It means.
4. BASIC PRINCIPLES OF PROCESSING OF PERSONAL DATA
4.1. Processing of Personal Data in Compliance with Law and Honesty Rules
The Company processes Personal Data in accordance with the law and the rules of honesty and on the basis of proportionality. In this context, the Company processes Personal Data to the extent and limited to the extent required by the Company's business activities.
4.2. Ensuring that Personal Data is Accurate and Up to Date when Necessary
The Company takes all necessary precautions to ensure that Personal Data is complete, accurate and up-to-date throughout the period it is processed. In this context, the Company establishes the necessary mechanisms to ensure the accuracy and up-to-dateness of Personal Data and updates the relevant Personal Data in accordance with the Relevant Person's change requests for Personal Data within the scope of KVKK Regulations.
4.3. Processing of Personal Data for Specific, Clear and Legitimate Purposes
Before Processing Personal Data, the purpose for which Personal Data will be processed is determined by the Company. In this context, the Company clearly states the purposes of processing Personal Data and processes Personal Data within the scope of its business activities and for purposes related to these activities. In this regard, Relevant Persons are informed in accordance with the Personal Data Protection Law Regulations and, where necessary, their Explicit Consent is obtained.
4.4. Personal Data Must Be Related to the Purpose for Processing, Limited and Proportionate
The Company collects Personal Data only to the extent and nature required by its business activities and processes it limited to specified purposes. Accordingly, the Company avoids processing Personal Data that is not relevant or needed to achieve the specified purposes.
4.5. Keeping Personal Data for the Period Envisaged in the Relevant Legislation or Necessary for the Purpose for which they are Processed
The Company retains Personal Data for the minimum period necessary for the purpose for which they are processed and stipulated in the relevant legal legislation. In this context, the Company first determines whether a period of time is prescribed for the storage of personal data in the relevant legislation, and if a period is determined, it acts in accordance with this period. If there is no legal period, Personal Data is stored for the period necessary for the purpose for which it is processed.
At the end of the specified storage periods, Personal Data is destroyed in accordance with the periodic destruction periods or the Relevant Person's application and with the specified destruction methods (deletion and/or destruction and/or anonymization). In this case, third parties to whom the Company transfers Personal Data are also enabled to delete, destroy or anonymize the Personal Data.
The Committee is responsible for the operation of the destruction processes. In this context, the necessary procedure is established by the Committee.
5. PROCESSING OF PERSONAL DATA
Personal Data can only be processed by the Company within the scope of the procedures and principles specified below.
5.1. Explicit Consent
Personal Data is processed with the Explicit Consent of the Relevant Person only if any of the other Personal Data processing conditions listed below are not present.
In this case, Personal Data is processed after informing the Relevant Persons within the framework of fulfillment of the Disclosure Obligation and if the Relevant Persons give their free will and Explicit Consent.
Explicit Consent from Relevant Persons is obtained by methods in accordance with KVK Regulations. Explicit Consent is verifiable and kept by the Company for the required period within the scope of KVK Regulations.
The Committee is obliged to ensure that the Disclosure Obligation is fulfilled in terms of all Personal Data Processing processes, and that Explicit Consent is obtained when necessary, and that the Explicit Consent received is kept. All department employees who process Personal Data are obliged to comply with the instructions of the Committee, this Policy and KVK Procedures.
5.2. Clearly Provided in Laws
Personal Data of the Relevant Person is processed within the scope of this data processing condition if it is clearly foreseen in the law regarding the Processing of Personal Data, in other words, if there is a clear provision in the relevant law regarding the Processing of Personal Data.
5.3. Failure to Obtain Explicit Consent of the Relevant Person Due to Actual Impossibility
If it is necessary for the Personal Data of a person who is unable to express his/her Explicit Consent due to actual impossibility or whose Explicit Consent cannot be given validity to be processed in order to protect his/her life or physical integrity or that of another person, the Personal Data of the Relevant Person will be subject to this data processing. It is processed within the scope of the condition.
5.4. Directly Related to the Establishment or Performance of the Contract
If the processing of Personal Data is necessary, provided that it is directly related to the establishment or performance of a contract to which the Relevant Person is a party, the Personal Data of the Relevant Person is processed within the scope of this data processing condition.
5.5. Fulfillment of the Company's Legal Obligations
If processing of Personal Data is mandatory for the Company to fulfill its legal obligations, the Personal Data of the Relevant Person will be processed within the scope of this data processing requirement.
5.6. Publication of Personal Data by the Relevant Person
If the Relevant Person has made his Personal Data public, the relevant Personal Data will be processed within the scope of this data processing condition, limited to the purpose of publicization.
5.7. Personal Data Processing is Necessary for the Establishment or Protection of a Right
If Personal Data Processing is mandatory for the establishment, exercise or protection of a right, the Personal Data of the Relevant Person is processed within the scope of this data processing requirement.
5.8. Personal Data Processing is Necessary for the Company's Legitimate Interests
If it is necessary to process data for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the Relevant Person, the Personal Data of the Relevant Person is processed within the scope of this data processing condition.
