Anatoli Pasta

General Clarification Text on Protection and Processing of Personal Data

In accordance with the Law on the Protection of Personal Data No.6698 (" KVKK "), Golda Gıda San.ve Tic.A.Ş. The scope of processing by ( company) is explained below.

The Method and Legal Reason of Our Collection of Your Personal Data

Your personal data is collected by our Company in different channels and based on legal reasons to comply with the legislation and Company policies in order to carry out our activities. In accordance with the basic principles stipulated by the KVKK, your personal data can be processed and transferred for the purposes specified in this Clarification Text within the scope of the personal data processing conditions and purposes specified in Articles 5 and 6 of the KVKK.

Purposes of Processing Your Personal Data

Your collected personal data are processed in accordance with the basic principles stipulated by KVKK and within the personal data processing conditions and purposes specified in Articles 5 and 6 of KVKK, Golda Gıda San.ve Tic.A.Ş. for the following purposes:

Golda Gıda San.ve Tic.A.Ş. Carrying out the necessary work and carrying out activities in this direction by the business units of our Company in order for the commercial activities to be carried out in accordance with the legislation and Company policies;
Golda Gıda San.ve Tic.A.Ş. determining, planning and implementing short, medium and long term commercial policies;
Golda Gıda San.ve Tic.A.Ş. supporting the design, planning and execution of human resources activities;
Golda Gıda San.ve Tic.A.Ş. ensuring the commercial and legal security of affiliated group companies and real persons with whom there is a business relationship;
Golda Gıda San.ve Tic.A.Ş. protecting its commercial reputation and trust.
Detailed information on the purposes of processing your personal data by our Company, Golda Gıda San.ve Tic.A.Ş., which you can access at www.golda.com.tr. It is explained in the Personal Data Protection and Processing Policy.

For what purpose do we transfer your Personal Data to whom?

Your personal data collected; In accordance with the basic principles stipulated by KVKK and within the personal data processing conditions and purposes specified in Articles 8 and 9 of KVKK, Golda Gıda San.ve Tic.A.Ş. for the following purposes; to our business partners, suppliers, Bera Holding A.Ş. and companies within the holding, our shareholders, companies with direct and indirect subsidiaries in Turkey and abroad, legally authorized public institutions and private persons:
Golda Gıda San.ve Tic.A.Ş. Carrying out the necessary work and carrying out activities in this direction by the business units of our Company in order for the commercial activities to be carried out in accordance with the legislation and Company policies;
Golda Gıda San.ve Tic.A.Ş. Determining , planning and implementing the short, medium and long term commercial policies of;
Golda Gıda San.ve Tic.A.Ş. Supporting the design, planning and execution of human resources activities of affiliated companies;
Golda Gıda San.ve Tic.A.Ş. Bera Holding A.Ş. and Bera Holding A.Ş. Ensuring the commercial and legal safety of real persons with whom the affiliated companies have business relations, fulfilling the contractual obligations,
Golda Gıda San.ve Tic.A.Ş. Bera Holding A.Ş. and Bera Holding A.Ş. Protecting the commercial reputation and trust of affiliated companies.
Detailed information about the transfer of your personal data by our Company is available at Golda Gıda San.ve Tic.A.Ş. It is included in the Personal Data Protection and Processing Policy.

Your Rights as Data Owner in Article 11 of KVKK;

