The purpose of this Privacy Policy is to determine the terms and conditions accepted for the privacy and security of the data shared with the Company by the users/members/visitors of the website (hereinafter referred to as the “USER” or “DATA SUBJECT”) or produced by the Company while the DATA SUBJECT uses the DOMAIN during the services provided by Borusan Birleşik Boru Fabrikaları Sanayi ve Ticaret AŞ. (hereinafter referred to as the “COMPANY“) and/or through the website operated by service providers (hereinafter referred to as the “DOMAIN“).

What Kind of Data Is Processed?

Under this heading, the personal data processed by the Company in accordance with the Law on the Protection of Personal Data numbered 6698 are specified below, not limited to those listed. Unless otherwise expressly stated, the term “personal data” under the terms and conditions provided under this Privacy Policy will include the following information:

• Identity Information (Name – Surname)
• Contact Information (Phone, address, e-mail)
• Transaction Security (IP address, user transaction records)

The Company is able to obtain information about the DOMAIN use of the DATA SUBJECT by using cookies, which is a technical communication file and the IP information is collected through cookies to determine the access and usage habits of the services offered on the Website and to make improvements on the Website.

The data, which have been irreversibly anonymized in accordance with the provisions of Articles 3 and 7 of the Law on Protection of Personal Data numbered 6698 , will not be considered as personal data as per the provisions of the said Law and the processing activities related to this data will be carried out without being bound by the provisions of this Privacy Policy.

For What Purposes Is the Data Used?

The COMPANY processes the personal data provided by the DATA SUBJECT, for the use of the services provided on the DOMAIN, to ensure the legal, technical and commercial security of our Company and the persons who have business relations with our Company, and to provide necessary information to the DATA SUBJECT and to fulfill the obligations arising from the nature of these activities.

The Company may also process the personal data in question in order to improve the services it provides, to improve the service and to provide necessary information to the DATA SUBJECT and to fulfill the obligations arising from the nature of the services it provides.

The personal data in question may be used in order to contact the DATA SUBJECT or to improve DATA SUBJECT’s experience on the DOMAIN (such as improving existing services, creating new services and providing tailor-made services), and may also be used within the scope of COMPANY’s reporting and business development activities and may be used for making statistical evaluations, creating databases and carrying out market researches without revealing the identity of the DATA SUBJECT. Such data may be processed, stored, transferred to third parties by the COMPANY and its collaborators for the purpose of direct marketing, and can be communicated to third parties and the DATA SUBJECT may be contacted to make notifications regarding the promotion of various applications, products and services, and maintenance and support activities if the required consent in these regards is provided by the DATA SUBJECT.

The Company may also process and share personal data with third parties in accordance with Articles 5 and 8 of the Law on Protection of Personal Data numbered 6698 and/or in case of exceptions in the relevant legislation without obtaining the consent of the Data Subject. The main ones of these situations are listed below:

• When it is clearly stipulated in laws,
• When a person is unable to disclose her/his consent due to actual impossibilities or when the consent of a person whose consent is not legally valid is mandatory for protection or body integrity of her/him or another person,
• When it is required to process personal data to the extent it is directly related to the establishment or performance of a contract concluded by and between the Data Subject and the Company,
• When it is mandatory to fulfill legal obligations,
• When the data concerned is made available to the public by the data subject himself/herself,
• When data processing is mandatory for the establishment, exercise, or protection of any right,
• When it is mandatory to process data for legitimate interests of the Company, provided that fundamental rights and freedoms of the data subject are not prejudiced.

Who Can Access Data?

The Company may transfer the personal data belonging to the Data Subject and the new data obtained by using this personal data to the third parties providing services to the Company in order to fulfill the purposes specified to the Data Subject with this Privacy Policy provided that it is limited for the purpose of providing such services.

The Company may share such data with third parties such as outsourced service providers of the company, including those sending SMS, hosting service providers, law firms, research companies, partners, suppliers, company shareholders, and call centers in order to improve the experience of the Data Subject (including improvement and customization), ensure the security of the Data Subject, detect fraudulent or unauthorized uses, research operational evaluation, to eliminate errors regarding the Website or Company services and to achieve any of the objectives contained in this Privacy Policy. In line with the demands of the authorized institutions and organizations, the data may be shared with such institutions as well.

With this Privacy Policy, the Company informs the Data Subject that the third parties mentioned may store the personal data of the Data Subject on their servers all over the world, provided that it is limited to the purposes stated above.

Your Rights Regarding Your Personal Data

By filing an application to our Company, the Data Subject is entitled:

• To learn whether his/her personal data are processed or not,
• To request information if his/her personal data are processed,
• To learn the purpose of data processing and whether this data is used for intended purposes,
• To know the third parties to whom personal data have been transferred at home or abroad,
• To request for rectification of the personal data if they are processed incompletely or inaccurately,
• To request for the deletion or destruction of his/her personal data within the framework of the terms set forth in the respective legislation,
• To request notification of correction, erasure or destruction carried out in line with the respective legislation to third parties to whom the personal data has been transferred,
• To object to the processing, exclusively by automatic means, of personal data, which leads to an unfavorable consequence for the data subject,
• To demand indemnification of losses suffered due to personal data being processed in breach of the law.

The Data Subject is responsible to the Company that the information subject to this Privacy Policy provided to the Company through the use of the Website is complete, correct and up-to-date and should there be any changes in this information, he/she must update them immediately. The Company will not have any responsibility if the Data Subject has not provided up-to-date information.

If the Data Subject makes a request that results in the inability to use any of his/her personal data by the Company, it may be possible that he/she cannot fully benefit from the services the Company has undertaken to provide. He/she hereby declares that any responsibility that will arise in this context will belong to himself/herself.

Storage Period of Personal Data

The COMPANY will store the personal data provided by the DATA SUBJECT for the period required by the above-mentioned processing purposes.

In addition to this, the COMPANY may store personal data in the event of any dispute that may arise between the Company and the DATA SUBJECT, limited to the purpose to carry out the necessary defenses within the scope of the dispute, and for the duration of the limitation periods determined in accordance with the relevant legislation.

Measures and Commitments Regarding Data Security

The Company undertakes to take the necessary technical and organizational measures and to carry out the necessary audits in order to ensure the appropriate level of security to ensure the following conditions specified in the relevant legislation or stated in this Privacy Policy:

• prevent unlawful processing of personal data,
• prevent unlawful access to personal data; and

ensure the retention of personal data.In case of linking to other applications on the website, the Company does not bear any responsibility for the privacy policies and contents of the applications.

Changes to the Privacy Policy

The Company may change the provisions of this Privacy Policy at any time. The current Privacy Policy takes effect on the date it is published on the DOMAIN.