public and is consistent with the data subject\u2019s intention to make such data public,<\/p>

e) It is necessary for the establishment, exercise, or protection of a right,<\/p>

f) When necessary for the protection of public health, the provision of preventive medicine, medical diagnosis, treatment, and care services, as well as the planning, management, and financing of health services, by persons or authorized institutions and organizations subject to a duty of confidentiality,<\/p>

g) It is necessary to fulfill legal obligations in the areas of employment, occupational health and safety, social security, social services, and social assistance,<\/p>

h) Foundations, associations, and other nonprofit organizations or entities established for political, philosophical, religious, or labor union purposes may, provided that they comply with the applicable legislation and their stated purposes, limit their activities to their specific fields of operation, and do not disclose such information to third parties, direct their activities toward their current or former members and affiliates, or toward individuals who are in regular contact with such organizations and entities,<\/p>

This is possible under such circumstances. In addition, adequate measures determined by the Board are taken when processing special-category personal data.<\/p>

5.7. Retention (Storage) of Personal Data<\/span><\/b><\/h2>

The storage of personal data is a personal data processing activity and is carried out in accordance with the conditions for processing personal data.<\/p>

Personal data may be stored only in the appropriate medium or media when storage is necessary. If other processing of personal data, other than storage, does not require the data to be retained, the personal data is destroyed.<\/p>

Personal data can be obtained in both physical and digital environments, and it can be transferred from a physical environment to a digital one, or from a digital system to a physical environment. The same rules apply to personal data processing activities in both environments, to the extent appropriate.<\/p>

5.7.1. Digital Environments<\/span><\/b><\/h3>

Under this policy, the most common digital environments where personal data\u2014whether collected digitally or converted to digital form at a later stage\u2014is stored and can be processed by information systems include:<\/p>

a) Servers (devices capable of storing digital personal data and used to provide services, such as databases, email, domain names, ERP\/MRP systems, etc.),<\/p>

b) Network and information security devices (routers, firewalls, switches, etc.),<\/p>

c) Personal computers (desktops, laptops, etc.),<\/p>

d) Mobile devices (cell phones, tablets, etc.),<\/p>

e) Portable storage devices (removable USB drives, CDs\/DVDs, memory cards),<\/p>

f) Cloud,<\/p>

g) Card readers, employee time-and-attendance systems, security cameras.<\/p>

5.7.2. Physical Environments<\/span><\/b><\/h3>

Media containing personal data obtained in a physical environment or converted from a digital environment to a physical environment:<\/p>

a) Any type of paper on which personal data may be written using writing instruments such as forms or ledgers, or that may contain personal data obtained through printing (including personnel files, visitor logs, and occupational safety and health records),<\/p>

b) Any medium other than paper that is suitable for storing personal data without digitization (cards, plaques, etc.).<\/p>

This policy does not apply to personal data located in physical environments that are not part of a data recording system.<\/p>

5.7.3. Determining Storage Environments<\/span><\/b><\/h3>

When determining the storage media for personal data that must be retained, the minimum number of media required is used. If the original medium on which the personal data was collected is suitable for storage, the data is retained in its original form on that medium. If the original form is not suitable for storage, does not allow for retention throughout the retention period, makes processing difficult, or if the data is at risk, a decision may be made to store it on another medium.<\/p>

5.7.4. Storage of Personal Data by Parties Other Than the Data Controller<\/span><\/b><\/h3>

It is also possible for personal data to be stored in environments not under the control of the data controller, where management and oversight are exercised by other natural or legal persons. In such cases, certain conditions must be met depending on whether the environment is located within or outside the country. Compliance with transfer conditions based on the location where the personal data was collected may also be required. In these cases, the transfer rules set forth under Section 5.8 apply.<\/p>

5.8. Transfer of Personal Data<\/span><\/b><\/h2>

Personal data may be transferred to other data controllers or data processors within the country or abroad. Such transfers are carried out in accordance with the law.<\/p>

Personal data may be transferred to the relevant authorities without any obligation to provide information and without requiring explicit consent, if requested by an authorized institution or organization pursuant to Article 28(1) of the Personal Data Protection Law.<\/p>

Personal data may also be transferred to authorized public institutions (such as ministries and administrative bodies under the Office of the President) upon request in cases explicitly specified by law, within the purposes and limitations set forth by law, provided that the obligation to inform the data subject is fulfilled.<\/p>

5.8.1. Transfer of Personal Data Within the Country<\/span><\/b><\/h3>

Personal data may not be transferred within the country to parties other than the data controller without the explicit consent of the data subject.<\/p>

Personal data may be transferred without the explicit consent of the data subject if one of the conditions specified in the third paragraph of Article 6 is met, provided that adequate safeguards are in place, as set forth in the second paragraph of Article 5 of the Law. In the transfer of special-category personal data, the measures prescribed by the Board must also be taken. Provisions in other laws regarding the transfer of personal data remain in full force and effect.<\/p>

5.8.2. Transfer of Personal Data Abroad<\/span><\/b><\/h3>

Subject to compliance with the general principles governing the processing of personal data, the transfer of personal data abroad and its storage abroad are permitted only within the framework of the phased regime set forth in Article 9 of the Personal Data Protection Law, as amended by Law No. 7499, and only if certain conditions are met.<\/p>

Decision on Eligibility<\/b><\/p>

Personal data may be transferred abroad provided that one of the conditions specified in Articles 5 and 6 of the Law is met and there is an adequacy decision issued by the Board\u2014and published in the Official Gazette\u2014regarding the country to which the data will be transferred, the sectors within that country, or international organizations.<\/p>

Appropriate Safeguards<\/b><\/p>

In the absence of a decision on adequacy, personal data may be transferred abroad provided that one of the conditions set forth in Articles 5 and 6 of the Law is met, and provided that the data subject has the opportunity to exercise their rights and seek effective legal remedies in the country to which the transfer is made, and provided that the parties ensure one of the following appropriate safeguards:<\/p>

a) The existence of an agreement\u2014which does not constitute an international treaty\u2014between public institutions and organizations abroad or international organizations and public institutions and organizations in Turkey, or professional organizations with the status of public institutions, and the Board\u2019s authorization of the transfer,<\/p>

b) The existence of binding corporate rules\u2014approved by the Board and containing provisions regarding the protection of personal data\u2014to which companies within a group of undertakings engaged in joint economic activities are required to comply,<\/p>

c) Entering into a standard contract with the data recipient that includes the matters announced by the Board, such as data categories, the purposes of data transfer, recipients and groups of recipients, technical and administrative measures to be taken by the data recipient, and additional measures taken for special-category personal data,<\/p>

d) The existence of a written undertaking containing provisions that ensure adequate protection, and authorization for the transfer by the Board.<\/p>

