Promena Platform Privacy Notice on the Processing of Personal Data

Dear Customers, Suppliers, Business Partners and their Employees/Representatives,

We would like to inform you about our practices regarding the processing of your personal data and about the personal data we process as the "Data Controller" under Law No. 6698 on the Protection of Personal Data (the "Law"), in our capacity as Zer Merkezi Hizmetler ve Ticaret Anonim Şirketi ("Koçzer").

This notice sets out the privacy notice regarding personal data processed within the scope of the Promena digital platform (www.promena.net, solutionss.promena.net, collectively the "Platform" or "Promena"). As a procurement and supplier solutions platform, Promena processes the personal data of customers, suppliers and business partners that are sole proprietorships. In addition, certain personal data relating to the employees of such customers, suppliers and business partners may be processed, regardless of whether the supplier or customer is a legal entity or a sole proprietorship. This notice contains detailed explanations regarding all such personal data processing activities carried out within the scope of the Platform.

1. What are our purposes for processing your personal data, and what personal data do we process?

Membership and Registration Processes: Within the scope of the Promena digital platform, the following data is processed for the purposes of onboarding customers and suppliers, creating company and user records, carrying out activation and account verification processes, enabling logins to accounts, providing access to and use of the Platform, granting user authorizations, generating, managing and routing registration links to the relevant person, carrying out password setting/activation/information security activities by email and sending notification messages, monitoring registration processes, and managing business processes:

• where the customer or supplier is a sole proprietorship, the identity (name, surname, Turkish ID number, MERSIS number, trade registry number, tax office and tax number, trade name/business title), contact (email address, mobile phone number, landline phone number, website, company address (country, state, city, address)), personnel (company type, industry, company size and number of employees, company registration date, brand), customer transaction (membership date), transaction security (authorization definitions, language and time zone preference, IP address, log records, username, password and activation information) and finance (payment term) data of such customer or supplier,
• with respect to persons identified as users/contact persons/invoice authorized persons/company authorized persons of the customer/supplier for whom a user account is opened on the Platform; identity (name, surname), contact (email address, mobile phone number, landline phone number), personnel (institution of employment and position, language and time zone preference, membership date), and transaction security (authorization definitions, IP address, log records, username, password and activation information) data

Platform Use and Commercial Processes: As part of Promena's operation as a B2B online marketplace platform that brings customers and suppliers together in a digital environment, the following data is processed for the purposes of enabling use of the Platform, managing user accounts, operating the Platform's features (procurement, bid, tender, contract and other commercial processes) and the related commercial activities, conducting audit, pre-assessment, screening and information verification processes regarding suppliers and customers, checking whether the criteria sought for suppliers are met, providing in-Platform communications and notifications, matching suppliers with customers, generating and retaining transaction histories and records, ensuring Platform performance and continuity, and conducting Promena's commercial activities:

• where the customer or supplier is a sole proprietorship, identity (name, surname, Turkish ID number, MERSIS number, trade registry number, tax office and tax number, trade name/business title), contact (email address, phone number, landline phone number, company address, registered electronic mail (KEP) address, delivery address), customer transaction (contract information, facility information, bid–tender–technical specification information, bid information and content, records relating to tender, procurement and similar commercial processes), finance (payment methods (cash, credit card, etc.) and payment details (installment amount, etc.), bank account information, information on whether there is any outstanding tax debt, tax liability information, collateral information (provisional collateral amount, bank information, collateral validity date), policy information, information on the tax certificate (tax type, primary activity code and name, declared tax base, accrued tax)) and transaction security (IP address, log records, device and access information) data
• with respect to employees or authorized persons of the relevant customer/supplier who are identified as users for whom a user account is opened on the Platform/contact person/invoice contact/delivery contact; identity (name, surname, signature, Turkish ID number), contact (email address, mobile phone number), personnel (institution of employment and position, representative personnel information appearing in the signature circular (title of the company represented, type of authority, scope of authority, manner and duration of exercise of authority, etc.)), customer transaction (bid, tender, frequency of use, preferred services, transaction types, records relating to procurement and similar commercial processes, Platform usage history), and transaction security (username, user role, transactions and activities on the Platform, IP address, log records, device and access information) data.