The rights of real persons whose personal data are processed in accordance with Article 11 of the KVKK are as follows;
Learning whether personal data is processed,
If personal data has been processed, to request information regarding this,
Learning the purpose of processing personal data and whether they are used appropriately for their purpose,
To know the third parties to whom personal data are transferred domestically or abroad,
To request correction of personal data in case of incomplete or incorrect processing and to request notification of the transaction made within this scope to third parties to whom personal data have been transferred,
Although it has been processed in accordance with the provisions of the KVKK and other relevant laws, to request the deletion or destruction of personal data in the event that the reasons for its processing disappear, and to request notification of the transaction made within this scope to third parties to whom personal data have been transferred,
Objection to the emergence of a result against the person himself by analyzing the processed data exclusively through automated systems,
To demand the compensation of the damage in case of damage due to the processing of personal data illegally.
Pursuant to the 1st paragraph of Article 13 of the KVK Law, you can submit your request for exercising your above-mentioned rights in writing or by other methods determined by the Personal Data Protection Board in the 'Application Form' available at our company's address "www.golda.com.tr". After it is filled in, you can send it in writing or electronically using the methods listed below.
(a) A wet signed copy of the application form is sent personally or through a notary to the address of the company "Eminettin Mah.Sanayi Bölgesi Küme Evler No: 1 70600 Kazımkarabekir / Karaman",
(b) After completing the application form and signing it with your secure electronic signature, sending the secure electronic signed form to the address "goldagida@hs01.kep.tr" by registered e-mail.
(c) Submitting the application form via mobile signature or by e-mail to the e-mail address "info@golda.com.tr" by using the e-mail address previously notified to the data controller and registered in the data controller's system.
Your requests in your application will be concluded free of charge within thirty days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost for the Company, the fee in the tariff determined by the Personal Data Protection Board in the Communiqué on Application Procedures and Principles for the Data Controller will be charged.

BERA HOLDİNG A.Ş., to which our company is affiliated. DIRECT OR INDIRECT AFFILIATES

Kombassan Paper Matbaa Food and Textile Industry Trade Corporation

Adaçal Industrial Minerals Industry and Trade Corporation

Bera Tourism Construction Travel and Trade Corporation

Divapan Integrated Wood Panel Industry Trade Corporation

Hisar Mining and Building Elements Industry and Trade Corporation

Kombassan Giyim Gıda Turizm Sanayi İç ve Dış Ticaret Anonim Şirketi

Karsu Camlica Village Water Management Corporation

Komal Consumer Goods Production Marketing Industry and Trade Corporation

Koveka Konya and Karaman Textile Industry and Foreign Trade Corporation

Golda Food Industry and Trade Corporation

Kompen PVC Building and Construction Materials Industry and Trade Corporation

Komyapı Hazırbeton Prefabrik Construction Contracting Industry and Trade Corporation

Kongaz Petroleum Products Marketing Industry and Trade Corporation

Muratli Karton Paper Industry and Trade Corporation

MPG Makine Production Group Makine İmalat Sanayi Ticaret Anonim Şirketi

Talay Automotive Industry and Trade Corporation

Komel Energy Industry and Trade Corporation

Anadolu Bearing Manufacturing Industry and Trade Corporation

Yenipark Tourism Industry and Trade Corporation

FOREIGN SUBSIDIARY GROUP COMPANIES

Sc Rulmenti SA Barlad

MZK Shopping Complex Limited Company

New Mgm Manufacturer Private Limited Company

GOLDA GIDA SANAYİ VE TİC.A. S.

STORING PERSONAL DATA

AND

DISPOSAL POLICY

1- PURPOSE OF THE POLICY;

The purpose of our personal data storage and destruction policy is to determine the maximum time required for the purpose of processing personal data, to explain the roadmaps that we will follow as the data controller and to set the goals in the processes of deletion, destruction or anonymization of personal data.

In this context, our aim is to process all personal data of customers, employees, employee candidates, natural person consultants, visitors, suppliers, real person business partners, natural person subcontractors, all real persons, legal entities and other third parties with whom we have legal relations. , To ensure that the relevant persons exercise their rights effectively and that they are processed in accordance with the Turkish Constitution, international conventions, the Law on the Protection of Personal Data No. 6698 and other relevant legislation.

2 - BASE OF POLICY

Our policy has been created as a requirement of the 5th and 6th articles of the Regulation on the deletion, destruction or anonymization of personal data, which entered into force by publishing in the Law on the Protection of Personal Data dated 07.04.2016 and numbered 6698 and the Official Gazette dated 28.10.2017 and numbered 30224.

3-CAPACITY POLICIES

Our policy; We process our customers, employees, employee candidates, natural person consultants, visitors, suppliers, real person business partners, real person subcontractors, subsidiaries and cooperating institutions, all real and legal persons with legal relations, belonging to other third parties. It covers all personal data with and without special characteristics defined by KVKK numbered 6698.

