ENTRANCE

Protection of personal data Toyi Oyun ve Tasarım A.Ş. (“Company” or “TOYİ”) is among its top priorities, and our Company makes every effort to comply with all legislation in force in this regard. The most important aspect of this issue is this Personal Data Protection and Processing Policy (“Policy”).

Within the framework of this Policy, the principles adopted in carrying out personal data processing activities, including personal data of children, carried out by our Company and the basic principles adopted in terms of compliance of our Company’s data processing activities with the regulations in the Personal Data Protection Law No. 6698 (“Law”) are explained and thus Our company provides the necessary transparency by informing personal data owners. With full awareness of our responsibility in this context, your personal data is processed and protected within the scope of this Policy.

Scope

This Policy relates to all personal data of persons other than our Company’s employees processed automatically or non-automatically as part of any data recording system.

The activities carried out by our Company regarding the protection of the personal data of our employees are managed under the TOYİ Employee Personal Data Protection and Processing Policy, which was written in parallel with the principles in this Policy.

ISSUES RELATED TO THE PROCESSING OF PERSONAL DATA

2.1       Processing of Personal Data in Accordance with the Principles Provided in the Legislation

2.1.1. Processing in Compliance with the Law and the Rules of Honesty

Personal data is processed in accordance with the general rule of trust and honesty, without harming the fundamental rights and freedoms of individuals. Within this framework, personal data is processed to the extent and limited to the extent required by our Company’s business activities.

2.1.2. Ensuring Personal Data is Accurate and Up to Date When Necessary

Our company takes the necessary precautions to ensure that personal data is accurate and up-to-date throughout the period it is processed, and establishes the necessary mechanisms to ensure the accuracy and up-to-dateness of personal data for certain periods.

2.1.3. Processing for Specific, Clear and Legitimate Purposes

Our company clearly states the purposes of processing personal data and processes it within the scope of purposes related to these activities in line with its business activities.

2.1.4. Being Related to the Purpose for Processing, Limited and Proportionate

Our company collects personal data only to the extent and nature required by its business activities and processes it limited to specified purposes.

2.1.5. Preservation for the Period Envisaged in the Relevant Legislation or Necessary for the Purpose for which they are Processed

Our company retains personal data for the period necessary for the purpose for which they are processed and the minimum period stipulated in the relevant legal legislation. In this context, our Company first determines whether a period of time is stipulated in the relevant legislation for the storage of personal data, and if a period is determined, it acts in accordance with this period. If there is no legal period, personal data is stored for the period necessary for the purpose for which they are processed. At the end of the specified storage periods, personal data is destroyed in accordance with the periodic destruction periods or the data owner’s application and with the specified destruction methods (deletion and/or destruction and/or anonymization).

2.2    Conditions for Processing Personal Data

Explicit consent of the personal data owner is only one of the legal bases that enable the lawful processing of personal data, and in case one of the following conditions is met, personal data is processed by our Company without seeking the explicit consent of the data owner.

Other than explicit consent, the basis for personal data processing may be only one of the conditions specified below, or more than one condition may be the basis for the same personal data processing activity. If the data processed is personal data of special nature, the conditions contained in heading 2.3 of this Policy (“Processing of Personal Data of a Special Category”) will apply.

2.2.1    Explicitly Provided in Laws

If it is clearly provided for in the law, in other words, if there is a clear provision in the relevant law regarding the processing of personal data, the personal data of the data owner may be processed by our Company within the framework stipulated in the legislation.

2.2.2    Failure to Obtain Explicit Consent of the Person Relevant Due to Actual Impossibility

If it is necessary to process the personal data of a person who is unable to express his/her consent due to actual impossibility or whose consent cannot be recognized as valid, in order to protect the life or physical integrity of himself or another person, the personal data of the data owner may be processed.

2.2.3    Being Directly Involved in the Establishment or Performance of the Contract

If processing of personal data is necessary, provided that it is directly related to the establishment or performance of a contract to which the data owner is a party.