Purpose and Scope

This policy sets out the principles adopted by Fabyon Otomasyon San. ve Tic. Ltd. Şti. to ensure compliance with the Turkish Personal Data Protection Law No. 6698 (“KVKK”) in all personal data processing activities carried out by the Company.

The policy covers our customers, prospective customers, employees of our suppliers and business partners, website visitors, job applicants and any other natural persons who engage with our Company.

Our Data Processing Principles

When processing personal data we adhere to the principles set out in Article 4 of the KVKK:

Lawfulness and fairness. We conduct our data processing activities in accordance with the law and the rule of good faith.

Accuracy and currency. We establish mechanisms to ensure that the data we process is accurate and, where necessary, kept up to date.

Specific, explicit and legitimate purposes. We determine the purpose before collecting data and communicate it clearly to the data subject.

Relevance, limitation and proportionality. We do not collect more data than the purpose requires.

Storage limitation. We retain data only for the period required by legislation or by the purpose of processing.

Data Security Measures

Administrative measures. Our employees receive regular training on the protection of personal data. Confidentiality undertakings are signed with data processors. Access rights are limited by job description and reviewed periodically. A personal data inventory is maintained and kept current.

Technical measures. Up-to-date security software is used across our systems. SSL/TLS encryption is applied on our website. Access logs are kept. Backup procedures are operated. Unauthorised access attempts are monitored.

Special Categories of Personal Data

Given the nature of our business, our Company does not collect special categories of personal data through its website. Where such data must be processed in employee and job applicant procedures, it is handled within the framework of Article 6 of the KVKK and the adequate measures determined by the Turkish Personal Data Protection Board.

Informing Data Subjects

Data subjects are informed in accordance with the disclosure obligation through every channel in which personal data is collected. Forms on our website link to the data protection notice, and explicit consent is obtained separately where required.

Updates to This Policy

This policy is reviewed in line with legislative changes and developments in Company processes, and updated where necessary. The current version is published on our website.

Effective date: 18 September 2026