AIM

With this policy, to make statements about the personal data processing activities and systems adopted by Ler Properties for the protection of personal data, and in this context, to protect personal data, especially our business partners, current and candidate employees, current and potential customers, company shareholders, visitors and third parties, by our company. It is aimed to ensure transparency by informing the persons processed.

PRINCIPLES OF PROCESSING OF PERSONAL DATA

In order to ensure compliance with KVKK, personal data will be processed by Ler Properties in accordance with the general principles and provisions stipulated in the legislation. In this context, Ler Properties; It complies with the principles listed below in the processing of personal data in accordance with international and national legislation regarding KVKK.

1. Engaging in Personal Data Processing Activities in Compliance with the Law and the Rules of Honesty

ler Properties; It is obliged to act in accordance with the law and the rules of honesty within the scope of processing personal data. In this context, proportionality requirements will be taken into account and personal data will not be used for purposes other than processing.

2. Ensuring Personal Data is Accurate and Up-to-Date Where Necessary

Ler Properties; It is obliged to ensure that the personal data it processes are accurate and up-to-date, taking into account the fundamental rights of personal data owners and its own legitimate interests, and to establish the necessary systems to take the necessary measures in this regard.

3. Processing for Specific, Clear and Legitimate Purposes

Ler Properties; It is obliged to determine the purposes for which personal data will be processed and to inform the data owners of these purposes before personal data is processed. Personal data will not be processed for purposes other than specified legitimate and lawful purposes.

4. Being Related to the Purpose for Processing, Being Limited and Proportionate

Ler Properties; will process personal data in a manner suitable for achieving the specified purposes and will avoid the processing of personal data that is not relevant or needed to achieve the purpose.

5. Preservation for the Period Envisaged in the Relevant Legislation or Necessary for the Purpose for which they are Processed

Ler Properties; In accordance with Article 138 of the Turkish Penal Code and Articles 4 and 7 of the KVK Law; will retain the personal data they process only for the period stipulated in the relevant legislation and laws or as required by the purpose of processing personal data. ler Properties; First of all, it will determine whether the relevant legislation stipulates a period for storing personal data, if a period is determined, it will act in accordance with this period, and if a period is not specified, it will retain personal data for the period necessary for the purpose for which they are processed. If the period expires or the reasons requiring processing disappear, personal data will be deleted, destroyed or anonymized by Ler Properties.

6. Carrying out Personal Data Processing Activities in Compliance with All the Basic Principles in Article 4 of the Law, Based on One or More of the Personal Data Processing Conditions Specified in Article 5 of the Law

As a rule, personal data will be processed in accordance with one or more of the conditions specified in Article 5 of the KVK Law. It will be determined by Ler Properties whether the personal data processing activities carried out by the Company’s business units are carried out based on one or more of these conditions. Personal data processing activities that do not meet some of these will not be included in the processes. In addition to ensuring that personal data processing activities are carried out based on one or more of the personal data processing conditions, in all personal data processing activities specified in Article 4 of the KVK Law and III of the Policy. It will be ensured that all principles specified in the sections are complied with and include these principles. Personal data processing activities will be carried out by taking into account the special provisions stipulated in the Personal Data Protection Law regarding the processing of special personal data and their transfer to third parties and abroad; In addition to the above-mentioned issues, personal data processing activities will be carried out by fulfilling the special requirements required by the law in these cases.

TERMS OF PROCESSING OF PERSONAL DATA

Detection and Processing of Personal Data

In accordance with KVKK, personal data is defined as “Any information regarding an identified or identifiable natural person”. The concept of personal data does not only consist of information that enables the recognition and identification of individuals such as name, surname, place of birth, date of birth, but also includes all physical, social, cultural, economic and psychological information of individuals.

In addition to the person’s identity information, citizenship number, tax number, passport number, social security number, driver’s license number, vehicle license plate, home address, business address, e-mail address, telephone number, fax number, resume, photo, video, genetics. All information that makes a person specific or identifiable, such as personal information, blood type, criminal history and criminal record information, is considered personal data and falls within the scope of personal data protection.