Business Partnership Processes: With a view to making Promena's products and services available to a broader user base, the following data is processed for the purposes of receiving, evaluating and finalizing applications from you as potential business partners and distributor candidates, contacting you where necessary in connection with your application, and carrying out business development activities:

• where you apply as a sole proprietorship, your identity (name, surname, tax office and tax number), contact (email address, phone number, website) and personnel (company title, field of activity, country or region of operation) data,
• regardless of whether the relevant business partner candidate is a natural or legal person, the identity (name, surname), contact (email address, phone number) and personnel (institution of employment, department, position, field of activity, role/position, country or region of operation) data of the candidate's employees

Internal Processes: For the purposes of conducting internal audit, internal control, internal investigation and testing activities, performing customer reporting and supplier audit processes (such as for measurement and strategy development), detecting potentially suspicious transactions and unlawful situations, carrying out reporting, analysis, development and improvement activities, and planning and implementing projects aimed at increasing efficiency;

• where the customer is a sole proprietorship, the identity (name, surname, Turkish ID number, tax office and tax number, trade name/business title), contact (email address, mobile phone number, company contact number, company email, company address) and customer transaction (sales figures, payment type, payment method, order contents) data of such customer,
• where the supplier is a sole proprietorship, the identity (name, surname, Turkish ID number, tax office and tax number, trade name/business title, MERSIS number, trade registry directorate and trade registry number), contact (email address, mobile phone number, KEP address, company contact number, company email, company address, order delivery address, website), personnel (company type, information contained in the activity certificate (capital amount, professional group, NACE code), information contained in the company seal), customer transaction (membership date), transaction security (authorization definitions, IP address, log records of communication-preference checkbox selections and membership transactions, password and activation information), finance (bank account information and tax classification), tax certificate information (tax type, primary activity code and name, declared tax base, accrued tax, approval code, tax period, business commencement date), and collateral information (provisional collateral amount, bank information, collateral validity date) data of such supplier,
• with respect to the employees of the customer/supplier identified as users for whom a user account is opened on the Platform/contact persons; identity (name, surname), contact (email address, mobile phone number, landline phone number), and personnel (institution of employment, department and position) data

Website Use Processes: Your website usage information and log records relating to the actions you take on the site will be processed for the purpose of detecting and resolving technical/software errors and deficiencies encountered during your visit to and use of the Promena website. 

Cookies: Tools such as cookies and web beacons are used on the website. For detailed information, please review the cookie privacy notice available on the Promena website.

Communication and Support Processes: If you contact us or share a request, complaint or suggestion through our communication channels (call center conversations, emails, forms filled out via the website, use of the live support line, etc., collectively the "Communication Channels"), the following data will be processed for the purposes of resolving your requests, suggestions and complaints, contacting you in this regard when necessary, accessing your sales/order/tender/bid records as needed to resolve your request or complaint, carrying out efforts to improve user satisfaction and service quality, and conducting internal audit and quality activities: identity (name, surname, tax number), contact (address, email address, phone number), personnel (institution of employment and position, company title), audio recordings (your voice recordings in the event of a conversation through the call center), and customer transaction (live support correspondence, your requests and complaints and the related details (date, content, time, channel), order content, and the responses you provide if you participate in our surveys) data.

Consent and Notice Processes: In order to fulfill our burden of proof regarding the consent and notification procedures arising from the legislation, your legal action data (date, consent/notice content) and transaction security data (log records of privacy notice and explicit consent checkboxes, date and time of consent) relating to the privacy notice and consent texts you approve are processed.