4-SHORTENING AND DEFINITIONS

Open Consent	On a specific subject, based on information and
	Consent expressed with free will.

Anonymous	Personal data, even when paired with other data, no
Fetch	in any way	an identified or identifiable fact
	with person	making it unassociable.

Working	Golda Gıda San.Tic.A.Ş. employee of.

Electronic environment	Personal data can be created with electronic devices,
	can be read, changed and stored
	environments.

Non Electronic	All written, printed, outside of electronic media,
Environment	visual etc. other environments.

Service provider	A specific contract to Golda Gıda San.Tic.A.Ş.
	natural or legal person providing services within the framework of.

Related person	The natural person whose personal data is processed.

Related User	Technical storage, protection and
	except for the person or unit responsible for backing up
	within the data controller organization
	or the authorization and instruction received from the data controller
	persons who process personal data.

Destruction	Deletion, destruction or anonymous of personal data
	to be made.

Law	Personal Data Protection Law No. 6698.

Recording Media	Any medium containing personal data that is fully or partially automated or processed in non-automatic ways, provided that it is a part of any data recording system.




Personal Data	Relating to an identified or identifiable natural person
	all kinds of information.

Personal Data Processing	Golda Gıda San.Tic.A.Ş. the personal data processing activities they carry out depending on their business and commercial processes; The inventory that they have created by associating with the data category, the recipient group and the data subject group of personal data processing purposes and the legal reason, explaining the maximum retention period required for the purposes for which the personal data is processed, the personal data foreseen to be transferred to foreign countries and the measures taken regarding data security.
Inventory









Your Personal Data	Such as obtaining, storing, storing, changing, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, which are fully or partially automatic or non-automatic, provided that they are part of any data recording system. any action taken on the data.
Processing







Special Qualified Personal	People's race, ethnicity, political opinion, philosophical
Data	faith, religion, sect or other beliefs, disguise and
	clothing, association, foundation or union membership, health,
	with sexual life, criminal conviction and security measures
	biometric and genetic data with relevant data.

Periodic Destruction	Conditions of processing personal data in the law
	personal data in case of loss of all
	specified in the retention and disposal policy and
	deletion, destruction or
	process of anonymization.

Politics	Personal Data Retention and Destruction Policy

Data Processor	Data based on the authority given by the data controller
	real or legal person who processes personal data on behalf of the responsible person
	person.

Data Record System	By structuring personal data according to certain criteria
	The registry system in which it is processed.

Data Supervisor	The purposes and means of processing personal data
	the establishment of the data recording system and
	the real or legal person responsible for its management (Golda Gıda San.Tic.A.Ş. ni)

Data Controllers	Data controllers to the Data Controllers Registry
Registry Information System	in the application and regarding the Data Controllers Registry
	that they will use in other processes, over the internet
	Accessible, Personal Data Protection Authority
	Information system created and managed by.

words	Data Controllers Registry Information System

regulation	Published in the Official Gazette dated 28 October 2017
	Deletion, Destruction or Anonymous of Personal Data
	Regulation on Making Reconstruction.

5-RESPONSIBILITY AND DISTRIBUTIONS OF DUTIES

Golda Gıda San.Tic.A.Ş. and employees of Bera Holding A.Ş., to which they are affiliated, are obliged to comply with the rules set forth in this Policy and to provide the necessary support to the units responsible for the processing of personal data. Company employees who process personal data act in accordance with the basic principles, personal data processing conditions and special quality personal data processing conditions while carrying out data processing activities.

Table 1: Task distribution for storage and disposal processes

The distribution of the titles, units and job descriptions of those involved in the storage and disposal processes of personal data is given in Table 1.