In accordance with this definition, Ler Properties will determine whether all data they collect, including third parties, especially their business partners, employees and customers, falls within the scope of personal data and will process this data in accordance with the rules of the KVKK.

Processing of personal data; Performed on data such as obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, making available, classifying or preventing its use by fully or partially automatic or non-automatic means provided that it is part of any data recording system. It covers all kinds of transactions.

Ler Properties; In accordance with KVKK, personal data will only be processed with the explicit consent of the relevant persons. However, if any of the following conditions exist, it is possible to process personal data without explicit consent:

It is clearly stipulated in the law,

It is a mandatory situation for the protection of the life or physical integrity of themselves or someone else, who are unable to express their consent due to actual impossibility or whose consent is not given legal validity,

It is necessary to process personal data of the contracting parties, provided that it is directly related to the establishment or performance of a contract,

In cases where it is mandatory for the data controller to fulfill its legal obligation.

Publicization of personal data by the relevant person,

Data processing is mandatory for the establishment, exercise or protection of a right,

It is mandatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned.

2. Processing of Special Personal Data

Within the scope of the Law, some personal data are considered as private data and Ler Properties will not process such data without the express consent of the person concerned or without the exceptions set out in the third paragraph of Article 6 of the Law. Explicit consent; It means obtaining detailed consent after informing the person whose data will be collected for the purposes for which this data is collected.

KVKK; data regarding a person’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data are private data. considered it as such.

Ler Properties will also take adequate measures determined by the Personal Data Protection Board in the processing of special personal data.

3. Transfer of Personal Data

Ler Properties will be able to transfer personal data to third parties with the explicit consent of the data owner, by taking the necessary security measures in line with the legal personal data processing purposes. However, Ler Properties will be able to transfer data that can be processed without explicit consent and data regarding health and sexual life to third parties without explicit consent in accordance with the limitations stipulated in the KVKK.

Ler Properties will take the necessary administrative and technical measures to transfer the data it transfers without explicit consent in accordance with the limitations in the KVKK.

Ler Properties may transfer personal data to foreign countries that have been declared to have adequate protection by the KVK Board, or, in the absence of sufficient protection, to foreign countries where the data controllers in Turkey and the relevant foreign country have committed in writing to adequate protection and have the permission of the KVK Board.

4. Building Entrances and Personal Data Processing Activities and Network and Website Users

In order to ensure security by Ler Properties, Ler Properties engages in personal data processing activities for monitoring guest entries and exits through security cameras in its buildings and facilities.

Personal data processing is carried out by Ler Properties by using security cameras and recording guest entries and exits.

Video recordings of our visitors are taken via camera monitoring system at Ler Properties building, facility entrances and inside the facility.

Ler Properties, within the scope of surveillance activities with security cameras; It aims to improve the quality of the service provided, to ensure its reliability, to ensure the safety of Ler Properties, customers and third parties, and to protect the interests of customers regarding the service they receive.

Ler Properties carries out camera monitoring activities for security purposes in accordance with the regulations in the KVK Law and the Law on Private Security Services and relevant legislation.

Only a limited number of Ler Properties employees have access to the records recorded and maintained digitally.

In accordance with Article 12 of the KVK Law, Ler Properties takes the necessary technical and administrative measures to ensure the security of personal data obtained as a result of camera monitoring activities.

Apart from recording with the camera mentioned above, by Ler Properties; Personal data processing activities are carried out to ensure security and to monitor guest entries and exits in Ler Properties buildings and facilities for the purposes specified in this policy.

Ler Properties provides internet access to visitors who request it during their stay in the building and facilities, to ensure security and for the purposes specified in this policy. In this case, log records regarding internet access are recorded in accordance with Law No. 5651 and the mandatory provisions of the legislation issued in accordance with this Law; These records are processed only upon request by authorized public institutions and organizations or to fulfill the relevant legal obligations during the audit processes to be carried out within Ler Properties. Only a limited number of employees have access to the log records obtained.

