Personal Data Protection Policy

As Göksu Global Holding Gıda İthalat İhracat San. ve Tic. A.Ş. Protection of fundamental rights and freedoms, protection of privacy regarding private life, ensuring and protecting information security, respect for ethical values are among our prioritised principles. Within the scope of the Law No. 6698 on the Protection of Personal Data, the following explanations regarding the processing and protection of your personal data and special categories of personal data are presented for your information in order to fulfil the disclosure obligation arising from Article 10 of the Law on the Protection of Personal Data. The concept of "personal data" in this document is used to include sensitive personal data. If you do not accept this policy, you should not transmit your personal data to us. However, in this case, we would like to inform you that there may be disruptions in the services we will provide to you and the service to be provided may not be fully functional. If you state that you are responsible for the accuracy and timeliness of the personal data you transmit to us and share the personal data of other persons with us, it will be understood that you have obtained all necessary permissions from the third party in question for us to collect, process, use and disclose their information, and our Company will not be held responsible in this context.

About Goksu Global
Goksu Global Holding Food Import Export San. Ve Tic. A.Ş. As Göksu Global Holding, we started our activities in 2009 in order to produce and trade in the food sector. Our group established our first brand "Bayramefendi Osmanlı Kahvecisi" in 2011 and has made it a national brand today by providing "franchise consultancy" and "production supply" services to the brand. "Bayramefendi Osmanlı Kahvecisi" brand, which is the most important representative of the traditional coffee culture in Turkey, has been serving its guests since 2011 with its original concept, rich product range and unique decoration approach. In 2019, our group established "Bex Coffee" in the UK as a result of the knowledge and experience gained from the franchise sector. Inspired by the energy and flavour understanding of the new generation, it created this new concept with the dream of becoming a global brand by blending the excitement of trying innovations in life, being unique and reaching better with its experience. At the beginning of 2020, our group established the "GG frozen & beverage" company in order to carry out its activities in food production and export by combining its production experience gained over time with its innovations. In this company, we have created healthy and innovative products by offering consumers a unique flavour experience with our "Limmo" branded products produced from lemon. Today, we have created a product group preferred by quality chain brands by exporting to 30 countries in Turkey.

Our Principles for Processing Personal Data
All personal data processed by our Company are processed only in accordance with the procedures and principles stipulated in the Law and other laws. The basic principles and principles we pay attention to when processing your personal data in accordance with Article 4 of the PDPP are as follows:
a) Following the law and good faith.
b) Being accurate and up to date when necessary.
c) Being processed for specific, explicit, and legitimate purposes.
d) Being relevant, limited and proportionate to the purpose for which they are processed.
e) Being retained for the period stipulated in the relevant legislation or required for the purpose for which they are processed.

Data Subject Categories
A separate policy is applied regarding the processing of personal data of our employees (including interns and subcontractor company employees) whose personal data are processed by our Company. Data subjects other than employees, such as customers, potential customers, visitors, employee candidates/trainees, employees, shareholders and officials of the institutions we cooperate with, may also address their requests to our Company within the scope of PDPP.

The Purpose of Processing and Transferring Personal Data
Our company processes personal data limited to the purposes and conditions within the personal data processing conditions specified in paragraph 2 of Article 5 and paragraph 3 of Article 6 of the Personal Data Protection Law No. 6698. It is possible to process personal data in the presence of at least one of the following items.
* The existence of the explicit consent of the person concerned,
* It is clearly stipulated in the laws,
• It is mandatory for a person who is unable to disclose his consent due to actual impossibility or whose consent is not legally valid to protect the life or body integrity of himself or someone else,
• It is necessary to process the personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract,
* It is mandatory for the data controller to fulfill his/her legal obligation
• The fact that the relevant person has been publicly identified by himself,
• Data processing is mandatory for the establishment, use or protection of a right,
* Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned.

Under the conditions stated above, our Company may process personal data for the following purposes
* Evaluating potential suppliers/business partners
* Establishment and management of customer relations
* Execution and conclusion of the contract process with our supplier/business partners
* Execution of direct marketing processes
* Communication and support (upon your request)
* Compliance with legal obligations
* Ensuring the protection and security of the company's interests
* Planning and execution of the company's business activities
* Reporting and auditing
* Protection of rights and interests
* Conducting Social Media activities

When We Collect Personal Data About You
We collect your personal data in the following cases:
• When you purchase our service
• When you sell goods or offer services to us,
• When you contact us via our website, e-mail, social media platforms, other online channels or by phone,
• When you participate in our company events and organizations,
* Indirectly, for example by using a "cookie" and personalizing the software used to make the website suitable for your specific preferences, or by monitoring your use of certain pages of the site (for example, your IP address), or by other technical methods that make it possible for us to monitor your use of the site,
• When you contact us for any purpose as a potential guest/customer/supplier/business partner/subcontractor.
• When you are in a business relationship with our factory as an external employee.

We will process the personal data we have obtained in the above cases only in accordance with this Notice.