A standard contract must be reported to the Authority by the data controller or data processor within five business days of its signing. <\/b>In the event of a violation of this notification requirement, an administrative fine may be imposed pursuant to Article 18 of the KVKK.<\/p>

Emergencies<\/b><\/p>

In the absence of a decision on adequacy and one of the appropriate safeguards, personal data may be transferred abroad only on an occasional basis and only if one of the following conditions is met. Transfers that are irregular, occur once or a few times, are not ongoing, and do not fall within the ordinary course of business are considered occasional:<\/p>

a) The data subject\u2019s explicit consent to the transfer, provided that the data subject has been informed of the potential risks,<\/p>

b) The transfer is necessary for the performance of a contract between the data subject and the data controller or for the implementation of pre-contractual measures taken at the data subject\u2019s request,<\/p>

c) The transfer is necessary for the conclusion or performance of a contract between the data controller and another natural or legal person for the benefit of the data subject,<\/p>

d) The transfer must be necessary for an overriding public interest,<\/p>

e) Where the transfer of personal data is necessary for the establishment, exercise, or protection of a right,<\/p>

f) Where the transfer of personal data is necessary to protect the life or physical integrity of a person who, due to actual impossibility, is unable to express consent or whose consent is not legally valid, or of another person,<\/p>

g) The transfer of data from a registry that is open to the public or to persons with a legitimate interest, provided that the conditions required by applicable law for accessing the registry are met and the person with a legitimate interest requests such access.<\/p>

Data controllers and data processors are also required to comply with the safeguards provided for in the Act with respect to subsequent transfers of personal data transferred abroad.<\/p>

5.9. Destruction of Personal Data<\/span><\/b><\/h2>

Personal data is destroyed once the circumstances requiring its retention no longer exist.<\/p>

5.9.1. Disposal Methods<\/span><\/b><\/h3>

Delete<\/b><\/p>

The purpose of deleting personal data is to ensure that such data becomes inaccessible and cannot be reused by the relevant users in any way. Personal data stored in electronic form that can be deleted is erased through the deletion process; measures are taken to prevent its recovery after deletion. For personal data stored in electronic form that cannot be deleted, the storage medium itself is destroyed. For documents stored on paper or similar physical media, the deletion process is carried out by covering the personal data with a dark color that cannot be removed (redaction).<\/p>

Destruction<\/b><\/p>

This refers to the destruction of media\u2014such as documents, files, CDs, floppy disks, and hard drives\u2014on which personal data is stored, in a manner that renders the data irretrievable and unusable. If the data can be deleted from digital media, the destruction method is not used. For optical media where deletion is not possible, the method of breaking the media into very small pieces is applied.<\/p>

Anonymization<\/p>

The anonymization of personal data refers to the process of rendering personal data such that it cannot under any circumstances be associated with an identified or identifiable natural person, even if matched with other data. Personal data is rendered incapable of being associated with an identified or identifiable natural person, even through the use of techniques appropriate to the storage medium and the relevant field of activity\u2014such as the reversal of the data by the data controller or third parties and\/or the matching of the data with other data.<\/p>

5.9.2. Retention Periods<\/span><\/b><\/h3>

For personal data that ceases to exist upon the expiration of retention periods, the destruction period is a maximum of six months.<\/p>

Personal data processed solely on the basis of explicit consent must be destroyed within 30 days if the data subject withdraws that consent. For personal data processed solely on the basis of explicit consent but for which destruction is required for a reason other than the withdrawal of consent, the destruction period is six months.<\/p>

5.9.3. Periodic Destruction<\/span><\/b><\/h3>

Personal data for which the projected retention period expires before the scheduled retention period ends is deleted without waiting for the scheduled retention period.<\/p>

The periodic destruction period is six months. Periodic destruction may be spread out over a reasonable period of time, depending on the types and quantities of personal data to be destroyed.<\/p>

5.10. Security Measures<\/span><\/b><\/h2>

5.10.1. The Objectives of Security Measures<\/span><\/b><\/h3>

RAYVAG;<\/b><\/p>

a) To prevent the unlawful processing of personal data,<\/p>

b) To prevent unlawful access to personal data,<\/p>

c) To ensure the protection of personal data,<\/p>

It takes all necessary technical and administrative measures to ensure an appropriate level of security for this purpose.<\/p>

5.10.2. Personal Data Processing Inventory<\/span><\/b><\/h3>

An inventory of personal data processing activities carried out within RAYVAG<\/b> has been compiled. All activities have been reviewed, and the necessary changes have been made. The inventory is updated as needed.<\/p>

\u00a0<\/h3>

5.10.3. Education<\/span><\/b><\/h3>

RAYVAG<\/b> conducts the necessary training activities within its own organization to raise awareness about the protection of personal data and to safeguard the rights and interests of data subjects. RAYVAG ensures that individuals who process personal data are aware that they may not disclose the personal data they have obtained to others and that this obligation continues even after they leave their positions.<\/p>

5.10.4. Audit<\/span><\/b><\/h3>

Compliance with established rules is monitored through periodic or ad hoc audits conducted either internally or by external parties.<\/p>

5.10.5. Data Breach<\/span><\/b><\/h3>

The procedures and principles to be followed in the event of a data breach have been established. If personal data processed by the organization is obtained by others through unlawful means, this situation must be reported to the Board as soon as possible\u2014and within 72 hours in accordance with the principles established by the Board\u2014and also to the data subjects within a reasonable timeframe.<\/p>

5.11. Informing the Data Subject<\/span><\/b><\/h2>

RAYVAG aims to inform data subjects whose personal data is processed in a process-based, understandable, and sufficiently detailed manner, in compliance with the law, using appropriate methods, and within a reasonable timeframe. Even when the processing of personal data is subject to explicit consent, RAYVAG places importance on ensuring that the data subject is accurately informed about the consequences of giving such consent.<\/p>

