Data Protection Complaints Policy

Effective Date: 24 June 2026 | Last Updated: 24 June 2026 | Next Review: June 2027

1. Purpose

This Data Protection Complaints Policy sets out the procedure by which any individual ('data subject') may raise a complaint with CAGS concerning the handling of their personal data. CAGS is committed to resolving all data protection concerns promptly, transparently, and fairly, in accordance with applicable international data protection law including GDPR, KVKK, and all other relevant national frameworks.

This policy is publicly accessible and applies globally — to all individuals regardless of their country of residence.

2. Who Can Complain?

Any individual whose personal data is processed by CAGS has the right to raise a complaint, including:

• Website visitors and platform users
• B2B customers and business contacts
• Employees and job applicants
• Business partners and suppliers
• Any other individual whose personal data CAGS has collected or processed

Complaints may be submitted by the data subject themselves or by an authorised representative acting on their behalf with a valid power of attorney.

3. What Can You Complain About?

You may raise a complaint if you believe CAGS has:

• Collected or processed your personal data without a valid lawful basis
• Failed to honour your data subject rights (access, rectification, erasure, portability, objection, etc.)
• Shared your personal data with third parties without authorisation
• Retained your personal data longer than necessary
• Failed to keep your personal data secure
• Transferred your personal data internationally without adequate safeguards
• Failed to respond to a previous data subject rights request within the required timeframe
• Used your data for purposes other than those disclosed in our Privacy Policy
• Engaged in automated decision-making affecting you without adequate safeguards

4. How to Submit a Complaint

Complaints may be submitted through any of the following channels:

4.1 By Email (Preferred)

• Email: info@cagsgrp.com
• Subject line: DATA PROTECTION COMPLAINT — [Your Name]

4.2 By Phone

• Telephone: +90 212 916 27 27

4.3 By Post

Data Protection — Complaints
CAGS TOBACCO AND TOBACCO PRODUCTS INDUSTRY AND TRADE JOINT STOCK COMPANY
Fulya Mahallesi, Buyukdere Caddesi, Torun Center A Blok No: 74A, Ic Kapi No: 19, Sisli / Istanbul, Turkey

4.4 What to Include in Your Complaint

To help us investigate efficiently, please include:

• Your full name and contact details (email and/or postal address)
• A clear description of your complaint and the specific concern
• The date(s) on which the alleged issue occurred (if known)
• Any previous correspondence with CAGS relating to this matter
• Supporting documents or evidence relevant to your complaint
• The outcome you are seeking

Complaints may be submitted in any language. CAGS will respond in English unless another arrangement is agreed.

5. Our Complaint Handling Process

Step 1 — Receipt & Logging (Immediate): Upon receipt of your complaint, CAGS will log it in our complaints register, recording: date received, complainant identity, nature of the complaint, and the channel through which it was received.

Step 2 — Acknowledgement (Within 30 Days): We will send you a written acknowledgement within 30 calendar days of receiving your complaint, confirming: that we have received your complaint, the reference number assigned, the name of the person handling your complaint, and an estimated timeline for our response.

Step 3 — Investigation: The designated data protection contact at CAGS will conduct a thorough, impartial investigation. This may involve: reviewing relevant data processing records, consulting with internal teams, reviewing applicable policies and legal obligations, and where necessary, engaging external legal or compliance advisors.

Step 4 — Written Response (Within 60 Days): CAGS will provide a full written response within 60 calendar days of the initial complaint, setting out: our findings, any corrective action taken or planned, and the outcome of the complaint. Where a complaint is complex and requires additional time, we will notify you before the 60-day deadline with an updated timeline.

Step 5 — Record Keeping: CAGS maintains a secure complaints log containing: date received, acknowledgement date, investigation steps taken, outcome, corrective actions, and date of final response. These records are retained for a minimum of 3 years and are available for review by relevant supervisory authorities upon lawful request.

6. Escalation — Supervisory Authorities

If you are not satisfied with our response, or if CAGS fails to respond within the timelines set out above, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. You do not need to wait for CAGS to respond before contacting a supervisory authority.

Key supervisory authorities globally:

• Turkey (CAGS headquarters): Kisisel Verileri Koruma Kurumu (KVKK) — www.kvkk.gov.tr
• European Union: Your national Data Protection Authority — edpb.europa.eu/about-edpb/board/members
• Germany: Bundesdatenschutzbeauftragter (BfDI) — www.bfdi.bund.de
• France: Commission Nationale de l'Informatique et des Libertés (CNIL) — www.cnil.fr
• Netherlands: Autoriteit Persoonsgegevens — www.autoriteitpersoonsgegevens.nl
• Middle East: Refer to your national data protection authority where applicable
• All other jurisdictions: Please contact your national data protection or privacy regulator

7. No Retaliation

CAGS guarantees that no individual who raises a data protection complaint in good faith will face any form of retaliation, disadvantage, or negative consequences as a result of making a complaint. This applies to employees, business partners, and all external parties.

8. Policy Review

This policy is reviewed annually and updated to reflect changes in applicable law, supervisory authority guidance, and CAGS's internal procedures. Last updated: 24 June 2026. Next review: June 2027.

Related Policies

• Privacy Policy: www.cagsgrp.com/privacypolicy
• Terms & Conditions: www.cagsgrp.com/terms-and-conditions
• Cookie Policy: www.cagsgrp.com/cookie-policy
• Contact CAGS: www.cagsgrp.com/contact