Camera Systems Privacy Notice

Introduction

This information notice has been prepared by Ones Bilişim Teknolojileri Anonim Şirketi (“Company”) in accordance with Law No. 6698 on the Protection of Personal Data (“KVKK”) and the “Communiqué on the Principles and Procedures to Be Followed in Fulfilling the Obligation to Inform.” Its purpose is to inform employees, visitors, suppliers and third parties about the personal data processed by the closed-circuit camera recording systems used in the Company’s buildings and facilities.

Pursuant to Article 10 KVKK, the Company, as data controller, provides information on:

• the purposes for which personal data are processed;
• the recipients of personal data and the purposes of transfer;
• the method and legal grounds for collecting personal data;
• the rights listed in Article 11 KVKK.

Definitions

• Personal Data: Any information relating to an identified or identifiable natural person.
• Special Categories of Personal Data: Sensitive data such as race, ethnic origin, political opinion, religious belief, health, sexual life, criminal conviction, biometric and genetic data.
• Data Controller: The legal entity that determines the purposes and means of processing personal data.
• Explicit Consent: A freely given, informed statement of approval relating to a specific matter.
• VERBİS: The Data Controllers’ Registry Information System managed by the Personal Data Protection Board.

Types of Personal Data Processed

Visual Data: Image recordings obtained through camera systems.

Purposes of Processing Personal Data

Your personal data may be processed—on the legal grounds in Article 5 KVKK—for the following purposes:

• Ensuring physical-area security
• Conducting internal security audits
• Managing emergency and crisis processes
• Tracking visitor entry and exit
• Preventing unauthorised access
• Fulfilling legal obligations and providing information to authorised bodies

(For the detailed purpose list, see Personal Data Processing and Protection Procedure .)

Methods and Legal Grounds for Collecting Personal Data

Your personal data are collected automatically 24/7 via camera systems installed inside and around the building and are processed on the following legal grounds:

• Ensuring physical-area security
• The Company’s legitimate interests
• Fulfilment of legal obligations

Under Article 5/2-f KVKK, personal data may be processed without explicit consent where processing is necessary for the legitimate interests of the data controller, provided fundamental rights and freedoms are not harmed.

Recipients of Personal Data and Purposes of Transfer

Camera recordings may be transferred—within the conditions of Articles 8 and 9 KVKK—only to:

• Authorised public institutions and organisations (judicial/administrative authorities)
• Legally authorised audit firms

Technical and administrative measures—such as encryption, access control, log management, confidentiality agreements and periodic audits—outlined in the Personal Data Processing and Protection Procedure are applied to safeguard personal data.

Retention Period of Personal Data

Personal data processed for the purposes stated in this notice are retained in accordance with the retention and destruction schedule defined in the Personal Data Processing and Protection Procedure / Deletion, Destruction and Anonymisation of Data and are then deleted, destroyed or anonymised.

Rights of the Data Subject

Under Article 11 KVKK you have the right to:

• Learn whether your personal data are processed;
• Request information if they are processed;
• Learn the purpose of processing and whether they are used appropriately;
• Know the third parties to whom they are transferred at home or abroad;
• Request correction of incomplete or inaccurate data;
• Request deletion or destruction of personal data;
• Request notification of corrections or deletions to third parties;
• Object to results produced solely by automated processing;
• Claim compensation for damage arising from unlawful processing.

Application Procedure

You may submit your requests under Article 11 KVKK in writing or via registered electronic mail (KEP), secure electronic signature or your e-mail address registered in our system:

• Written application: Complete the “KVKK Application Form” and send it with wet signature to the Company address by post.
• KEP: Send via our KEP address.
• E-mail: Send from your registered e-mail address to ik

Your request will be concluded free of charge within 30 days of receipt. If the action requires a cost, the tariff set by the Personal Data Protection Board will apply.