Personal Data Protection Notice (KVKK)

Last updated: 16 October 2026

This notice has been prepared by NOVEX Sigara Kâğıdı Sanayi ve Ticaret Limited Şirketi (“NOVEX” or the “Company”), acting as data controller, pursuant to Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK” or the “Law”) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. Its purpose is to inform individuals who visit www.novexrollingpaper.com, contact the Company via the contact form, e-mail, telephone or WhatsApp, submit a business cooperation request or apply for a job, about how their personal data is processed.

1. Data Controller

• Legal name: NOVEX Sigara Kâğıdı Sanayi ve Ticaret Limited Şirketi
• Address: Veliköy Mahallesi, 17. Cadde, A Blok No: 3/A, Çerkezköy / Tekirdağ, Türkiye
• E-mail: info@novexrollingpaper.com

2. Categories of Personal Data Processed

• Identity data: first name and surname; for business enquiries, the company you represent and your job title.
• Contact data: e-mail address, telephone number, postal address and, where applicable, company contact details.
• Request / message content: the content of messages, questions, requests and attachments sent via the contact form, e-mail or WhatsApp.
• Transaction security data: IP address, date and time, browser and device information, website log records and technical records used to prevent misuse of form submissions.
• Cookie data: information such as age verification confirmation, language preference and cookie preference; and, if you consent, usage data collected through analytics cookies.
• CV data (job applications): education, work experience, skills, certificates, references and any other information the candidate chooses to include in their CV.

The Company does not request special categories of personal data (such as race, ethnic origin, political opinion, religion, health or biometric data) through the website. We kindly ask applicants not to include such data in their CVs.

3. Purposes of Processing

• Receiving, assessing and responding to contact, information and business cooperation requests;
• Conducting cooperation discussions such as contract manufacturing and private label production;
• Receiving and assessing job applications and running recruitment processes;
• Ensuring website security and preventing misuse and unauthorised access;
• Providing the core functions of the website, such as remembering age verification, language and cookie preferences;
• Responding to requests for information and documents from competent public authorities;
• Establishing, exercising and defending legal rights in the event of a dispute.

4. Legal Grounds for Processing

Your personal data is processed on the basis of the following legal grounds set out in Article 5(2) of the Law:

• Sub-paragraph (c): processing is necessary for the establishment or performance of a contract, provided it relates directly to the parties to that contract (cooperation discussions and assessment of job applications);
• Sub-paragraph (ç): processing is necessary for the data controller to comply with a legal obligation (requests from competent authorities);
• Sub-paragraph (e): processing is necessary for the establishment, exercise or protection of a right;
• Sub-paragraph (f): processing is necessary for the legitimate interests of the data controller, provided it does not harm the fundamental rights and freedoms of the data subject (responding to requests, website security, strictly necessary cookies).

Processing that does not fall under the above grounds, such as the use of analytics cookies or keeping your CV in our candidate pool for future vacancies beyond the position you applied for, is carried out only on the basis of your explicit consent under Article 5(1) of the Law. You may withdraw your consent at any time.

5. Transfer of Personal Data

Your personal data may be transferred, solely for the purposes stated above and in accordance with Articles 8 and 9 of the Law, to the following categories of recipients:

• Service providers supplying hosting, maintenance and technical support for the website;
• Corporate e-mail and communication infrastructure providers;
• Legal, accounting and audit advisers, to the extent necessary;
• Competent public authorities and judicial bodies, upon request and as required by law.

Transfers abroad

Because the servers of the cloud-based hosting, e-mail and similar service providers we use may be located outside Türkiye, your personal data may be transferred abroad. Such transfers are carried out in compliance with Article 9 of the Law: where an adequacy decision exists, or where one of the appropriate safeguards listed in the Law is in place (for example, the standard contract published by the Personal Data Protection Board), or, in incidental cases where neither is possible, where one of the exceptions provided for in the Law applies.

6. Method of Collection

Your personal data is collected electronically, by partly automated and partly non-automated means, through the contact form on the website, e-mails you send us, messages you send via WhatsApp, telephone calls, and cookies and similar technologies. For detailed information on cookies, please see our Cookie Policy.

7. Retention Periods

Your personal data is retained for as long as required by the purposes of processing and for the periods set out in the applicable legislation. As a general rule:

• Contact and information requests: 2 years from the conclusion of the request;
• Correspondence that leads to a commercial relationship: for the periods required by the Turkish Commercial Code and other applicable legislation;
• Job applications: 1 year from the conclusion of the application process; if you consent to our candidate pool, until you withdraw consent and for no more than 2 years;
• Transaction security records: 2 years;
• Cookies: the periods stated in the Cookie Policy.

Once the retention period expires, personal data is erased, destroyed or anonymised in accordance with Article 7 of the Law and the Regulation on the Erasure, Destruction or Anonymisation of Personal Data.

8. Rights of the Data Subject

Under Article 11 of the Law, every data subject has the right to apply to the data controller to:

1. Learn whether their personal data is being processed;
2. Request information about the processing, if their data has been processed;
3. Learn the purpose of the processing and whether the data is used in line with that purpose;
4. Know the third parties, in Türkiye or abroad, to whom their personal data has been transferred;
5. Request the correction of personal data that is incomplete or inaccurate;
6. Request the erasure or destruction of personal data under the conditions set out in Article 7 of the Law;
7. Request that the correction, erasure or destruction be notified to third parties to whom the data has been transferred;
8. Object to a result to their detriment arising from the analysis of the processed data exclusively by automated systems;
9. Claim compensation for damages suffered as a result of the unlawful processing of their personal data.

9. How to Submit a Request

You may submit requests regarding the rights listed above, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:

• by a signed written application delivered in person, by post or through a notary public to Veliköy Mahallesi, 17. Cadde, A Blok No: 3/A, Çerkezköy / Tekirdağ, Türkiye; or
• by secure electronic signature or mobile signature, or from the e-mail address you have previously notified to us and that is registered in our systems, to info@novexrollingpaper.com.

Your application must clearly state your name and surname, your signature (for written applications), your Turkish ID number (for foreign nationals, nationality and passport number or ID number, if any), your residential or business address for notifications, your e-mail address for notifications (if any), your telephone number and the subject of your request.

Applications are concluded free of charge as soon as possible depending on the nature of the request, and within 30 days at the latest. Where the process involves an additional cost, a fee may be charged in line with the tariff set by the Personal Data Protection Board. If your application is rejected, you find the response insufficient, or no response is given in time, you may lodge a complaint with the Personal Data Protection Board under Article 14 of the Law.