TITLE	UNIT	RESPONSIBILITY

Legal Affairs Manager	Legal Affairs Directorate	Processing of personal data
		goals and methods
		In the law and relevant legislation
		with determined principles and rules
		whether it is compatible and
		are covered by exceptions
		analysis of absence,
		lighting and express consent
		preparation of texts,
		protection of personal data
		policy and procedure
		written with third parties
		contracts concluded
		Law and related legislation
		harmonizing.
Director of human resources	Human Resources Directorate	Information processed on an individual basis
		Whether it is of special nature
		analysis of personal data
		taking inventory,
		how long is the processed data
		Determination of retaining data,
		those responsible will be made to the registry
		preparation of the application,
		law-compliant processing
		required for supply
		control mechanisms
		establishment.
IT Manager	Information Technologies Directorate	Security of stored data
		Required technology for
		taking precautions, personal
		data retention and destruction
		Writing policy, personal
		data protection policy and
		Writing the procedure.

6-RECORDING MEDIA

All kinds of media containing personal data that are fully or partially automated or processed non-automatically as part of a data recording system are included in the recording medium.

Personal data are stored securely in the environments listed in Table 2 in accordance with the law.

Table 2: Personal data storage environments

Electronic Media		Non-Electronic Environments

Servers (File Server- backup, Logo	 Paper
Tiger Plus - Payroll Management etc.)	 Manual data recording systems (survey forms,
 Software (office	software)	visitor logbook etc.)
 Information security	devices (security	 Written, printed, visual media
wall, intrusion detection and blocking, log
registry file, antivirus, etc.)
 Mobile devices
 Optical Discs (CD, DVD, etc.)
 Personal computers (Desktop, laptop)
 Removable sticks (USB, Memory
Card etc.)
 Printer, scanner, copier

7 - EXPLANATIONS ON STORAGE AND DISPOSAL

Golda Gıda San.Tic.A.Ş. acts within the framework of the following principles in the storage and destruction of personal data.

7.1 Notes on Storage

In Article 4 of the Law, it is stated that personal data should be related, limited and measured for the purpose they are processed and should be kept for the required period foreseen in the relevant legislation or for the purpose for which they are processed, and the processing conditions of personal data are listed in Articles 5 and 6.

Accordingly, within the framework of our activities, personal data are stored for a period stipulated in the relevant legislation or suitable for our processing purposes.

7 . 2 Legal Reasons Requiring Storage

Golda Gıda San.Tic.A.Ş. The personal data processed by Ş. are kept for the periods stipulated in the legislation regarding the purpose of processing and the field of activity. Accordingly, personal data will be kept within the scope of other legislation provisions that are published or to be published, but not limited to the legislation listed below.

Law No. 6698 on Protection of Personal Data,

Turkish Code of Obligations of 6098,

Turkish Commercial Code No. 6102,

Labor Law No. 4857,

Social Insurance and General Health Insurance Law No. 5510,

Occupational Health and Safety Law No. 6331,

Tax Procedure Law No. 213,

Law No. 5651 on Regulation of Broadcasts Made on the Internet and Fight Against Crimes Committed Through These Publications,

It is kept during the storage periods stipulated under the provisions of other legislation, but not limited to these laws.

7-3 Processing Purposes Requiring Preservation

Personal data, Golda Gıda San.Tic.A.Ş. It is stored securely in physical or electronic environments within the framework of the limits specified in the KVKK and other relevant legislation in order to manage legal disputes, especially for the maintenance of business contracts and commercial activities, fulfillment of legal obligations, planning and managing personnel processes, litigation and execution proceedings.

Personal data are processed for the following purposes:

Monitoring personnel recruitment and career processes,
Fulfilling the activities in the employment contract, managing the work, reporting, analysis,
Protection of individuals and public health,
Notifications of personnel wage payments and legal deductions to be paid to institutions,
Providing the necessary training for the professional and personal development of employees, creating personal files of employees,
Execution of finance and accounting transactions,
Preparing a power of attorney for employees appointed by the senior management in order to carry out various works on behalf of the company and have them approved by the notary offices,
Making individual pension deductions at legal rates and notifying contracted banks on behalf of the employee,
Responding to written requests of official authorities such as Law Enforcement Forces, Courts, Enforcement Offices, SSI, İŞKUR, Embassies,

Providing corporate communication,
Establishing contact with real or legal persons who have business relations with Bera Holding A.Ş. and its affiliated companies,
Ensuring the security of Bera Holding A.Ş and its affiliated companies,
Execution of works and transactions as a result of contracts and protocols signed,

Within the scope of VERBIS, determining the preferences and needs of employees, data controllers, contact persons, data controller representatives and data processors, arranging the services provided accordingly and updating them if necessary,
Ensuring the fulfillment of legal obligations as required or required by legal regulations,
Using it as evidence in order to fulfill the burden of proof in legal disputes that may arise in the future.

