OZMO KİMYA SANAYİ VE DIŞ TİCARET LTD.ŞTİ

SUPPLIER CONFIDENTIALITY UNDERTAKING

PARTIES

Company: KOZMO KİMYA SANAYİ VE DIŞ TİCARET LTD.ŞTİ
Address:
Supplier:
Address:

This Supplier Personal Data Protection and Confidentiality Undertaking (“Undertaking”) has been executed between the Company and the Supplier (“Party”) whose information is provided above. Unless otherwise stated in writing, the addresses written above shall be considered as the legal notification addresses.

This Undertaking has been prepared in order to define the personal data and other confidential information obtained by the Party from the Company within the scope of Law No. 6698 on the Protection of Personal Data (“Law”), to inform the Party, to set forth the necessary measures to be taken to protect such data and information, and to determine sanctions in case of any disclosure.

Subject Matter

The subject of this Undertaking is the protection of “personal data,” “sensitive personal data,” and “confidential information” belonging to the Company, which may exist in written or oral, visual, magnetic, or any other format, within the scope of the confidentiality principle established between the parties. The protection obligation covers the Party itself, its employees, business partners, customers, suppliers, or third parties to whom the information is disclosed.

Protection of Personal Data and Confidential Information

The Party is obliged to take all necessary technical and administrative measures to ensure an appropriate level of security according to the nature of the personal data in order to prevent unlawful processing, unlawful access, and to ensure the preservation of personal data obtained from the Company’s data subjects (e.g., name, surname, date of birth, ID number, passport number, marital status, gender, employment data, address, email address, phone number, family information, payment details, entry-exit records, activity images/information, requests or complaints, website data, transaction security information, etc.).

If personal data is processed by another real or legal person on behalf of the Party, both parties shall be jointly responsible for taking the necessary measures. The Party and those operating under its authority are obligated to process personal data only in accordance with the Company’s written instructions. In cases where the Party must transfer personal data to a subcontractor, it must notify and obtain the prior approval of the Company in a provable manner. Any contract made with a subcontractor must, at a minimum, include the same provisions as this Undertaking and the main contract between the Company and the Party.

The Party agrees to process personal data in accordance with the Law and the contract signed with the Company and must immediately inform the data provider if for any reason it cannot comply. In this case, the Company reserves the right to suspend data transfer and terminate the contract.

Information Not Considered as Personal Data or Confidential

Information obtained before the confidentiality obligation or made public without the fault of the Party, or those required to be disclosed by legal regulations, court orders, or administrative decisions, as well as personal data excluded from the Law, are outside the scope of confidentiality.

The Party must immediately inform the Company of any request from a judicial authority concerning the transferred personal data. The Company reserves the right to suspend or terminate the contract depending on the nature of the request.

All rights to confidential information belong to the Company, and disclosure of such information does not grant any rights to the disclosing party. The Party acknowledges that the Company’s confidential information includes valuable trade secrets and that the Company is under no obligation to disclose them. The Company makes no guarantee regarding the completeness, accuracy, or certainty of its confidential information.

Precautions

The Party shall respond to Company inquiries regarding personal data processing in accordance with procedures as soon as possible and comply with the decisions and opinions of the Personal Data Protection Board. The Party accepts that the Company has the right to audit whether obligations have been fulfilled and will cooperate accordingly.

If the Party becomes aware of any unauthorized disclosure of personal data or confidential information, it must notify the Company immediately in writing and take all necessary steps to minimize any potential damage. The Party agrees in advance to compensate the Company for all damages incurred and pay a penalty of not less than ……………….. TL for breach of this Undertaking.

Return of Confidential Information

Upon termination of the commercial relationship or this Undertaking, the Party agrees to return or destroy all transferred personal data and confidential information, including any backups. If legal provisions prevent destruction, the Party must take all necessary administrative and technical measures to ensure confidentiality and cease any processing. Future data return obligations will be addressed under a separate undertaking. If it is determined that the returned data has been copied or reproduced, the penalty specified in Article 5 shall apply.

Permission to Disclose

Except for the exceptions defined in Article 3 and unless written permission is obtained from the other party, the Party shall not disclose, publish, use for advertising purposes, or refer to personal or confidential information through any means, including the press and media.

