Personal data protection and processing policy

This policy has been prepared so that Espada Scaffolding (“Company”), as data controller under KVKK, can explain personal data processing activities, ensure transparency and lawfulness, and inform data subjects whose personal data are processed by the Company.

It sets principles for lawful protection and processing of personal data of employees, candidates, individual customers, visitors, business partners, suppliers and other third parties.

Personal data: Any information relating to an identified or identifiable natural person.

Special categories of personal data: Data on race, ethnicity, political opinion, belief, health, sexual life, criminal convictions and biometric/genetic data, among others.

Data controller: The party that determines purposes and means of processing and manages the data filing system.

Data processor: A natural or legal person processing data on behalf of the controller.

Explicit consent: Freely given, informed consent on a specific matter.

Personal data may be processed lawfully and fairly; accurately and, where necessary, kept up to date; for specified, explicit and legitimate purposes; in a manner relevant, limited and proportionate; and only for as long as required by law or the processing purpose.

Personal data obtained by the Company may be processed for purposes including:

• Product / service marketing and sales processes
• Communication activities
• Finance and accounting
• Storage and archiving
• Management of relations with partners and suppliers
• Information security processes
• Quote, order and customer support processes
• Legal processes and compliance with legal obligations

Personal data may be collected orally, in writing or electronically via the website, email, contact forms, contracts and correspondence.

Except where the law provides exceptions, processing is based on explicit consent. Processing without consent may also be possible where expressly provided by law, for contract formation/performance, legal obligation, establishment/exercise/protection of a right, or legitimate interest.

Subject to Articles 8 and 9 of KVKK and with appropriate security measures, personal data may be transferred to third parties for lawful processing purposes, including suppliers, competent public authorities, legal counsel, accountants, banks, consultants and regulators.

The Company applies technical and administrative measures to prevent unlawful disclosure, access or transfer of personal data, including access control, network security, backups, training, confidentiality agreements and periodic audits.

Personal data are retained for the period required by law or the processing purpose. When processing conditions cease, data are deleted, destroyed or anonymized.

Under Article 11 of KVKK, data subjects may learn whether their data are processed, request information, correction, deletion/destruction, learn recipients of transfers, and claim compensation for unlawful processing.

Applications may be submitted to Espada Scaffolding in writing, via notary, or through an email address registered in Company systems. Current contact channels are published on the contact page.

This policy is dated 01/01/2023. The effective date is updated upon renewal. The policy is published on the Company website and reviewed at least once a year. In case of conflict with legislation, applicable law prevails.