7-4. Causes Requiring Destruction

Personal data;

Changing or abolishing the relevant legislation provisions that constitute the basis for the processing, storage and destruction of personal data,
No longer the purpose requiring the processing or storage of personal data,
In cases where the processing of personal data takes place only on the basis of express consent, the person concerned withdraws his consent,
The request for the deletion or destruction of the personal data of the relevant person within the framework of his legal rights is examined and approved by the data controller,
In the event that the data controller rejects the application made by the person concerned with the request for deletion, destruction or anonymization of his personal data, the response he gave is insufficient or does not respond within the period stipulated by the law; Making a complaint to the Board and approval of this request by the Board,
In the event that there is no reason to keep the personal data for a longer period, although the maximum period that requires the storage of personal data has passed, Golda Gıda San.Tic.A.Ş. Upon the request of the person concerned, they are deleted, destroyed or re 'sen deleted, destroyed or anonymized.

8-TECHNICAL AND ADMINISTRATIVE MEASURES

Golda Gıda San.Tic.A.Ş. in order to keep personal data securely and to prevent unlawful processing and access. The technical and administrative measures we have taken are listed below, but not limited to those listed.

8- 1 Technical Measures

Risks and threats that may affect the operation of our systems are regularly monitored and the security of our systems is ensured in accordance with the Information Systems Security Procedure.
Data recording media are protected against cyber attacks by anti-virus applications and firewalls. In this context, all software is used under license. The use of unlicensed software is prohibited in our company.
Our information systems are updated regularly.
Access to personal data is provided with double-layer passwords.
Personal data in electronic environment is regularly backed up.
Access to data stored in electronic or non-electronic media is restricted to authorized personnel.
Necessary measures have been taken to ensure that the deleted personal data cannot be accessed or reused.
Necessary training has been provided for special quality personal data security for employees involved in special quality personal data processing processes, and the authorizations of users with access to data have been defined.

8.2. Administrative Measures

Necessary trainings on the law and other regulations are given to company employees about KVKK.
Corporate policies on access, information security, use, storage and disposal issues have been prepared and implemented.
Employees who have a change of position or leave their jobs are removed from their authority in this area.
Personal data is reduced as much as possible.
Necessary security measures are taken for entering and exiting physical environments containing personal data.
Physical environments containing personal data are secured against external risks (fire, flood, etc.).
Periodic and random inspections are carried out within the company.
Employees, whose job applications are accepted, fulfill the obligation to enlighten them by making the necessary clarification regarding their personal data while making the employment process, and their explicit consent is obtained if they consent.
The obligation to enlighten the persons whose personal data will be processed before the processing of personal data is fulfilled, and their express consent is obtained if they consent.
Before processing sensitive personal data, express consent is obtained from individuals.
Personal data processing inventory has been prepared.
Knowledgeable and experienced personnel are employed within the scope of processing personal data.
If it is determined that the processed personal data are obtained by others illegally, the situation is immediately reported to the relevant person and the Board.
Information security training is provided for employees.
Data processing service providers are regularly audited for data security.
Awareness of data providing service providers is ensured on data security.

9- PERSONAL DATA DISPOSAL TECHNIQUES

At the end of the period stipulated in the relevant legislation or the storage period required for the purpose for which they are processed, personal data are transferred to Golda Gıda San. Tic. A.S. Upon the application of you or the person concerned, it is destroyed by the following techniques in accordance with the provisions of the relevant legislation.

9-1 Deletion of Personal Data

Personal data are deleted by the methods described below.