5.11.1. Request by the Data Subject<\/span><\/b><\/h3>

Data subjects must first contact the data controller to exercise their rights regarding their personal data. According to Article 14 of the Law, complaints cannot be filed directly with the Personal Data Protection Board.<\/p>

Under the law, the data subject;<\/p>

a) To learn whether their personal data has been processed,<\/p>

b) To request information regarding the processing of their personal data, if it has been processed,<\/p>

c) To learn the purpose of the processing of their personal data and whether it is being used in accordance with that purpose,<\/p>

d) To know the third parties to whom their personal data has been transferred, whether within the country or abroad,<\/p>

e) To request the correction of their personal data if it has been processed incompletely or incorrectly,<\/p>

f) To request the erasure or destruction of their personal data if the grounds for processing no longer exist,<\/p>

g) To request that the third parties to whom their personal data has been transferred be notified of the actions taken pursuant to subparagraphs (e) and (f),<\/p>

h) To object to a decision made solely through the automated processing of their data that results in a negative outcome for them,<\/p>

i) To request compensation for damages suffered as a result of the unlawful processing of their personal data<\/p>

They may exercise these rights.<\/p>

Data subjects may submit their requests in accordance with the Communiqu\u00e9 on the Procedures and Principles for Submitting Requests to the Data Controller; they may do so in writing or by using a registered electronic mail (KEP) address, a secure electronic signature, a mobile signature, or an email address previously provided to RAYVAG by the data subject and registered in RAYVAG\u2019s system.<\/p>

In this regard, interested parties may fill out the application form available at https:\/\/rayvag.com.tr\/en\/home\/kvkk-privacy-notice\/ <\/i>; they may then submit a signed copy of the form, along with identification documents, in person to the address \u201cAdana Hac\u0131 Sabanc\u0131 Organized Industrial Zone (OSB), Celal Bayar Boulevard No. 28, Sar\u0131\u00e7am, 01400 Adana,”<\/b> either in person, by certified mail, or through a notary public; or they may submit the form with a secure electronic signature to the registered email address rayvag@hs02.kep.tr<\/b><\/p>

5.11.2. Circumstances Under Which the Data Controller Cannot Be Contacted<\/span><\/b><\/h3>

Data subjects may not exercise their right to lodge a complaint with the data controller\u2014except for the right to request compensation for damages\u2014in the following cases:<\/p>

a) The processing of personal data is necessary for the prevention of a crime or for a criminal investigation,<\/p>

b) The processing of personal data that the data subject has made public,<\/p>

c) Where the processing of personal data is necessary for the performance of supervisory or regulatory duties, or for disciplinary investigations or proceedings, by public institutions and organizations, as well as professional associations with the status of public institutions, acting pursuant to the authority granted by law,<\/p>

(c) The processing of personal data is necessary to protect the State\u2019s economic and financial interests in matters related to the budget, taxes, and financial affairs.<\/p>

5.11.3. Responding to Inquiries<\/span><\/b><\/h3>

Applications from interested parties are carefully reviewed and responded to as soon as possible\u2014and in any case within a maximum of 30 days\u2014either in accordance with the applicant\u2019s request or by another method deemed appropriate. No fee is charged for the response. However, if the process incurs additional costs, the applicant may be required to pay the fee specified in the schedule established by the Board.<\/p>

In order to fulfill the applicant\u2019s requests, the applicant may be asked to provide proof of identity or to submit additional information or documents for another reason.<\/p>

5.12. Data Controller Registry (VERB\u0130S)<\/span><\/b><\/h2>

Data Controller Registry (VERB\u0130S)<\/p>

5.13. Updates to the Policy, Their Disclosure, and Retention<\/span><\/b><\/h2>

The Policy is updated as necessary in accordance with applicable regulations. Since the Policy is intended for public access, it is published on the Company\u2019s website (www.rayvag.com.tr). The Policy is maintained by Rayvag.<\/p>

5.14. Situations Not Covered by the Policy<\/span><\/b><\/h2>

In the event of disputes not addressed in this Policy or arising from the implementation of this Policy, the relevant sources will be consulted. The applicable legal regulations in force regarding the processing and protection of personal data will apply.<\/p>

6. OTHER MATTERS<\/span><\/b><\/h1>

In the event of any inconsistency between the provisions of the KVKK and other relevant legislation and this Policy, the provisions of the KVKK and other relevant legislation shall take precedence.<\/p>

In the event of any changes to the Policy, the relevant provisions of the Policy will be updated accordingly.<\/p>

7. SPECIAL CIRCUMSTANCES AND EXCEPTIONS<\/span><\/b><\/h1>

There isn’t any.<\/p>

8. AMENDMENTS AND REPEAL<\/span><\/b><\/h1>

This Policy is reviewed and updated by RAYVAG<\/b>.<\/p>

9. ENFORCEMENT<\/span><\/b><\/h1>

This Policy, prepared by RAYVAG<\/b>, entered into effect on July 14, 2026.<\/p>

10. IMPLEMENTATION<\/span><\/b><\/h1>

RAYVAG <\/b>is responsible for implementing this document.<\/p>

11. DISTRIBUTION<\/span><\/b><\/h1>

The policy is published on the RAYVAG <\/b>website (www.rayvag.com.tr) and communicated to third parties and Company employees.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

1. PURPOSE<\/span><\/b><\/h1>

RAYVAG Wagon Industry and Trade Inc. <\/b>(\u201cRAYVAG\u201d or \u201cthe Company\u201d), we have placed great importance on the protection of personal data pertaining to all natural persons whose personal data we process through any means in the course of our commercial activities, as well as on the full compliance with our obligations under the Law on the Protection of Personal Data No. 6698 (\u201cKVKK\u201d or \u201cthe Law\u201d), effective as of the date the Law entered into force.<\/p>

The Personal Data Protection, Processing, and Privacy Policy (\u201cPolicy\u201d) has been prepared to inform you about the processes involved in the collection, processing, retention, and transfer of personal data by RAYVAG, as well as the principles we adhere to. This document is consistent with the policies in effect within RAYVAG. Information that is not required to be disclosed to the public and is not in the public interest has not been included.<\/p>

