Personal Data Processing — Privacy Notice

1. Identity of the Data Controller

2. Categories of Personal Data Processed

The following categories of personal data about you are processed:

• Identity data: Name, surname, title (position)
• Contact data: Corporate e-mail address
• Professional information: Name, sector, size and city/country of the company you work for
• Corporate identifier: Company website address (publicly available)

No special category personal data (health, religion, biometric, etc.) is processed.

3. Purposes of Personal Data Processing

Your data is processed for the following purposes:

• Promotion and information about our foreign blue-collar staffing services
• Providing solution proposals for your business's potential workforce needs
• Exploring commercial cooperation and partnership opportunities
• Scheduling appointments/meetings and conducting follow-up communications if you show interest

4. Legal Basis for Processing

Your personal data is processed on the legal basis of legitimate interest pursuant to Article 5/2-f of the KVKK.

As a result of the balancing test conducted within the scope of our legitimate interest assessment:

• The data processed is only of a corporate/professional nature and does not contain personal data relating to private life.
• The contact serves to inform you about a sector-specific solution service directly related to your professional role.
• It is considered that you could reasonably expect this type of communication.
• If you object, processing is terminated immediately and permanently (see Section 7).

Note: If you do not want your personal data processed for this purpose, you can use the unsubscribe link in the e-mail sent to you or send an e-mail with the subject "Unsubscribe" to kvkk@firma.com. Your request will be processed within 30 days at the latest.

5. Method and Source of Data Collection

Your personal data is collected electronically via the B2B business development platform Apollo.io and from publicly available commercial sources (company websites, trade registry data, sector directories).

The data has not been collected directly from you and is processed under the legal basis stated in Section 4 above, together with the notification of this Privacy Notice.

6. Parties to Whom Data Is Transferred

Your personal data may be shared in a limited way with the following parties:

• E-mail delivery infrastructure provider (Instantly.ai): Only contact data is transferred for the technical delivery of e-mails. Instantly.ai acts as a KVKK/GDPR-compliant data processor.
• Internal sales/business development team: For appointment and follow-up processes.

Your data is not shared with, sold to, or rented to third parties for marketing purposes. Cross-border transfer is carried out only within the scope of Instantly.ai servers, with the necessary safeguards provided under Article 9 of the KVKK.

7. Retention Period

Your personal data is retained as follows:

• For the duration of the active campaign and for a maximum of 12 months thereafter.
• If you submit an unsubscribe/objection request, it is removed from the active database within 30 days of receipt; remaining copies are permanently destroyed within the 6-month periodic destruction cycle.
• The same period applies in backup systems unless a legal obligation requires otherwise.

8. Rights of the Data Subject (KVKK Article 11)

Under KVKK you have the following rights:

To exercise your rights, you can apply in writing via our contact page or directly at kvkk@firma.com. Requests are concluded within 30 days at the latest.

9. Right to Complain

You can submit complaints about the processing of personal data to the Personal Data Protection Authority (KVKK) or via the Communication Management System (İYS).