Personal Data on Servers; After the period of storage of personal data on servers expires, the system administrator removes the access authority of the relevant user and deletes them.
Personal Data in Electronic Media: After the period of storage of personal data in electronic media expires, it is made inaccessible and unavailable in any way for other employees except the database manager.
Personal Data in Physical Environment: After the period that requires storage of personal data kept in physical environment expires, it is made inaccessible and unavailable in any way for other employees, except for the department manager responsible for document archiving. In addition, the blackening process is also applied by scratching / painting / wiping it in an illegible way.
Personal Data on Portable Media: Personal data stored in flash-based storage media are encrypted by the system administrator after the expiration of the storage period, and access is only given to the system administrator and stored in secure environments with encryption keys.

9.2 Destruction of Personal Data

Personal Data in the Physical Environment: The personal data in the paper environment, which require their storage, are irreversibly destroyed in the paper trimming machines.

Personal Data in Optical / Magnetic Media: Physical destruction such as melting, burning or pulverizing the personal data in optical media and magnetic media that expires. In addition, magnetic media is passed through a special device and exposed to a high magnetic field, making the data on it unreadable .

9-3 Anonymizing Personal Data

The anonymization of personal data is making personal data unrelated to a certain or identifiable natural person under any circumstances, even if they are matched with other data.

In order for personal data to be considered anonymized; Personal data must be rendered unrelated to an identified or identifiable natural person, even by using techniques appropriate for the recording medium and the relevant field of activity, such as the return of personal data by the data controller or third parties and / or matching the data with other data.

10-STORAGE AND DESTRUCTION PERIODS

The personal data processed by our company within the scope of its activities are stored during the periods stipulated by the laws and the time limit, the retention periods are generally, the storage and destruction periods of the personal data on the data basis are recorded in the "Personal Data Processing Inventory", on the basis of data categories, on the basis of the process. will take place as indicated in the table below.

TABLE 3- Process-based storage and disposal times table

PROCESS		STORAGE PERIOD	DESTRUCTION TIME

Biometric Data	Following the termination of the business relationship	Following the expiry of the retention period
		2 years		during the first periodic destruction period
Job health security	Following the termination of the business relationship	Following the expiry of the retention period
Of processes	15 years		during the first periodic destruction period
Execution
Contracts	Following the termination of the contract	Following the expiry of the retention period
Preparation	10 years		during the first periodic destruction period

Golda Gıda San.Tic.A.Ş.	End of activity	Following the expiry of the retention period
Execution of Activities		10 years following	during the first periodic destruction period


Human Resources	Activity	to expire	Following the expiry of the retention period
Of processes	15 years following	during the first periodic destruction period
Execution

Log Tracking	5 years		Following the expiry of the retention period
				during the first periodic destruction period

Hardware and Software	2 years		Following the expiry of the retention period
Access Processes			during the first periodic destruction period
Execution

Visitor	and	Your activity	to expire	Following the expiry of the retention period
Meeting		2 Years following	During the first periodic destruction period
Registration of Participants
Camera Recordings	To be recorded	Following the expiry of the retention period
		1 month following	during the first periodic destruction period

Customer Data	To be recorded	Following the expiry of the retention period
		10 years following	during the first periodic destruction period

accountancy and Finance	To be recorded	Following the expiry of the retention period
Of processes	15 years following	during the first periodic destruction period
Execution

11-PERIODIC DESTRUCTION TIME

Golda Gıda San.Tic.A.Ş. has determined the periodic destruction period as 6 months. Accordingly, periodic destruction is carried out regularly in June and December every year.

12-PUBLISHING AND STORAGE OF THE POLICY

The policy is prepared in two different environments: wet signed (printed paper) and electronic environment. It is published from our internet address (www.golda.com.tr). The printed paper copy is also kept in the Human Resources Department.

13-UPDATE PERIOD OF THE POLICY

The policy is reviewed as needed and required sections are updated.

14-ENFORCEMENT AND TERMINATION OF THE POLICY

Politics, Golda Gıda San.Tic.A.Ş. It is deemed to have entered into force after its publication on the website. In the event that it is decided to repeal the Policy, old copies of the Policy with wet signature are canceled by the Human Resources Directorate (by stamping or canceled) and kept by the Human Resources Management for at least 5 years.