Miscellaneous

This Undertaking is issued in two original copies, with each party responsible for the stamp duty on its own copy. If any provision of this Undertaking is deemed invalid, annulled, or unenforceable, this does not affect the validity of the other provisions.

All disputes arising from this Undertaking shall be subject to the jurisdiction of Istanbul courts and enforcement offices.

All notifications between the parties shall be made in writing. This Undertaking is binding on the parties and their successors. The rights and obligations set forth herein may not be transferred in whole or in part.

This Undertaking has been signed on …/…/…… and the confidentiality and data protection obligations of the parties shall remain in effect throughout the business relationship and beyond, without any time limitation, even after its termination.

On behalf of the Supplier:
Full Name:
Full Address:
Contact Number:
Email:
Signature/Stamp

On behalf of the Company:
Full Name:
Full Address:
Contact Number:
Email:
Signature/Stamp

 

KOZMO KIMYA INDUSTRY AND FOREIGN TRADE LTD.

SUPPLIER CLARIFICATION NOTICE

This clarification notice has been prepared by KOZMO KIMYA INDUSTRY AND FOREIGN TRADE LTD. (“KOZMO KIMYA”) as the data controller, in accordance with Article 10 of the Personal Data Protection Law No. 6698 (“Law”) and the Regulation on the Procedures and Principles to be Followed in Fulfillment of the Obligation to Inform.

MERSIS Number: Address: Phone: Fax: E-mail:

KOZMO KIMYA processes the following personal data related to the supplier’s authorized representative: name, surname, mother-father names, date of birth, place of birth, marital status, Turkish ID number, passport number, gender, Turkish ID card, driver’s license, contact address, email address, mobile phone number, signature, legal transactions, bank account number, IBAN number, audit inspection, work data, camera recordings, vehicle plate number, vehicle and cargo information, balance sheet information, financial performance data, credit and risk information, incident management, criminal convictions, and security measures. These data are processed for the purposes of: conducting activities in compliance with regulations, managing finance and accounting operations, ensuring physical security of premises, following up legal matters, conducting communication activities, managing/controlling business activities, overseeing logistics operations, managing procurement processes, executing contract processes, managing supply chain processes, providing information to authorized persons, institutions, and organizations, planning/controlling access rights of business partners/suppliers to information and facilities, and managing relationships with business partners/suppliers, collecting entry/exit records of business partner/supplier employees.

These personal data are processed based on the legal grounds specified in Article 5 of the Law, such as “necessary for the establishment and performance of a contract, provided for in laws”, for activities like purchasing goods/services, payment transactions, and managing logistics operations; and “obtaining explicit consent” for communication activities, which are collected verbally, in writing, or electronically. These data are processed fully or partially by automated means, and all necessary technical and administrative measures are taken to protect them. In the event the explicit consent is withdrawn, the data processing activity is halted.

For the purposes mentioned above, personal data may be shared with real persons or legal entities under private law, shareholders, business partners, suppliers, relevant public institutions and organizations, and board members.

Requests within the scope of Article 11 of the Law “Rights of the data subject” can be submitted by sending the Application Form, as specified in the KOZMO KIMYA Personal Data Protection and Processing Policy available on the website, to KOZMO KIMYA.

DECLARATION OF CLARIFICATION

I declare that I have been adequately informed about all the above-mentioned matters, that I have read and understood KOZMO KIMYA’s Personal Data Protection and Processing Policy, and that I am aware of my rights under Article 11 of the Law No. 6698.

Data Subject’s Name and Surname: …………………………….. T.C. ID Number: ……………………………..

Date: …./…../……….. Signature

---

EXPLICIT CONSENT STATEMENT

I consent to the processing of my personal data, collected verbally, in writing, or electronically by the data controller for purposes related to the establishment and performance of the contract, obtaining explicit consent, and legitimate interests of the data controller, to be processed in a limited and proportional manner.

I Accept with My Explicit Consent I Do Not Accept

Data Subject’s Name and Surname: …………………………….. T.C. ID Number: ……………………………..

Date: …./…../……….. Signature