Personalized Marketing Activities (where permitted): If you are a sole proprietorship and grant your explicit consent, your finance data (term preferences, payment information, payment channels and preferences), customer transaction data (information regarding past tender-bid-specification processes, transaction histories), and marketing data (industry, company size, membership type (customer/supplier), activity status (active-inactive), address (province-district), features used on the Platform, transaction history, demographic information, attitudes toward in-Site notifications/surveys/offers/campaigns, habits, favorites, likes, behaviors, preferences, search activity, segments, past order/sale/tender/bid records, cookie records, communication preferences, and tender-bid-payment information) will be processed for the purposes of creating offers and opportunities tailored to you, personalized campaigns, advantages, promotions, and advertisements, conducting segmentation, reporting, profiling, marketing and analysis activities, carrying out advertising and marketing/communication activities (notifications, pop-up displays, personalized offers, customization of user screens, advertising, display of personalized content, and delivery of in-Site notifications) regarding Promena's and Koçzer's products and services on Koçzer websites or other third-party platforms, and improving the user experience on Promena.

Commercial Communication Processes/Newsletter Subscription: Your identity data (name and surname) and contact data (phone number, email address, company address) will be processed for the following purposes: to deliver general (non-personalized) campaigns, advantages, promotions, advertisements, announcements, marketing activities, events, notices and invitations created by Koçzer; to contact you and/or conduct surveys in connection with handling complaints, ensuring customer and supplier satisfaction, and/or recommending new products; and, if you are a sole proprietorship and have provided explicit consent for personalized marketing activities, to deliver to you the content prepared in connection with the activities described in the Personalized Marketing section.

Legal Retention/Notification Processes: The following data may be processed for the purposes of fulfilling our obligations arising from the legislation, performing our legal and administrative obligations toward the competent and authorized public institutions and organizations, sharing the information and documents required in connection with inquiries and audits conducted by official institutions and organizations, exercising any and all rights to file, respond to and object to proceedings before courts, enforcement offices, mediation, conciliation, arbitration panels and similar bodies in connection with dispute resolution, conducting negotiations and settlement processes, carrying out notice, warning and notification processes, and transmitting the necessary information to the relevant persons when information is requested from us: identity (name, surname, Turkish ID number, tax office and tax number, identity information of the representative on the signature circular (name, surname, Turkish ID number, signature)), contact (email address, phone number, landline phone number, company address, KEP address, delivery address), customer transaction (your order and purchase information, records and minutes evidencing fulfillment of your request, live support correspondence, information regarding the commercial electronic messages sent to you), transaction security (your order/tender/bid records on Promena, your commercial communication consent/refusal actions, and log records of other transactions you have carried out), legal action (correspondence and related case file information (litigation/enforcement/arbitration panel/mediation/conciliation, etc.) relating to dispute processes), and audio recordings (call center voice recordings).

1. To Whom and For What Purposes May We Transfer Your Personal Data?

We may transfer your personal data to the following groups of recipients:

Government Institutions and Organizations: We may transfer the information requested from us to the competent public institutions and organizations, courts, prosecutor's offices, ministries, law enforcement and other judicial/administrative authorities (Social Security Institution, İYS (Commercial Electronic Message Management System), and the Personal Data Protection Authority) for the purposes of fulfilling legal notification, declaration and audit obligations and our other related obligations, conducting judicial/official correspondence, pursuing legal disputes and exercising our legal rights (such as the right to file and respond to actions), and performing our obligations under the incentives from which our company benefits.

Suppliers: Your personal data is transferred to our domestic suppliers from which we receive support in areas such as information technology or specialized consultancy, the supply of products or services, and the follow-up of related processes (archiving companies, attorneys, maintenance and support service providers, call center and live support service providers, banks, independent audit firms, IT support service providers, suppliers from which we receive support in document control/approval processes, maintenance/repair and technical support service providers, security firms, legal and financial consultancy firms, KEP service providers, accountants/financial advisors, logistics companies, consulting firms providing project support, service providers, and infrastructure and server service providers).

Transfer to Customers: If you are present on the Promena platform as a supplier or as a user thereof, your personal data may be transferred to the customers using the platform for the purposes of enabling you to participate in tender, bid, procurement and similar commercial processes created by customers through the Promena website, submit bids to customers, facilitating customer–supplier matching, carrying out the commercial activities conducted through the platform, evaluating bids, performing procurement processes, ensuring communication between the parties, and establishing and performing contracts and business relationships.