2. SCOPE<\/span><\/b><\/h1>

This policy applies to all personal data stored in digital or analog data recording systems\u2014for which RAYVAG<\/b> determines the purposes and means of processing and is responsible for their establishment and management\u2014and obtained from data subjects through automated or non-automated methods. These provisions apply to RAYVAG employees, job applicants, interns, suppliers and customers with whom RAYVAG has a business relationship\u2014including their employees and authorized representatives\u2014as well as visitors, subcontractor employees, and RAYVAG<\/p>

This covers all personal data storage and destruction activities for which RAYVAG<\/b> is recognized as the data controller.<\/p>

RAYVAG<\/b>\u2019s personal data processing activities, carried out in its capacity as a data processor, are governed by the provisions of the Law regarding the obligations of data processors.<\/p>

3. REFERENCES<\/span><\/b><\/h1>

\u2022 Law No. 6698 on the Protection of Personal Data (including amendments made by Law No. 7499)<\/p>

\u2022 Regulation on the Registry of Data Controllers<\/p>

\u2022 Regulation on the Erasure, Destruction, or Anonymization of Personal Data<\/p>

\u2022 Regulation on the Procedures and Principles Governing the Transfer of Personal Data Abroad<\/p>

\u2022 Communication on the Procedures and Principles to Be Followed in Fulfilling the Obligation to Provide Information<\/p>

\u2022 Communication on the Procedures and Principles for Filing Requests with the Data Controller<\/p>

\u2022 Principle Decisions and Decisions of the Personal Data Protection Board<\/p>

\u2022 Board Decisions Regarding Adequate Measures to Be Taken by Data Controllers in the Processing of Special Category Personal Data<\/p>

\u2022 Provisions in other legislation regarding personal data and its processing<\/p>

4. DEFINITIONS AND ABBREVIATIONS<\/span><\/b><\/h1>

Abbreviation<\/span><\/b><\/p><\/td>

Definition<\/span><\/p><\/td><\/tr>

Explicit Consent<\/b><\/p><\/td>

Consent that is informed and freely given regarding a specific matter.<\/p><\/td><\/tr>

Buyer Group<\/b><\/p><\/td>

The category of natural or legal persons to whom the data controller transfers personal data.<\/p><\/td><\/tr>

Anonymization<\/b><\/p><\/td>

Ensuring that personal data is rendered incapable of being associated with an identified or identifiable natural person under any circumstances, even when combined with other data.<\/p><\/td><\/tr>

Binding Company Rules<\/b><\/p><\/td>

Rules approved by the Board that must be followed by companies within a group of enterprises engaged in a joint economic activity and that provide appropriate safeguards for the transfer of personal data abroad.<\/p><\/td><\/tr>

Relevant User<\/b><\/p><\/td>

Persons who process personal data within the data controller\u2019s organization or in accordance with the authority and instructions received from the data controller, excluding the person or unit responsible for the technical storage, protection, and backup of the data.<\/p><\/td><\/tr>

Destruction<\/b><\/p><\/td>

Data Subject: The erasure, destruction, or anonymization of personal data.<\/p><\/td><\/tr>

Relevant Person<\/b><\/p><\/td>

A natural person whose personal data is processed.<\/p><\/td><\/tr>

Contact Person<\/b><\/p><\/td>

The natural person designated by the data controller\u2014whether a legal entity established in Turkey or a representative of a legal entity not established in Turkey\u2014at the time of registration in the Registry, for the purpose of communicating with the Authority regarding the obligations of the data controller under the Law and secondary regulations.<\/p><\/td><\/tr>

Law\/KVKK<\/b><\/p><\/td>

Law No. 6698 on the Protection of Personal Data.<\/p><\/td><\/tr>

Recording Medium<\/b><\/p><\/td>

Any medium containing personal data that is processed fully or partially automatically, or processed by non-automated means provided that it forms part of a data filing system.<\/p><\/td><\/tr>

Personal Data<\/b><\/p><\/td>

Any information relating to an identified or identifiable natural person.<\/p><\/td><\/tr>

Personal Data Processing Inventory<\/b><\/p><\/td>

An inventory in which data controllers detail the personal data processing activities they carry out in accordance with their business processes; this inventory links these activities to the purposes of processing, the category of data, the group of recipients to whom the data is transferred, and the group of data subjects, and specifies the maximum retention period, the personal data intended for transfer to foreign countries, and the measures taken regarding data security.<\/p><\/td><\/tr>

Processing of Personal Data<\/b><\/p><\/td>

Any operation performed on personal data, such as the collection, recording, storage, retention, modification, reorganization, disclosure, transfer, acquisition, making available, classification, or restriction of use of such data, whether carried out by fully or partially automated means or by non-automated means provided that it forms part of a data filing system.<\/p><\/td><\/tr>

Board<\/b><\/p><\/td>

Personal Data Protection Board.<\/p><\/td><\/tr>

Organization<\/b><\/p><\/td>

Personal Data Protection Authority.<\/p><\/td><\/tr>

Sensitive Personal Data<\/b><\/p><\/td>

Data regarding an individual\u2019s race, ethnic origin, political views, philosophical beliefs, religion, denomination, or other beliefs; attire; membership in associations, foundations, or labor unions; health; sexual life; criminal convictions; and security measures, as well as biometric and genetic data.<\/p><\/td><\/tr>

Periodic Destruction<\/b><\/p><\/td>

The process of deleting, destroying, or anonymizing personal data\u2014as specified in the policy on the retention and disposal of personal data and to be carried out automatically at regular intervals\u2014in the event that all conditions for the processing of personal data set forth in the Law cease to exist.<\/p><\/td><\/tr>

Standard Contract<\/b><\/p><\/td>

A contract announced by the Board that includes matters such as data categories, the purposes of data transfer, recipients and groups of recipients, technical and administrative measures to be taken by the data recipient, and additional safeguards for special-category personal data, and that provides appropriate safeguards for cross-border transfers.<\/p><\/td><\/tr>

Data Processor<\/b><\/p><\/td>

A natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.<\/p><\/td><\/tr>

Data Recording System<\/b><\/p><\/td>

A record-keeping system in which personal data is processed according to specific criteria.<\/p><\/td><\/tr>

