REYSAŞ VEHICLE INSPECTION STATIONS OPERATIONS INC. – GENERAL INFORMATION NOTICE

REYSAŞ VEHICLE INSPECTION STATIONS OPERATIONS JOINT STOCK COMPANY
GENERAL INFORMATION NOTICE

This “Information Notice” has been prepared for individuals whose personal data we process, including relatives of job candidates and employees, auditors, business partner representatives, public institution officials, potential buyers of goods or services, suppliers, supplier employees, supplier representatives, customers, customer employees, board chairpersons, board members, and visitors.

As Reysaş Vehicle Inspection Stations Operations Joint Stock Company (hereinafter referred to as the “Company”), we would like to inform you, in accordance with the Law on the Protection of Personal Data No. 6698 (hereinafter referred to as “KVKK”), about the processing of your personal data and your rights.

I – Data Controller
The Company operates at Küçük Çamlıca Mahallesi, Erkan Ocaklı Sokak No:13, Üsküdar/Istanbul, and acts as the data controller under KVKK. We process your personal data within the scope of financial information, physical space security, communication, identity, professional experience, customer transactions, personnel records, and supplier transactions.

II – Purpose of Processing Personal Data
Your personal data may be processed for the following purposes:
Emergency management, information security, candidate/intern/student recruitment and placement, job application processes, fulfillment of obligations arising from employment contracts and legislation, employee benefits and compensation, audit/ethics processes, training, legal compliance, financial and accounting operations, ensuring physical space security, assignment procedures, legal affairs, communication, HR planning, business operations and audits, occupational health and safety, evaluating suggestions to improve business processes, business continuity, procurement processes, sales processes, production and operations, customer relationship management, customer satisfaction, event organization, performance evaluation, risk management, contract management, request/complaint handling, security of movable property and resources, supply chain management, ensuring the security of data controller operations, investment processes, providing information to authorized persons/institutions, and execution of management activities.

III – To Whom and For What Purpose the Personal Data May Be Transferred
Your personal data may be shared with:

• Authorized public institutions to fulfill legal obligations

• Accounting offices, customers, suppliers, TÜVTÜRK, affiliates and subsidiaries for ensuring physical security, fulfilling employment obligations, procurement and sales processes, communication, logistics, financial and legal affairs

IV – Method and Legal Basis for Collecting Personal Data
Your personal data is collected through automated or non-automated means—verbally, in writing, or electronically—based on the legal grounds stated in Articles 5 and 6 of the KVKK: fulfilling legal obligations, legal requirements, contract execution, and legitimate interest of the data controller. This includes phone calls, in-person meetings, contract signing, invoicing (non-automated methods), as well as CCTV in common and working areas, and email communications (automated methods).

V – Your Rights Under Article 11 of the KVKK
In accordance with Article 11 of the KVKK, you may exercise your rights regarding your personal data by fully completing the information in the Application Form and submitting your request as outlined in Article 13(1) of the KVKK and the Communiqué on Application Procedures to the Data Controller via one of the following methods:

a) By visiting our headquarters in person at Küçük Çamlıca Mahallesi Erkan Ocaklı Sokak No:13, Üsküdar/Istanbul
b) By sending a notarized or registered letter to the same address to verify your identity
c) By sending an email to “kvkk@reysas.com” from your registered email address in our systems
d) Or by using other methods that may be determined by the Personal Data Protection Authority in the future

Your request will be processed free of charge and concluded within thirty days depending on the nature of the request. However, if the process incurs a cost, a fee may be charged in accordance with the tariff set by the Personal Data Protection Board.