Corporate Privacy Notice on the Processing of Personal Data

OIC/SMIIC Halal Traceability System (HTS)

This Privacy Notice has been prepared for the purpose of informing the users, authorized representatives and visitors whose personal data are processed through the OIC/SMIIC Halal Traceability System promotional portal and the HTS Infrastructure (together, the “Platform”), operated within the Islamic Countries Standards and Metrology Institute (“SMIIC” or the “Data Controller”).

SMIIC attaches the utmost importance to the security and confidentiality of your personal data and processes such data in compliance with Law No. 6698 on the Protection of Personal Data of the Republic of Türkiye (“KVKK”), the European Union General Data Protection Regulation (“GDPR”) to the extent applicable, and other relevant international and national legislation.

Data Controller: Islamic Countries Standards and Metrology Institute (SMIIC)

Address: Istanbul Dünya Ticaret Merkezi A1 Blok No: 436 - 437 - 438 K:14 34149 Yeşilköy, Bakırköy-Istanbul / TÜRKİYE

Contact / E-mail: secretariat@smiic.org

Your personal data are collected and processed in electronic form, through your entry of information into the Platform, directly by SMIIC or through authorized data processors / service providers acting on behalf of SMIIC and bound by data security, confidentiality and contractual commitments.

Personal data processed within the scope of activities conducted through the Platform are classified under the following categories:

• Identity Data: Name, surname.

• Contact Data: E-mail address, telephone number, country of duty.

• Corporate and Account/Role Data: User category, information on the represented organization/company, user account definitions; the name, surname and contact details of representatives/employees registered in the system by the authorized representative.

• Transaction and Documentation Data: Personal data that may be contained in corporate/technical documents uploaded to the Platform (signatures, titles, identity details in authorization documents).

• Transaction Security and Log Data: IP address, system access and log records, session data, e-mail one-time password (OTP) verification records.

• Marketing / Communication Data: Newsletter subscription consents, permission records, communication preferences.

SMIIC processes your personal data for the purpose of operating the HTS ecosystem in a secure, transparent manner consistent with international standards, relying on the legal bases set out in Article 5 of the KVKK and, to the extent applicable, Article 6 of the GDPR. Our data processing activities are carried out for the following principal purposes and on the following legal bases:

Platform Registration and Account Management Processes:

Your personal data processed for the purposes of creating user accounts, verifying user identities, defining authorizations and ensuring the operational continuity of the Platform are processed on the legal basis that processing is directly related to the establishment or performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6/1-b).

Application, Confirmation and Halal Conformity Verification Processes:

Your data processed for the purposes of conducting the halal conformity assessment, confirmation, certification tracking and verification workflows within the HTS infrastructure, and the systemic representation of applicants, are processed on the bases of the performance of a contract (KVKK Art. 5/2-c; GDPR Art. 6/1-b) and SMIIC’s legitimate interests in upholding global halal traceability standards (KVKK Art. 5/2-f; GDPR Art. 6/1-f).

Ensuring Transaction Security, Audit and Legal Compliance:

Your transaction security data processed for the purposes of ensuring the information security of the Platform, detecting and preventing unauthorized access, maintaining log records in accordance with legislation and their constituting evidence in judicial/administrative proceedings, are processed on the bases of express provision by law (KVKK Art. 5/2-a), the fulfilment of SMIIC’s legal obligations (KVKK Art. 5/2-ç; GDPR Art. 6/1-c) and its legitimate interests in protecting system security (KVKK Art. 5/2-f; GDPR Art. 6/1-f).

Corporate Information and Newsletter Communications:

Newsletter dispatch activities conducted via your e-mail address for the purpose of communicating developments, announcements and corporate news regarding the HTS infrastructure are carried out on the basis of your explicit consent to be given under the KVKK and the GDPR (KVKK Art. 5/1; GDPR Art. 6/1-a) and the commercial electronic communication consent obtained under Law No. 6563 on the Regulation of Electronic Commerce.

Your personal data may be transferred, in furtherance of the purposes set out in this Notice and in accordance with the “need-to-know” principle, to the following third parties:

• Operational Stakeholders and Authorized Bodies: The relevant Halal Accreditation Bodies, Halal Conformity Assessment Bodies and SMIIC’s affiliated/authorized organs, for the purposes of the verification and confirmation of applications and the completion of accreditation workflows;

• Service Providers (Data Processors): Suppliers providing infrastructure hosting, e-mail delivery, SMS/OTP verification and technical support services, operating under confidentiality undertakings;

• Public Institutions and Authorities: Judicial and administrative authorities entitled to make requests for the fulfilment of our legal obligations under applicable legislation.

Storage Location: Your personal data is stored in high-security data centers located within Türkiye.

International Transfer Mechanisms: Given the global nature of the Platform and the international structure of the HTS ecosystem, your personal data may be transferred to accreditation/conformity assessment bodies established abroad or to technical infrastructure providers located abroad, within the scope of Article 9 of the KVKK and, to the extent applicable, the relevant provisions of the GDPR. Such transfers are carried out in accordance with the safeguards and mechanisms required under the applicable legislation. List of transfers: User Name & Surname, Email Address, Company Information, Product Information, and Certificate Information.

As a data subject, you have the following rights under Article 11 of the KVKK and, to the extent applicable, Articles 15–22 of the GDPR:

• To learn whether your personal data are processed and to request access;

• To learn the purpose of processing and whether the data are used in accordance with that purpose;

• To know the third parties to whom your personal data are transferred, in Türkiye or abroad;

• To request the rectification of incomplete or inaccurate data;

• To request the erasure or destruction of your data (right to be forgotten) within the scope of Article 7 of the KVKK and Article 17 of the GDPR;

• To request the restriction of processing and to object to processing;

• To exercise the right to data portability (under the GDPR);

• To claim compensation for damages arising from the unlawful processing of your data;

• To withdraw any consent given, at any time.

Application Procedure:

You may submit your applications and requests regarding your personal data, if you wish through the “Data Subject Application Form”:

• By sending it with wet-ink signature and a copy of your identity document to secretariat@smiic.org;

• By applying in person at the Istanbul Dünya Ticaret Merkezi A1 Blok No: 436 - 437 - 438 K:14 34149 Yeşilköy, Bakırköy-Istanbul / TÜRKİYE with a valid identity document;

• By sending it to secretariat@smiic.org from the e-mail address previously notified to SMIIC and registered in our systems.

Your requests will be assessed and concluded free of charge within the statutory periods prescribed under the KVKK and the GDPR (at the latest within 30 days).

You further retain the right to lodge a complaint with the Personal Data Protection Authority in Türkiye (KVKK) or with the competent Data Protection Authority (DPA) in EU Member States.

• secretariat@smiic.org

No analytics, marketing or third-party targeting cookies aimed at tracking user experience are used on the Platform.

Only Strictly Necessary Cookies are used on the Platform, for the secure operation of the system, the maintenance of user sessions and the conduct of verification processes. These cookies are not subject to consent; if blocked through browser settings, the core functions of the Platform may not operate.

This Privacy Notice may be updated from time to time to ensure compliance with applicable legislation and SMIIC data processing policies. The current version enters into force on the date of its publication on the Platform. Material changes will additionally be notified to registered users via e-mail or in-system notifications.