VERBIS<\/b><\/p><\/td>

The information system (Data Controllers Registry Information System) created and managed by the Presidency, which is accessible online and is used by data controllers when submitting applications to the Registry and for other Registry-related procedures.<\/p><\/td><\/tr>

Data Controller<\/b><\/p><\/td>

A natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.<\/p><\/td><\/tr><\/tbody><\/table>

5. GENERAL PRINCIPLES GOVERNING THE PROCESSING OF PERSONAL DATA<\/span><\/b><\/h1>

Personal data is processed in accordance with the general principles set forth in the Act.<\/p>

5.1. Compliance with the Law and Principles of Integrity<\/span><\/b><\/h2>

In accordance with this principle, personal data processing activities are carried out in compliance with all relevant legislation\u2014primarily the Constitution and the Personal Data Protection Law (KVKK)\u2014and in accordance with the principles of good faith. RAYVAG takes the necessary measures to ensure transparency and accountability.<\/p>

5.2. Accuracy and Timeliness When Necessary<\/span><\/b><\/h2>

RAYVAG takes the necessary measures to ensure the accuracy of personal data at the time of collection. When reprocessing is required, it makes every reasonable effort to ensure the data remains up-to-date. It establishes appropriate methods to enable data subjects to correct or update their personal data and makes every effort to ensure access is provided easily and at minimal cost.<\/p>

5.3. Processing for Specific, Clear, and Legitimate Purposes<\/span><\/b><\/h2>

Personal data shall be processed only for specified, explicit, and legitimate purposes. Personal data shall not be processed for purposes that are contrary to applicable laws and regulations or incompatible with the Company\u2019s business activities. All personal data processing activities shall be conducted in a transparent and accountable manner.RAYVAG\u2019s purposes for processing personal data include the manufacture, maintenance, repair, and overhaul of railway locomotives and rolling stock; the management of tendering and contractual processes; the maintenance of customer and supplier relationships; the management of human resources and personnel records; the fulfilment of occupational health and safety obligations; ensuring the security of physical premises, including visitor records and CCTV footage; the management of quality assurance and certification processes; the execution of accounting and financial operations; the handling of legal matters and ensuring compliance with applicable laws and regulations; responding to requests from administrative and judicial authorities; and ensuring information security.<\/p>

5.4. Relevance to the Purpose for Which They Are Processed, and Being Limited and Proportionate<\/span><\/b><\/h2>

Every effort is made to ensure that the personal data collected or processed is kept to a minimum in terms of both quantity and detail. When collecting personal data, the purposes for which it is processed are taken into account; personal data that is unrelated to the purpose or not necessary to achieve the purpose is not processed. Only the minimum amount of data necessary to achieve the purpose is processed. Personal data is not collected or retained for potential future needs.<\/p>

5.5. Retained for the Period Specified in the Relevant Legislation or as Necessary for the Purpose for Which They Were Processed<\/span><\/b><\/h2>

The maximum periods for which personal data may be retained for the purpose for which it is processed are specified. If the relevant legislation stipulates a retention period, the data is retained for that period; otherwise, it is retained for as long as necessary for the purpose for which it is processed.<\/p>

When determining the maximum retention period for personal data necessary for the purpose for which it is processed;<\/p>

a) The period generally accepted as standard practice in the sector in which the data controller operates, within the scope of the purpose of processing the relevant category of data,<\/p>

b) The period during which the legal relationship established with the data subject will continue, which necessitates the processing of personal data falling within the relevant data category,<\/p>

c) The period during which the legitimate interest that the data controller will derive, depending on the purpose of processing the relevant category of data, will be valid in accordance with the law and the principles of good faith,<\/p>

d) The period during which the risks, costs, and liabilities arising from the retention of the relevant data category will continue to exist under the law, depending on the purpose of processing,<\/p>

e) Whether the maximum period to be determined is suitable for ensuring that the relevant data category is accurate and, where necessary, kept up to date,<\/p>

f) The period during which the data controller is required to retain personal data falling within the relevant data category pursuant to its legal obligation,<\/p>

(g) The statute of limitations period established by the data controller for asserting a right related to personal data falling within the relevant data category,<\/p>

is taken into account.<\/p>

5.6. Conditions for the Processing of Personal Data<\/span><\/b><\/h2>

The conditions for processing personal data are governed by the Law. Sensitive personal data and non-sensitive personal data are treated separately with regard to the conditions for processing.<\/p>

Data regarding an individual\u2019s race, ethnic origin, political views, philosophical beliefs, religion, denomination, or other beliefs; attire; membership in associations, foundations, or labor unions; health; sex life; criminal convictions; and security measures, as well as biometric and genetic data, are considered special-category personal data.<\/p>

5.6.1. Conditions for the Processing of Non-Sensitive Personal Data<\/span><\/b><\/h3>

The basic rule is that personal data must not be processed without the explicit consent of the data subject.<\/p>

The law sets forth the conditions under which personal data that is not of a sensitive nature may be processed even without the data subject\u2019s explicit consent in certain circumstances:<\/p>

a) Where expressly provided for by law,<\/p>

b) Where it is necessary to protect the life or physical integrity of a person who, due to actual impossibility, is unable to express consent, or whose consent is not legally valid, or of another person,<\/p>

(c) Provided that it is directly related to the conclusion or performance of a contract, the processing of personal data belonging to the parties to the contract is necessary,<\/p>

(d) It is necessary for the data controller to fulfill its legal obligation,<\/p>

e) The information has been made public by the individual concerned,<\/p>

f) Data processing is necessary for the establishment, exercise, or protection of a right,<\/p>

g) The processing of data is necessary for the legitimate interests of the data controller, provided that such processing does not infringe upon the fundamental rights and freedoms of the data subject.<\/p>