On the websites owned by Ler Properties; To ensure that people visiting these sites carry out their visits on the sites in accordance with the purposes of their visit; Internet movements within the site are recorded by technical means in order to show them customized content and engage in online advertising activities.

5. Deletion, Destruction, Anonymization of Personal Data

Even though it has been processed in accordance with the provisions of the relevant law, as regulated in Article 138 of the Turkish Penal Code and Article 7 of the KVK Law, personal data will be deleted and destroyed by Ler Properties based on its own decision or upon the request of the personal data owner, in case the reasons requiring processing are eliminated. or made anonymous.

In this context, Ler Properties takes the necessary technical and administrative measures to fulfill its relevant obligations, develops the necessary operating mechanisms in this regard, trains and assigns the relevant business units to comply with these obligations and ensures their awareness.

LER PROPERTIES OBLIGATIONS

1. Obligation to Inform the Personal Data Owner

Ler Properties will inform personal data owners about the following issues during the acquisition of personal data:

– Identity of the data controller and his representative, if any,

– For what purpose personal data will be processed,

– To whom and for what purpose personal data can be transferred,

– Method and legal reasons for collecting personal data,

– Personal data owner KVKK art. His rights under Art. 11.

In accordance with this obligation, Ler Properties publishes the information text they have prepared on their website and designs appropriate processes to inform the data owner during data collection activities.

2. Obligation to Respond to Applications of Personal Data Owners

Personal data owners may request information by applying to Ler Properties in writing in accordance with the KVKK or by other methods determined by the KVK Board, using the attached application form or the KEP address “………………………..”.

Ler Properties has established and implements procedures for responding to applications in accordance with Article 13 of the KVKK and other administrative and technical regulations in order to evaluate the rights of personal data owners and provide the necessary information to personal data owners.

Personal data owners;

– Learning whether your personal data is being processed or not,

– Requesting information if your personal data has been processed,

– Learning the purpose of processing your personal data and whether they are used for their intended purpose,

– Knowing the third parties to whom your personal data is transferred at home or abroad,

– Request correction of your personal data if it is incomplete or incorrectly processed,

– Requesting the deletion or destruction of your personal data within the framework of the conditions stipulated in the relevant legislation,

– To request that the transactions made on your personal data in accordance with the relevant legislation be notified to third parties to whom your personal data has been transferred,

– Object to the emergence of a result against you by analyzing your processed data exclusively through automatic systems,

– In case you suffer damage due to unlawful processing of your personal data, you have the right to request compensation for the damage.

Ler Properties only processes requests sent to registered e-mail addresses in writing or signed with a secure electronic signature. If the KVK Board determines other application methods, it will also accept applications through these methods.

Ler Properties will respond to the request as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request. Ler Properties will accept the applications and take the necessary action or reject the applications with reasons.

In cases where the personal data owner’s application is rejected, the answer given is insufficient, or the application is not answered, the personal data owner may file a complaint with the KVK Board within 30 (thirty) days from the date of learning the answer and, in any case, within 60 (sixty) days from the date of application.

Ler Properties will respond to personal data owners in a timely and justified manner as stipulated by KVKK in order to prevent complaints.

3.1. Taking Technical and Administrative Measures to Ensure Lawful Data Processing

It analyzes all processes related to personal data processing activities carried out by business units within Ler Properties; All activities carried out by business units, from collection to deletion of data, are not audited for legal compliance.

Personal data processing activities carried out within Ler Properties are audited by the established technical systems.

The technical measures taken are reported regularly, and when a deficiency or illegality is detected, the relevant person is notified and the deficiency or illegality is corrected.

Ler Properties informs and trains its employees about personal data protection law and the lawful processing of personal data.

It includes provisions in the contracts and documents governing the legal relationship between Ler Properties and its business partners, employees and customers, which impose the obligation not to process, disclose or use personal data in violation of the regulations in the KVKK.

