This Camera Recording Policy and Privacy Notice is issued to inform you that camera surveillance equipment has been installed in the café of Magnolia Gıda Tic. A.Ş. and in other areas marked with the notice sign below (hereinafter referred to as the “Company premises”).

(1) Data Controller and Contact Person

Pursuant to the Personal Data Protection Law No. 6698 (“Law”), your personal data may be processed by Magnolia Gıda Tic. A.Ş. (hereinafter referred to as the “Company”) as the data controller, within the scope set out below.

(2) Methods and Legal Grounds for Collecting Personal Data

The camera surveillance system records and processes images of individuals and objects that pass within the range of the system. The system operates continuously, 24 hours a day, 7 days a week. Visual information and camera footage are processed through the video surveillance system. These data are processed based on the personal data processing conditions specified in Articles 4, 5 and 6 of the Law, as well as the provisions of the Private Security Services Law No. 5188, the Labor Law No. 4857, the Occupational Health and Safety Law No. 6331, the Law on the Production, Consumption and Inspection of Foodstuffs No. 5179, and other applicable legislation.

(3) Purposes for Which Personal Data Will Be Processed

The personal data described above may be processed for the following purposes:

· Ensuring the protection of Company premises, individuals, belongings, products, and all assets within the premises from attacks, theft, robbery, or any kind of harm,

· Ensuring the security of Company facilities, infrastructure, products, operations, and implementing measures against security breaches,

· Providing information to authorized institutions and organizations,

· Ensuring the legal, technical, and commercial occupational safety of the Company and individuals in business relationships with the Company,

· Planning, supervising, and executing information security processes,

· Controlling entry to and exit from the workplace,

· Planning and/or executing occupational health and/or safety processes and fulfilling related obligations,

· Preventing fire and other potential disasters,

· Managing areas within Company premises (such as parking lots or restricted areas),

· Detecting and investigating violations of workplace rules.

(4) Recipients to Whom Personal Data May Be Transferred and Purposes of Transfer

Camera recordings may be transferred to legally authorized public institutions, private persons or organizations, third parties, business partners, suppliers, and shareholders solely for the purposes listed above, within the conditions outlined under Articles 8 and 9 of the Law.

Details regarding data sharing include:

· Sharing data such as camera footage with security companies and the companies that install or operate the technical system,

· Authorized external service providers for data management and storage,

· Suppliers for the storage of physical and electronic employee data,

· Experts, law firms, audit firms, public institutions, insurance companies, social aid support funds, and consultants for audit, assessment, regulatory, or contractual obligations,

· Cases where processing is required for the legitimate interests of the data controller.

Transfers to public authorities are as follows:

· Providing camera footage upon request to authorities such as the police, prosecutor’s office, and courts,

· Sharing with authorized administrative and regulatory bodies and/or other competent supervisory authorities.

(5) Retention Periods for Personal Data

The Company retains processed personal data in physical and/or electronic environments for the duration required by the relevant legislation or for the purpose of processing, in compliance with the Law. These retention periods are specified approximately in the Company’s Personal Data Retention and Destruction Policy.

(6) Rights of the Data Subject Under Article 11 of the Law

If you submit your requests concerning your rights to the Company using the methods outlined in this Privacy Notice, the Company will conclude your request free of charge within thirty days, depending on the nature of the request. However, if the Personal Data Protection Board determines a fee schedule, fees may be charged accordingly. You may obtain information regarding the processing of your data by contacting [email protected]

.

Within this scope, data subjects have the right to:

· Learn whether personal data is processed,

· Request information regarding the processing of personal data,

· Learn the purpose of processing and whether personal data is used accordingly,

· Know the third parties to whom personal data is transferred domestically or abroad,

· Request correction of personal data if it is incomplete or inaccurate, and request notification of such correction to third parties to whom the data was transferred,

· Request deletion or destruction of personal data if the reasons requiring processing no longer exist, and request notification to third parties to whom the data was transferred,

· Object to results that may arise against the individual through automated processing of personal data,

· Request compensation if personal data is unlawfully processed and causes damage.