Privacy Notice

1. Identity of the Data Controller

This Privacy Notice has been prepared by DTEX Savunma Madencilik Ticaret Limited Şirketi (“DTEX” or the “Company”) in its capacity as data controller, pursuant to Article 10 of Law No. 6698 on the Protection of Personal Data (the “KVKK” or the “Law”) and the “Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform” published in the Official Gazette No. 30356 dated 10/3/2018, in order to inform data subjects regarding the processing of their personal data.

2. Categories of Personal Data Processed

Depending on the nature of the relationship established with the data subject and the category of the data subject, our Company may process the following categories of personal data:

3. Purposes of Processing Personal Data

DTEX processes your personal data in accordance with the general principles set out in Article 4 and the conditions set out in Articles 5 and 6 of the KVKK, for the following purposes:

3.1. Operational and Service Delivery Purposes

• Provision of explosives engineering, drilling and blasting, controlled demolition, UXO clearance, seismic analysis and structural analysis services
• Conduct of explosives sales, logistics and storage operations
• Establishment, performance and monitoring of customer contracts
• Management of supplier relationships
• Planning and reporting of field operations

3.2. Fulfilment of Legal Obligations

• Notifications made to the Directorate General of Security (EGM) under Regulation No. 87/12028 and Circular No. 2023/9
• Reporting to MAPEG under Mining Law No. 3213
• OHS records and training under Occupational Health and Safety Law No. 6331
• Keeping commercial books and records under Turkish Commercial Code No. 6102
• Fulfilment of tax obligations under Tax Procedure Law No. 213
• Accounting and audit processes under Law No. 3568
• Notifications under Social Security Law No. 5510
• Submission of information/documents at the request of judicial and administrative authorities

3.3. Communication and Customer Relations

• Responding to contact form requests submitted via the website
• Conduct of service requests and quotation processes
• Customer satisfaction activities
• Assessment of requests and complaints

3.4. Security and Audit

• Ensuring physical security at the company building and operation sites
• Conduct of information security processes
• Supporting the audit processes of authorised institutions

3.5. Human Resources Processes

• Evaluation of job applications
• Recruitment, employee relations and personnel affairs processes
• Professional qualification checks (e.g. verification of the Blaster Competence Certificate)

4. Method of Collection and Legal Grounds

4.1. Collection Methods

Your personal data is collected by wholly or partly automated means, or by non-automated means provided that it forms part of a data recording system, through the following channels:

• Contact and quotation forms on our website
• E-mail correspondence
• Telephone calls and fax
• Face-to-face meetings and company visits
• Processes for signing contracts and other legal documents
• Security cameras at the company building and on site
• Public institutions, courts and official correspondence
• Business partners, suppliers and intermediary organisations
• Cookies and similar technologies (for details, see our Cookie Policy)

4.2. Legal Grounds (KVKK Art. 5 and Art. 6)

Your personal data is processed on the basis of one or more of the following legal grounds set out in Article 5/2 of the KVKK:

5. Transfer of Personal Data

Your personal data may be transferred to the following recipient groups in accordance with the conditions set out in Articles 8 and 9 of the KVKK, limited to the achievement of the purposes stated above:

5.1. Domestic Transfers

5.2. International Transfers

Our Company may transfer certain data to service providers established abroad within the scope of website infrastructure, e-mail services and cloud computing services. Such transfer is carried out, within the framework of Article 9 of the KVKK:

• by obtaining explicit consent, or
• within the framework of transfers to countries with adequate protection as determined by the Personal Data Protection Board, or
• by using standard contract/undertaking mechanisms.

6. Retention Periods

Your personal data is retained for the period required by the purposes of processing, taking into account the minimum periods stipulated in the relevant legislation:

• Customer/supplier contract data: 10 years from termination of the contract (limitation periods under the Turkish Code of Obligations and the Turkish Commercial Code)
• Commercial books and invoice details: 10 years (Tax Procedure Law and Turkish Commercial Code)
• Personnel records: 10 years from termination of the employment relationship (Labour Law No. 4857 and Social Security Law No. 5510)
• Explosives consumption and sales notifications: At least 10 years (Regulation No. 87/12028 and Circular No. 2023/9)
• Seismic measurement reports: 10 years
• Contact form records: 2 years
• Website log records: 2 years (Law No. 5651)
• Security camera recordings: Maximum 30 days
• Job application CVs: 1 year (destroyed thereafter)

Personal data whose retention period has expired is deleted, destroyed or anonymised within the framework of Article 7 of the KVKK and the “Regulation on the Deletion, Destruction or Anonymisation of Personal Data” (Official Gazette 28/10/2017 — No. 30224).

7. Data Security Measures

DTEX takes the following technical and administrative measures in order to prevent the unlawful processing of personal data and unlawful access to it, and to ensure the safekeeping of personal data:

Technical Measures

• Up-to-date anti-virus and firewall systems
• Access authorisation and control matrices
• Encryption (SSL/TLS) and regular backups
• Penetration tests and vulnerability scans
• Regular monitoring of log records

Administrative Measures

• KVKK awareness training for personnel
• Confidentiality agreements and undertakings
• Data inventory and VERBİS registrations
• Personal data retention and destruction policy
• Disciplinary regulation and data breach response plan

8. Rights of the Data Subject (KVKK Art. 11)

Pursuant to Article 11 of the KVKK, data subjects whose personal data is processed have the following rights:

1. To learn whether their personal data is being processed
2. To request information if their personal data has been processed
3. To learn the purpose of processing and whether the data is used in accordance with that purpose
4. To know the third parties to whom personal data is transferred, domestically or abroad
5. To request rectification of personal data that has been processed incompletely or inaccurately
6. To request the erasure or destruction of personal data within the framework of the conditions set out in Article 7 of the KVKK
7. To request that the actions taken pursuant to items (e) and (f) above be notified to the third parties to whom the personal data has been transferred
8. To object to a result arising against the person as a consequence of the analysis of the processed data exclusively by automated systems
9. To claim compensation for damage suffered as a result of the unlawful processing of personal data

9. Application Methods

In order to exercise the rights set out above, you may apply by one of the following methods, together with documents verifying your identity, within the scope of the “Communiqué on the Procedures and Principles of Application to the Data Controller” published in the Official Gazette No. 30356 dated 10/3/2018:

10. Changes to this Privacy Notice

DTEX reserves the right to make updates to this Privacy Notice from time to time in line with changes in legal regulations or developments in business processes. The updated text enters into force on the date it is published on our website. Material changes are additionally announced to data subjects through appropriate channels.