Ler Properties’ access to personal data is limited only to the relevant company employee in line with the processing purpose.

Procedures to ensure that the activities of each business unit comply with the personal data processing conditions specified in the KVKK are determined specifically for each business unit and the activity it carries out. Implementation rules are determined for business units, necessary administrative measures are taken, procedures are created and training is provided to ensure the control of these rules and the continuity of the application.

3.2. Taking Technical and Administrative Measures to Prevent Unlawful Access to Personal Data

Ler Properties takes the necessary administrative and technical measures, depending on the nature of the data to be protected, to prevent personal data from being unlawfully obtained, disclosed, displayed and transferred to third parties.

Technical measures are taken in accordance with technological developments and the measures taken are periodically updated and renewed.

Ler Properties designs and commissions access and authorization technical processes in accordance with legal compliance requirements. The technical measures taken are periodically reported to the relevant person and technological solutions are produced for issues with security risks.

Relevant software and systems are installed, including software and hardware that includes virus protection systems and firewalls.

Ler Properties employees are trained on the technical measures taken and personnel knowledgeable in technical matters are employed.

Ler Properties undertakes that its employees will not disclose the personal data they have learned to anyone else in violation of the provisions of KVKK and will not use it for purposes other than processing. It is ensured that this commitment is valid even after the employees leave their jobs.

Articles to protect personal data are added to the contracts made by Ler Properties with the persons to whom personal data is transferred.

3.3.Audit of Measures Taken for the Protection of Personal Data

In terms of the technical and administrative measures it will take, Ler Properties carries out the necessary inspections regarding the operation of the measures and establishes systems to have them carried out. These audit results are reported to the relevant department within the scope of Ler Properties’ internal functioning and the necessary activities are carried out to improve the measures taken.

3.3. Measures to be Taken in Case of Unauthorized Disclosure of Personal Data

Ler Properties is obliged to notify the relevant personal data owner and the KVK Board as soon as possible if the processed personal data is obtained by others through illegal means. In this context, the necessary internal structure is being created.

4. Obligation to Register in the Data Controllers Registry

Before starting to process data, Ler Properties will be registered in the data controllers registry by submitting application information and documents within the announced period determined by the KVK Board. The documents to be submitted are as follows:

– Identity and address information of Ler Properties as the data controller and its representative, if any,

– For what purpose personal data will be processed,

– Explanations about the data subject person group and groups and the data categories of these people

– Recipient or recipient groups to which personal data may be transferred,

– Personal data intended to be transferred to foreign countries,

– Measures taken regarding personal data security,

– Maximum period required for the purpose for which personal data are processed.

ORGANIZATIONAL STRUCTURING WITHIN LER PROPERTIES

A “Personal Data Protection Committee” or a person responsible for this matter has been appointed within Ler Properties to manage this policy and other policies related to this policy and to carry out the actions determined by the senior management for compliance.

In this context, the following minimum actions are taken by the Committee or the person to be appointed:

– To determine the basic policies regarding the processing and protection of personal data and what needs to be done to comply with the legislation,

– To submit the determined basic policies and action steps to the approval of the senior management; overseeing and coordinating its implementation,

– To decide how the policies regarding the processing and protection of personal data will be implemented and how the audit will be carried out, and to make the necessary assignments after receiving the approval of the senior management,

– To identify the risks that may occur in Ler Properties’ personal data processing activities and to ensure that necessary precautions are taken; Presenting improvement suggestions to senior management for approval,

– Ensuring that employees are trained on the protection of personal data and company policies,

– To decide on the applications of personal data owners at the highest level,

– To make the necessary arrangements within the company for Ler Properties to fulfill its obligations under KVKK,

– To follow developments in the protection of personal data; To make recommendations to senior management on what needs to be done within the scope of these developments,

Managing relations with the Institution and the Board.

ANNEX-1 DEFINITIONS