5.6.2. Conditions for the Processing of Special Category Personal Data<\/span><\/b><\/h3>

The processing of special-category personal data is prohibited. However, the processing of such data;<\/p>

a) The data subject\u2019s explicit consent,<\/p>

b) Where expressly provided for by law,<\/p>

c) Where a person is unable to express consent due to actual impossibility, or where the person\u2019s consent is not legally valid, and it is necessary to protect the life or physical integrity of that person or another person,<\/p>

d) It relates to personal data that the data subject has made public and is consistent with the data subject\u2019s intention to make such data public,<\/p>

e) It is necessary for the establishment, exercise, or protection of a right,<\/p>

f) When necessary for the protection of public health, the provision of preventive medicine, medical diagnosis, treatment, and care services, as well as the planning, management, and financing of health services, by persons or authorized institutions and organizations subject to a duty of confidentiality,<\/p>

g) It is necessary to fulfill legal obligations in the areas of employment, occupational health and safety, social security, social services, and social assistance,<\/p>

h) Foundations, associations, and other nonprofit organizations or entities established for political, philosophical, religious, or labor union purposes may, provided that they comply with the applicable legislation and their stated purposes, limit their activities to their specific fields of operation, and do not disclose such information to third parties, direct their activities toward their current or former members and affiliates, or toward individuals who are in regular contact with such organizations and entities,<\/p>

This is possible under such circumstances. In addition, adequate measures determined by the Board are taken when processing special-category personal data.<\/p>

5.7. Retention (Storage) of Personal Data<\/span><\/b><\/h2>

The storage of personal data is a personal data processing activity and is carried out in accordance with the conditions for processing personal data.<\/p>

Personal data may be stored only in the appropriate medium or media when storage is necessary. If other processing of personal data, other than storage, does not require the data to be retained, the personal data is destroyed.<\/p>

Personal data can be obtained in both physical and digital environments, and it can be transferred from a physical environment to a digital one, or from a digital system to a physical environment. The same rules apply to personal data processing activities in both environments, to the extent appropriate.<\/p>

5.7.1. Digital Environments<\/span><\/b><\/h3>

Under this policy, the most common digital environments where personal data\u2014whether collected digitally or converted to digital form at a later stage\u2014is stored and can be processed by information systems include:<\/p>

a) Servers (devices capable of storing digital personal data and used to provide services, such as databases, email, domain names, ERP\/MRP systems, etc.),<\/p>

b) Network and information security devices (routers, firewalls, switches, etc.),<\/p>

c) Personal computers (desktops, laptops, etc.),<\/p>

d) Mobile devices (cell phones, tablets, etc.),<\/p>

e) Portable storage devices (removable USB drives, CDs\/DVDs, memory cards),<\/p>

f) Cloud,<\/p>

g) Card readers, employee time-and-attendance systems, security cameras.<\/p>

5.7.2. Physical Environments<\/span><\/b><\/h3>

Media containing personal data obtained in a physical environment or converted from a digital environment to a physical environment:<\/p>

a) Any type of paper on which personal data may be written using writing instruments such as forms or ledgers, or that may contain personal data obtained through printing (including personnel files, visitor logs, and occupational safety and health records),<\/p>

b) Any medium other than paper that is suitable for storing personal data without digitization (cards, plaques, etc.).<\/p>

This policy does not apply to personal data located in physical environments that are not part of a data recording system.<\/p>

5.7.3. Determining Storage Environments<\/span><\/b><\/h3>

When determining the storage media for personal data that must be retained, the minimum number of media required is used. If the original medium on which the personal data was collected is suitable for storage, the data is retained in its original form on that medium. If the original form is not suitable for storage, does not allow for retention throughout the retention period, makes processing difficult, or if the data is at risk, a decision may be made to store it on another medium.<\/p>

5.7.4. Storage of Personal Data by Parties Other Than the Data Controller<\/span><\/b><\/h3>

It is also possible for personal data to be stored in environments not under the control of the data controller, where management and oversight are exercised by other natural or legal persons. In such cases, certain conditions must be met depending on whether the environment is located within or outside the country. Compliance with transfer conditions based on the location where the personal data was collected may also be required. In these cases, the transfer rules set forth under Section 5.8 apply.<\/p>

5.8. Transfer of Personal Data<\/span><\/b><\/h2>

Personal data may be transferred to other data controllers or data processors within the country or abroad. Such transfers are carried out in accordance with the law.<\/p>

Personal data may be transferred to the relevant authorities without any obligation to provide information and without requiring explicit consent, if requested by an authorized institution or organization pursuant to Article 28(1) of the Personal Data Protection Law.<\/p>

Personal data may also be transferred to authorized public institutions (such as ministries and administrative bodies under the Office of the President) upon request in cases explicitly specified by law, within the purposes and limitations set forth by law, provided that the obligation to inform the data subject is fulfilled.<\/p>

5.8.1. Transfer of Personal Data Within the Country<\/span><\/b><\/h3>

Personal data may not be transferred within the country to parties other than the data controller without the explicit consent of the data subject.<\/p>

Personal data may be transferred without the explicit consent of the data subject if one of the conditions specified in the third paragraph of Article 6 is met, provided that adequate safeguards are in place, as set forth in the second paragraph of Article 5 of the Law. In the transfer of special-category personal data, the measures prescribed by the Board must also be taken. Provisions in other laws regarding the transfer of personal data remain in full force and effect.<\/p>

5.8.2. Transfer of Personal Data Abroad<\/span><\/b><\/h3>

Subject to compliance with the general principles governing the processing of personal data, the transfer of personal data abroad and its storage abroad are permitted only within the framework of the phased regime set forth in Article 9 of the Personal Data Protection Law, as amended by Law No. 7499, and only if certain conditions are met.<\/p>

Decision on Eligibility<\/b><\/p>

Personal data may be transferred abroad provided that one of the conditions specified in Articles 5 and 6 of the Law is met and there is an adequacy decision issued by the Board\u2014and published in the Official Gazette\u2014regarding the country to which the data will be transferred, the sectors within that country, or international organizations.<\/p>

Appropriate Safeguards<\/b><\/p>

In the absence of a decision on adequacy, personal data may be transferred abroad provided that one of the conditions set forth in Articles 5 and 6 of the Law is met, and provided that the data subject has the opportunity to exercise their rights and seek effective legal remedies in the country to which the transfer is made, and provided that the parties ensure one of the following appropriate safeguards:<\/p>

a) The existence of an agreement\u2014which does not constitute an international treaty\u2014between public institutions and organizations abroad or international organizations and public institutions and organizations in Turkey, or professional organizations with the status of public institutions, and the Board\u2019s authorization of the transfer,<\/p>

b) The existence of binding corporate rules\u2014approved by the Board and containing provisions regarding the protection of personal data\u2014to which companies within a group of undertakings engaged in joint economic activities are required to comply,<\/p>

c) Entering into a standard contract with the data recipient that includes the matters announced by the Board, such as data categories, the purposes of data transfer, recipients and groups of recipients, technical and administrative measures to be taken by the data recipient, and additional measures taken for special-category personal data,<\/p>

d) The existence of a written undertaking containing provisions that ensure adequate protection, and authorization for the transfer by the Board.<\/p>