Which Personal Data Do We Process
Our methods of processing personal data are that you participate in our business events and surveys through our website, by phone or e-mail, through electronic applications specific to our customers, or interact with us in any other way. In this context, the categories of personal data that we process for you are as follows:

• When you purchase our service,
• When you sell goods or offer services to us,
• When you contact us via our website, e-mail, social media platforms, other online channels or by phone,
• When you participate in our company events and organizations,
* Indirectly, for example by using a "cookie" and personalizing the software used to make the website suitable for your specific preferences, or by monitoring your use of certain pages of the site (for example, your IP address) or by other technical methods that make it possible for us to monitor your use of the site,
• When you contact us for any purpose as a potential guest/customer/supplier/business partner/subcontractor,
• When you are in a business relationship with our factory as an external employee.

Processing of Personal Data Through Closed Circuit Camera Recording
Security cameras are used in our business for the security of our factory. Our purposes of monitoring with security cameras are; to increase the quality of the service provided, to ensure the safety of life and property of persons, to protect the legitimate interests of data owners. Personal data processing activities carried out by our company with security cameras are carried out in accordance with the Constitution, PDPP, Law No. 5188 on Private Security Services and related legislation. In accordance with Article 4 of the PDPP, our company processes personal data in a limited and measured manner in connection with the purpose for which they are processed. In this context, data owners are informed by placing warning signs in common areas where CCTV recordings are made. However, since our Company has a legitimate interest in keeping CCTV records, their explicit consent is not obtained. In addition, in accordance with Article 12 of the LPPD, necessary technical and administrative measures are taken to ensure the security of personal data obtained as a result of CCTV monitoring activities.

In addition, a procedure is applied to the areas where there are CCTV cameras, the monitoring areas of the cameras, the duration of the records. It is not allowed to place a camera to the extent that it exceeds the security purpose and exceeds the privacy of people. Only a certain number of Company employees have access to CCTV camera images. The personnel who have access to these records sign an undertaking that they will protect personal data in accordance with the law.
A total of 82 security cameras located at the entrance doors, building exterior, dining hall, visitor waiting room, front office area, production area and floor corridors within the company are used to record images and the recording process is supervised by the Security unit in order to ensure building security.

For which legal reasons do we process your personal data?
Personal data are collected, used, recorded, stored, and processed by our Company by providing written information to personal data owners in a clear and understandable manner, obtaining their explicit consent, if necessary, in accordance with the law and good faith, in connection with and limited to the legitimate purpose clearly stated above, within the framework of the principle of proportionality.
We process your personal data in accordance with the following legal reasons regulated in Article 5 of the LPPD, including the Turkish Commercial Code No. 6102, Turkish Code of Obligations No. 6098, Tax Procedure Law No. 213, electronic commerce legislation, and the purpose of processing and transferring personal data of this policy;

* The existence of the explicit consent of the person concerned,
* It is clearly stipulated in the laws,
• It is mandatory for a person who is unable to disclose his consent due to actual impossibility or whose consent is not legally valid to protect the life or body integrity of himself or someone else,
• It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract,
* It is mandatory for the data controller to fulfill his/her legal obligation,
• The fact that the relevant person has been publicly identified by himself,
• Data processing is mandatory for the establishment, use or protection of a right,
* Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned.
In cases where your Personal Data is processed with explicit consent, we would like to state that if you withdraw your explicit consent, you will be removed from the commercial membership program where processing based on such explicit consent is required and you will not be able to benefit from the advantages you have benefited from such processing as of the relevant date.

Retention and Destruction Periods of Personal Data
Your personal data will be stored for the retention periods specified in the relevant legal regulations or for the period required by the above-mentioned processing purposes, and then will be deleted, destroyed, or anonymized in accordance with the PDPP. In this context, Personal Data Retention and Destruction Policy and procedures have been prepared and implemented.

What are Your Rights Regarding Your Personal Data?
Pursuant to Article 11 of the LPPD, everyone may, by applying to the data controller;
a) To learn whether personal data is processed,
b) To request information if personal data is processed,
c) To learn the purpose of processing personal data and whether it is used in accordance with its purpose,
d) To know the third parties to whom personal data is transferred domestically or abroad,
e) To request correction of personal data in case of incomplete or incorrect processing,
f) To request the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the PDPP,
g) To request notification of the transactions made in accordance with subparagraphs (e) and (f) to third parties to whom personal data are transferred,
h) To object to the occurrence of a result to the detriment of the person himself/herself by analyzing the processed data exclusively through automated systems,
j) In case of damage due to unlawful processing of personal data, it has the right to demand compensation for the damage.

To Make a Request in Accordance with the Law on the Protection of Personal Data
In order to obtain more detailed information about your Personal Data, you can access the application form for obtaining information from our company's website and address www.goksuglobal.com. For us to respond to your requests regarding your Personal Data as soon as possible, your requests and questions must be clear, understandable and dated.