I. Data Controller Identity

This Disclaimer has been prepared by Figes Fizik ve Geometride Bilgisayar Simülasyonu Hizmet Ticaret A.Ş. (“Figes A.Ş.” or “Company”), acting as the data controller pursuant to Article 10 of Personal Data Protection Law No 6698 (“PDPL”) titled “Data Controller’s Obligation to Inform” and Notification on Methods and Principles to Be Observed in the Meeting of Obligation to Inform. With this “Disclaimer”, which we have prepared as the Data Controller, we would like to inform you on the purposes of processing of your personal data, to whom your personal data may be transmitted, the purposes of transmittance, the collection methods of your personal data, the legal grounds therefor, and your other rights stipulated under Article 11 of PDPL.

As the Data Controller, we process, record, transmit, share, and store your personal data by means of the methods described below and within the framework of the applicable legislation.

Our company at all times and at its own discretion, reserves the right to amend, modify, or update this “Disclaimer on Personal Data Protection” in accordance with the amendments, modifications, or updates in the applicable legislation.

Figes Fizik ve Geometride Bilgisayar Simülasyonu Hizmet Ticaret A.Ş.

Address: Odunluk Mahallesi, Akpınar Caddesi Green White Plaza No: 5/7, 16110, Nilüfer/BURSA

Telephone: +90 224 442 8585

E-Mail: kvkk@figes.com.tr

Registered e-mail: figes@hs03.kep.tr

II. Purpose of the Personal Data Protection and Processing Policy:

Operating in the fields of activity stated under the Articles of Association, our Company collects and processes your verbal, written, or electronic personal data for the purpose of observing the applicable regulations of the relevant organizations, as well as our contractual obligations. This personal data will be used by our company to provide and increase the quality of the relevant services within the scope of the company’s fields of activity, to perform marketing, sales, and other activities, and to observe the company’s data protection, reporting, and informing obligations.

Without your explicit consent, your personal data will not be used for any purpose other than those stated above, and it will not be disclosed or transmitted to third-parties, except for those prescribed under the legal obligations, and competent public bodies.

Pursuant to the customers’ explicit consent, or the other cases stipulated under Paragraph 2 of Article 5 of PDPL, as well as other applicable legislation, our company will only be able to disclose and share your personal data for the purposes of providing the customers with value added services, opportunities, and offerings, with our national or international subsidiaries, directly or indirectly affiliated entities, joint ventures, or public competent bodies who are authorized to request such data, provided that the necessary precautions are taken, as well as our contracted national or international entities, suppliers, authorized distributors, resellers, and business partners .

In addition to the abovementioned purposes, the personal data may be processed for the purposes listed below to the extent it is allowed under the personal data protection provisions of Articles 4, 5, 6 of the said Law:

• Conducting of the Emergency Response Processes
• Conducting of the Information Security Processes
• Conducting of the Employee Candidate / Internship / Student Selection and Placing Processes
• Conducting of the Employee Candidate Application Processes
• Meeting of the Employment Contract and Regulatory Obligations for Employees
• Conducting of the Employee Satisfaction and Commitment Processes
• Conducting of the Audits / Ethics Activities
• Conducting of the Training Activities
• Conducting of the Activities According to Applicable Legislation
• Conducting of the Financial and Accounting Tasks
• Ensuring of the Physical Environment Security
• Monitoring and Conducting of the Legal Affairs
• Conducting of the Communication Activities
• Conducting of the Human Resources Activities
• Conducting / Auditing of the Business Activities
• Conducting of the Business Continuity Activities
• Conducting of the Goods/Services Procurement Processes
• Conducting of the After Sale Service Processes
• Conducting of the Goods/Services Sales Processes
• Organization and Event Management
• Conducting of the Marketing and Analysis Works
• Conducting of the Performance Evaluation Processes
• Conducting of the Advertising/Campaign/Promotion Processes
• Conducting of the Storing and Archiving Processes
• Conducting of the Contractual Processes
• Conducting of the Supply Chain Management Processes
• Providing Information to Competent Persons, Bodies, and Authorities
• Conducting of Management Activities
• Creating and Monitoring of the Visitor Records

III. Personal Data Collection Methods and Legal Grounds

Figes Fizik ve Geometride Bilgisayar Simülasyonu Hizmet Ticaret A.Ş. collects personal data from electronic / digital environments such as customers’ company websites, mobile applications, social media accounts, and e-mail addresses; directly from its customers; from the services used by its customers to ensure proper use of the services and make the necessary improvements in its services according to customer demands; from potential customer candidates; through solution partners  and other business partners who ensure that the Company’s services are used by customers. Furthermore, the company collects the audio, electronic, or hard copy data transmitted through facsimile, and other means of communication, including the notifications served by the administrative or judiciary bodies in accordance with the below-mentioned legal grounds stipulated under Article 5 and 6 of the Law:

• Your explicit consent is obtained (i.e., communicating the marketing and promotion activities, as well as the changes and maintenance services concerning the products and/or services).
• The process whereby the personal data is processed is expressly permitted by law (i.e., processing of the data included in the invoices of products and/or services).
• We are contractually obligated to process your personal data, especially if an agreement has been executed by and between us, provided that the processing is directly related to the execution or performance of the contract.
• We are legally obligated to process your personal data as it is necessary for compliance with a legal obligation which we are subject to.
• You have shared your personal data with us (i.e., you have contacted our company to communicate your requests or complaints).
• Provided that your fundamental rights and freedoms are not harmed, where processing your personal data is necessary for the legitimate interests of our company (i.e., storing of your personal data throughout the statute of limitation in case of any legal dispute).
• Your personal data is collected to improve service quality and ensure customer satisfaction.

IV. Processing of Special Categories of Personal Data

According to Personal Data Protection Law the data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dressing, membership of association, foundation or trade-union, health, sexual life, criminal conviction and security measures, and biometrics and genetics are special categories of personal data. Our company take the adequate measures designated by the Personal Data Protection Board in order to process the special categories of personal data. Our company will process the special categories of personal data to provide better services, provided that the explicit consent of the data subject is obtained, which will only be limited to collecting purposes.

V. Transfer of Processed Personal Data: Persons and Purposes

To the extent that it is necessary to realize and fulfill the purposes stated under Article II of this Disclaimer, the personal data collected by Figes Fizik ve Geometride Bilgisayar Simülasyonu Hizmet Ticaret A.Ş. may be transferred to national or international Business/Solution Partners, Company Representatives, Suppliers, competent public/private authorities, real persons or legal entities, and third-parties, who may process such data at home or abroad, provided that such transfers are limited to the personal data processing conditions stipulated under Article 8 and 9 of the Law, and to the purposes stated hereunder.

VI. Rights of Data Subjects According to Article 11 of PDP Law:

Within the framework of the applicable law, the data subjects have the right to:

• Learn whether or not their personal data have been processed;
• Request information as to processing if their data have been processed;
• Learn the purpose of processing of the personal data and whether data are used in accordance with their purposes;
• Know the third-parties in the country or abroad to whom personal data have been transferred;
• Request rectification in case personal data is processed incompletely or inaccurately;
• Request deletion or destruction of personal data within the framework of the conditions set forth under article 7;
• Request notification of the operations made as per indents (d) and (e) to third-parties to whom personal data have been transferred;
• Object to occurrence of any result that is to their detriment by means of analysis of personal data exclusively through automated systems;
• Request compensation for the damages in case the person incurs damages due to unlawful processing of personal data;

by applying to the data controller.

VII. Statute of Limitation for Personal Data Protection

The personal data processed according to the purposes stated under this “Disclaimer on Personal Data Protection” and PDP Law will be deleted, destructed, or anonymized for further use once the processing purposes according to Paragraph 1 of Article 7 of PDP Law cease to exist and/or the statute of limitation according to the applicable legislation runs out. 

VIII. Cases Where Our Company May Process Your Personal Data Without Your Explicit Consent Under the Applicable Laws

Pursuant to Article 5 of PDP, our Company may process your personal data collected according to the applicable provisions, without obtaining your explicit consent if one of the below conditions exists:

The cases explicitly projected under law:

• It is necessary in order to protect the life or physical integrity of the data subject or another person where the data subject is physically or legally incapable of giving consent;
• It is necessary to process the personal data of parties of a contract, provided that the processing is directly related to the execution or performance of the contract (see Article II of this Disclaimer);
• It is necessary for compliance with a legal obligation which the controller is subject to;
• The relevant information is revealed to the public by the data subject herself/himself;
• It is necessary for the institution, usage, or protection of a right;
• It is necessary for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed.

IX. To Submit a Request Under the Personal Data Protection Law:

Pursuant to Paragraph 1 of Article 13 of PDP Law, you may convey your request relating to the enforcement of this Law to the data controller in writing or by other means designated by the Board.

The applications to be submitted in writing may be conveyed by means of filling the “Application Form For Processed Personal Data Subjects” and:

• Submitting an in-person application
• Serving by the notary public channel
• Sending an e-mail to kvkk@figes.com.tr.

With respect the matters of personal data only the e-mail address kvkk@figes.com.tr must be used; otherwise, the requests and notifications will not be evaluated.

The rights of personal data can only be exercised by the relevant individuals. The requests relating to third-parties other than those who have filled in the form and provided identification information as attachment will not be considered. The forms will not be considered unless they are enclosed with relevant identification information. We would like to inform you that we are remain obligated to share the data with competent bodies upon request even if the data deletion requests have been fulfilled.

Depending on the nature of your request, our company will finalize your request as soon as possible and within thirty days upon receipt at the very least, provided that the requests have been filed in accordance with the methods stated hereunder. However, if the nature of request calls for additional expenses, the company may charge you based on the tariff designated by the Personal Data Protection Board.