A standard contract must be reported to the Authority by the data controller or data processor within five business days of its signing. <\/b>In the event of a violation of this notification requirement, an administrative fine may be imposed pursuant to Article 18 of the KVKK.<\/p>

Emergencies<\/b><\/p>

In the absence of a decision on adequacy and one of the appropriate safeguards, personal data may be transferred abroad only on an occasional basis and only if one of the following conditions is met. Transfers that are irregular, occur once or a few times, are not ongoing, and do not fall within the ordinary course of business are considered occasional:<\/p>

a) The data subject\u2019s explicit consent to the transfer, provided that the data subject has been informed of the potential risks,<\/p>

b) The transfer is necessary for the performance of a contract between the data subject and the data controller or for the implementation of pre-contractual measures taken at the data subject\u2019s request,<\/p>

c) The transfer is necessary for the conclusion or performance of a contract between the data controller and another natural or legal person for the benefit of the data subject,<\/p>

d) The transfer must be necessary for an overriding public interest,<\/p>

e) Where the transfer of personal data is necessary for the establishment, exercise, or protection of a right,<\/p>

f) Where the transfer of personal data is necessary to protect the life or physical integrity of a person who, due to actual impossibility, is unable to express consent or whose consent is not legally valid, or of another person,<\/p>

g) The transfer of data from a registry that is open to the public or to persons with a legitimate interest, provided that the conditions required by applicable law for accessing the registry are met and the person with a legitimate interest requests such access.<\/p>

Data controllers and data processors are also required to comply with the safeguards provided for in the Act with respect to subsequent transfers of personal data transferred abroad.<\/p>

5.9. Destruction of Personal Data<\/span><\/b><\/h2>

Personal data is destroyed once the circumstances requiring its retention no longer exist.<\/p>

5.9.1. Disposal Methods<\/span><\/b><\/h3>

Delete<\/b><\/p>

The purpose of deleting personal data is to ensure that such data becomes inaccessible and cannot be reused by the relevant users in any way. Personal data stored in electronic form that can be deleted is erased through the deletion process; measures are taken to prevent its recovery after deletion. For personal data stored in electronic form that cannot be deleted, the storage medium itself is destroyed. For documents stored on paper or similar physical media, the deletion process is carried out by covering the personal data with a dark color that cannot be removed (redaction).<\/p>

Destruction<\/b><\/p>

This refers to the destruction of media\u2014such as documents, files, CDs, floppy disks, and hard drives\u2014on which personal data is stored, in a manner that renders the data irretrievable and unusable. If the data can be deleted from digital media, the destruction method is not used. For optical media where deletion is not possible, the method of breaking the media into very small pieces is applied.<\/p>

Anonymisierung<\/b><\/p>

The anonymization of personal data refers to the process of rendering personal data such that it cannot under any circumstances be associated with an identified or identifiable natural person, even if matched with other data. Personal data is rendered incapable of being associated with an identified or identifiable natural person, even through the use of techniques appropriate to the storage medium and the relevant field of activity\u2014such as the reversal of the data by the data controller or third parties and\/or the matching of the data with other data.<\/p>

5.9.2. Retention Periods<\/span><\/b><\/h3>

For personal data that ceases to exist upon the expiration of retention periods, the destruction period is a maximum of six months.<\/p>

Personal data processed solely on the basis of explicit consent must be destroyed within 30 days if the data subject withdraws that consent. For personal data processed solely on the basis of explicit consent but for which destruction is required for a reason other than the withdrawal of consent, the destruction period is six months.<\/p>

5.9.3. Periodic Destruction<\/span><\/b><\/h3>

Personal data for which the projected retention period expires before the scheduled retention period ends is deleted without waiting for the scheduled retention period.<\/p>

The periodic destruction period is six months. Periodic destruction may be spread out over a reasonable period of time, depending on the types and quantities of personal data to be destroyed.<\/p>

5.10. Security Measures<\/span><\/b><\/h2>

5.10.1. The Objectives of Security Measures<\/span><\/b><\/h3>

RAYVAG;<\/b><\/p>

a) To prevent the unlawful processing of personal data,<\/p>

b) To prevent unlawful access to personal data,<\/p>

c) To ensure the protection of personal data,<\/p>

It takes all necessary technical and administrative measures to ensure an appropriate level of security for this purpose.<\/p>

5.10.2. Personal Data Processing Inventory<\/span><\/b><\/h3>

An inventory of personal data processing activities carried out within RAYVAG<\/b> has been compiled. All activities have been reviewed, and the necessary changes have been made. The inventory is updated as needed.<\/p>

\u00a0<\/h3>

5.10.3. Education<\/span><\/b><\/h3>

RAYVAG<\/b> conducts the necessary training activities within its own organization to raise awareness about the protection of personal data and to safeguard the rights and interests of data subjects. RAYVAG ensures that individuals who process personal data are aware that they may not disclose the personal data they have obtained to others and that this obligation continues even after they leave their positions.<\/p>

5.10.4. Audit<\/span><\/b><\/h3>

Compliance with established rules is monitored through periodic or ad hoc audits conducted either internally or by external parties.<\/p>

5.10.5. Data Breach<\/span><\/b><\/h3>

The procedures and principles to be followed in the event of a data breach have been established. If personal data processed by the organization is obtained by others through unlawful means, this situation must be reported to the Board as soon as possible\u2014and within 72 hours in accordance with the principles established by the Board\u2014and also to the data subjects within a reasonable timeframe.<\/p>

5.11. Informing the Data Subject<\/span><\/b><\/h2>

RAYVAG aims to inform data subjects whose personal data is processed in a process-based, understandable, and sufficiently detailed manner, in compliance with the law, using appropriate methods, and within a reasonable timeframe. Even when the processing of personal data is subject to explicit consent, RAYVAG places importance on ensuring that the data subject is accurately informed about the consequences of giving such consent.<\/p>