Transfer to Sellers: If you are present on the Promena platform as a customer or as a user thereof, your personal data may be shared with the suppliers on the Promena platform, in connection with Promena's operation as a B2B platform, for the purposes of conducting the tender, bid, procurement and similar commercial processes on the platform, facilitating supplier–customer matching, obtaining bids from suppliers, ensuring commercial communication, and carrying out the commercial activities on the platform.

Foreign Suppliers: Because the servers of the domestic suppliers from which our company receives support in the IT and product support areas are located abroad, or because our company receives support from suppliers located abroad, your personal data is shared with such suppliers (in connection with product and server services relating to the Promena system, and email product and server services). (Your personal data is transferred with the appropriate safeguards required under the legislation (standard contracts) for the relevant transfer in place.)

1. What are the methods and legal grounds for collecting your personal data?

We collect your personal data through (i) automated methods — by your sharing them by telephone or email, by your completing the customer membership, application, demo request and contact forms on our website, by the recording of documents you upload to the Promena system, where you are a supplier or its employee, by your customer entering your information into Promena and inviting you to the platform, by the recording of phone conversations held during call-center processes, by your sharing your business card and during mutual communication through other channels, by the sharing of information with us through formal notices or digital channels by official, administrative and judicial authorities, by obtaining your personal data from sources where you have made them public, by the re-use in various processes of data you have shared with us verbally or in writing during the course of business, and by the capture of log records of your transactions when you use our company's information systems; and (ii) non-automated methods — during pre-commercial discussions, in writing at the time of signing a contract, by the completion of audit forms within audit processes, by the recording of written forms or documents you deliver in person, and by the sharing of information with us through formal notice by official, administrative and judicial authorities.

We process the personal data obtained based on the legal grounds set out separately below for each of the processing purposes listed above:

• For carrying out Membership and Registration processes, Platform Use and Commercial Processes, and Business Partnership processes: the legal grounds of "data processing being necessary for the establishment and performance of a contract," "fulfillment of a legal obligation," and "data processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject";
• For legal retention/notification processes: the legal grounds of "fulfillment of a legal obligation," "data processing being mandatory for the establishment, exercise or protection of a right," and "data processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject";
• For commercial communication/newsletter processes, under the tradesperson/merchant exception in commercial communication legislation: the legal grounds of "being expressly provided for by law" and "data processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject";
• For communication and support processes: the legal ground of "data processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject";
• For consent and notice processes: the legal grounds of "fulfillment of a legal obligation" and "data processing being mandatory for the establishment, exercise or protection of a right";
• For website use processes: the legal grounds of "data processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject" and "data processing being mandatory for the establishment, exercise or protection of a right";
• For internal processes: the legal grounds of "fulfillment of a legal obligation," "being expressly provided for by law," "data processing and transfer being mandatory for the establishment, exercise or protection of rights," and "data processing being mandatory for the legitimate interests of the data controller."
• For mandatory cookies within the scope of Cookies: the legal ground of "data processing being mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject"; and for functionality, performance/analytics and marketing/tracking cookies: the legal ground of your "explicit consent";
• Your personal data relating to personalized marketing activities will be processed based on your "explicit consent." You may withdraw your explicit consent at any time without providing any reason and thereby terminate personal data processing activities that rely on explicit consent.

1. What are your rights?

You may submit your requests under Article 11 of the Law regarding your processed personal data to Koçzer, in accordance with the Communiqué on the Procedures and Principles for Applications to the Data Controller, by completing the Data Subject Application Form available at https://www.koczer.com/uploads/Veri_Sahibi_Basvuru_Formu_4726cf3b20.pdf. Depending on the nature of your request, your application will be concluded as soon as possible and in any event within thirty days at no charge; however, if the process entails an additional cost, a fee may be charged in accordance with the schedule set by the Personal Data Protection Board.

KEP Address: zer@zer.hs02.kep.tr Email Address: kvk@koczer.com Address: Ünalan Mah. Ayazma Cad. Çamlıca İş Merkezi B. Blok Kat: 1 Üsküdar/İstanbul