5.11.1. Request by the Data Subject<\/span><\/b><\/h3>

Data subjects must first contact the data controller to exercise their rights regarding their personal data. According to Article 14 of the Law, complaints cannot be filed directly with the Personal Data Protection Board.<\/p>

Under the law, the data subject;<\/p>

a) To learn whether their personal data has been processed,<\/p>

b) To request information regarding the processing of their personal data, if it has been processed,<\/p>

c) To learn the purpose of the processing of their personal data and whether it is being used in accordance with that purpose,<\/p>

d) To know the third parties to whom their personal data has been transferred, whether within the country or abroad,<\/p>

e) To request the correction of their personal data if it has been processed incompletely or incorrectly,<\/p>

f) To request the erasure or destruction of their personal data if the grounds for processing no longer exist,<\/p>

g) To request that the third parties to whom their personal data has been transferred be notified of the actions taken pursuant to subparagraphs (e) and (f),<\/p>

h) To object to a decision made solely through the automated processing of their data that results in a negative outcome for them,<\/p>

i) To request compensation for damages suffered as a result of the unlawful processing of their personal data<\/p>

They may exercise these rights.<\/p>

Data subjects may submit their requests in accordance with the Communiqu\u00e9 on the Procedures and Principles for Submitting Requests to the Data Controller; they may do so in writing or by using a registered electronic mail (KEP) address, a secure electronic signature, a mobile signature, or an email address previously provided to RAYVAG by the data subject and registered in RAYVAG\u2019s system.<\/p>

In this regard, interested parties may fill out the application form available at https:\/\/rayvag.com.tr\/en\/home\/kvkk-privacy-notice\/ <\/i>; they may then submit a signed copy of the form, along with identification documents, in person to the address \u201cAdana Hac\u0131 Sabanc\u0131 Organized Industrial Zone (OSB), Celal Bayar Boulevard No. 28, Sar\u0131\u00e7am, 01400 Adana,”<\/b> either in person, by certified mail, or through a notary public; or they may submit the form with a secure electronic signature to the registered email address rayvag@hs02.kep.tr<\/b><\/p>

5.11.2. Circumstances Under Which the Data Controller Cannot Be Contacted<\/span><\/b><\/h3>

Data subjects may not exercise their right to lodge a complaint with the data controller\u2014except for the right to request compensation for damages\u2014in the following cases:<\/p>

a) The processing of personal data is necessary for the prevention of a crime or for a criminal investigation,<\/p>

b) The processing of personal data that the data subject has made public,<\/p>

c) Where the processing of personal data is necessary for the performance of supervisory or regulatory duties, or for disciplinary investigations or proceedings, by public institutions and organizations, as well as professional associations with the status of public institutions, acting pursuant to the authority granted by law,<\/p>

(c) The processing of personal data is necessary to protect the State\u2019s economic and financial interests in matters related to the budget, taxes, and financial affairs.<\/p>

5.11.3. Responding to Inquiries<\/span><\/b><\/h3>

Applications from interested parties are carefully reviewed and responded to as soon as possible\u2014and in any case within a maximum of 30 days\u2014either in accordance with the applicant\u2019s request or by another method deemed appropriate. No fee is charged for the response. However, if the process incurs additional costs, the applicant may be required to pay the fee specified in the schedule established by the Board.<\/p>

In order to fulfill the applicant\u2019s requests, the applicant may be asked to provide proof of identity or to submit additional information or documents for another reason.<\/p>

5.12. Data Controller Registry (VERB\u0130S)<\/span><\/b><\/h2>

Data Controller Registry (VERB\u0130S)<\/p>

5.13. Updates to the Policy, Their Disclosure, and Retention<\/span><\/b><\/h2>

The Policy is updated as necessary in accordance with applicable regulations. Since the Policy is intended for public access, it is published on the Company\u2019s website (www.rayvag.com.tr). The Policy is maintained by Rayvag.<\/p>

5.14. Situations Not Covered by the Policy<\/span><\/b><\/h2>

In the event of disputes not addressed in this Policy or arising from the implementation of this Policy, the relevant sources will be consulted. The applicable legal regulations in force regarding the processing and protection of personal data will apply.<\/p>

6. OTHER MATTERS<\/span><\/b><\/h1>

In the event of any inconsistency between the provisions of the KVKK and other relevant legislation and this Policy, the provisions of the KVKK and other relevant legislation shall take precedence.<\/p>

In the event of any changes to the Policy, the relevant provisions of the Policy will be updated accordingly.<\/p>

7. SPECIAL CIRCUMSTANCES AND EXCEPTIONS<\/span><\/b><\/h1>

There isn’t any.<\/p>

8. AMENDMENTS AND REPEAL<\/span><\/b><\/h1>

This Policy is reviewed and updated by RAYVAG<\/b>.<\/p>

9. ENFORCEMENT<\/span><\/b><\/h1>

This Policy, prepared by RAYVAG<\/b>, entered into effect on July 14, 2026.<\/p>

10. IMPLEMENTATION<\/span><\/b><\/h1>

RAYVAG <\/b>is responsible for implementing this document.<\/p>

11. DISTRIBUTION<\/span><\/b><\/h1>

The policy is published on the RAYVAG <\/b>website (www.rayvag.com.tr) and communicated to third parties and Company employees.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
\n\t
<\/div>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\tIt is very important to us to keep you informed about our services and products and to hear your opinions and suggestions.\t<\/h6>\n\t\t

\n\t\t\t\t\tContact Us\t\t\t<\/h2>\n\t\t

For this reason, we encourage you to contact us with any questions, feedback, or suggestions you may have. By communicating directly with you, we can work together to develop the solutions that best meet your needs and further improve our quality and services.<\/p>\n\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t
\n\t\tTo Contact Us\t<\/h6>\n\t\t

\t\n\t\t+ 90 322 394 5080\t<\/a>\n\t<\/h2>\t\t

\t\n\t\t+ 90 850 346 7984\t<\/a>\n\t<\/h2>\t<\/div>\n
\n\t\t\t
\n\t\t\t\t
\n\t\tOur Address\t<\/h6>\n\t
\tAOSB Atat\u00fcrk Bulvar\u0131 No:28 , Sar\u0131\u00e7am Adana<\/a>\t<\/h5>\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t