6. PROCESSING OF SPECIAL PERSONAL DATA
6.1. Personal Data of Special Nature is processed by the Company in accordance with the principles and principles specified in this Policy and by taking all necessary administrative and technical measures, including the methods determined by the Board, and if the following conditions are met:
- Special Personal Data other than health and sexual life are processed without the Explicit Consent of the Relevant Person if it is clearly provided for in the law, in other words, if there is a clear provision in the relevant law regarding the Processing of Personal Data. Otherwise, Explicit Consent of the Relevant Person is required for the processing of Special Personal Data other than health and sexual life.
- Special Personal Data regarding health and sexual life are collected for the purposes of protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing, by persons who are under the obligation of confidentiality (e.g. workplace physician working under the company payroll). ) or by authorized institutions and organizations without the Explicit Consent of the Relevant Person. Otherwise, Explicit Consent of the Relevant Person is required for the processing of Special Personal Data other than health and sexual life.
6.2. The Company provides the following for employees involved in the processing of Special Personal Data:
6.2.1. It provides regular training on KVK Regulations and the security of Special Personal Data.
6.2.2. Makes confidentiality agreements.
6.2.3. It clearly defines the authorization scope and duration of users who are authorized to access Special Personal Data.
6.2.4. Periodically carries out authorization checks.
6.2.5. It immediately removes the authorizations of employees who change their duties or leave their jobs in this area and immediately takes back the inventory allocated to the relevant employee.
6.3. In case of transfer of Special Personal Data to electronic environments, regarding the electronic environments where Special Personal Data is processed, stored and/or accessed, the Company:
6.3.1. It preserves Special Personal Data using cryptographic methods.
6.3.2. It keeps cryptographic keys securely and in different environments.
6.3.3. It securely logs transaction records of all movements performed on Special Personal Data.
6.3.4. It constantly monitors the security updates of the environments where Special Personal Data is located, regularly performs the necessary security tests and records the test results.
6.3.5. If the Special Personal Data is accessed through a software, it carries out user authorizations for this software, regularly performs security tests of these software, and records the test results.
6.3.6. It provides at least a two-stage authentication system in case of remote access to Special Personal Data.
6.4. In case of processing of Special Personal Data in a physical environment, the Company: Regarding the physical environments in which the data is processed, stored and/or accessed:
6.4.1. It takes adequate security measures (against electricity leakage, fire, flood, theft, etc.) depending on the nature of the environment where the Special Personal Data is located.
6.4.2 It prevents unauthorized entry and exit by ensuring the physical security of these environments.
6.5. In case of transfer of Special Personal Data, the Company:
6.5.1. If it is necessary to transfer Special Personal Data via e-mail, an encrypted corporate e-mail address or Registered Electronic Mail (KEP) account is used.
6.5.2. If it is necessary to transfer Special Personal Data through media such as portable memory, CD, DVD, encryption is done using cryptographic methods.
6.5.3. If Special Personal Data needs to be transferred between servers in different physical environments, a VPN is established between the servers or the transfer is made via SFTP or HTTPS method.
6.5.4. If it is necessary to transfer Special Personal Data via paper, necessary precautions are taken against risks such as theft, loss or viewing of the document by unauthorized persons and the document is sent in the format of "confidential documents".
6.6. In addition to the above regulations, the Committee is responsible for taking measures and establishing mechanisms in accordance with the KVK Regulations, especially the Personal Data Security Guide published by the Board to ensure the security of Special Personal Data.
7. PERSONAL DATA PROCESSED BY THE COMPANY AND THE PURPOSES OF PROCESSING
Before the Company, the Relevant Persons are informed in accordance with the KVK Regulations, and in line with the Company's Personal Data processing purposes, based on and limited to at least one of the Personal Data processing conditions specified in Articles 5 and 6 of the KVKK, especially regarding the Processing of Personal Data. Personal Data is processed in accordance with the general principles specified in the KVKK, including the principles specified in Article 4 of the KVKK. Detailed information about the categories of Personal Data processed and the purposes of processing Personal Data, within the framework of the purposes and conditions specified in this Policy, is included in ANNEX 1 of this Policy (ANNEX 1 - Personal Data Categories and Purposes of Processing Personal Data).
8. STORAGE PERIOD AND DESTRUCTION OF PERSONAL DATA
8.1. The Company retains Personal Data for the period necessary for the purpose for which they are processed and the minimum period stipulated in the relevant legal legislation. In this context, the Company first determines whether a period of time is stipulated in the relevant legislation for the storage of Personal Data, and if a period is determined, it acts in accordance with this period. If there is no legal period, Personal Data is stored for the period necessary for the purpose for which it is processed. Personal Data is not stored by the Company under any circumstances, taking into account the possibility of future use.
8.2. The Company creates a Personal Data storage and Destruction policy in accordance with its Personal Data processing inventory and carries out all Destruction (deletion and/or destruction and/or anonymization) activities in accordance with the Personal Data storage and Destruction policy regarding KVK Regulations. Personal Data is destroyed at the end of the storage periods determined within the scope of the prepared Personal Data storage and Destruction policy, in accordance with the periodic Destruction periods or the Relevant Person's application and with the determined Destruction methods (deletion and/or destruction and/or anonymization). The Committee is responsible for the operation of the destruction processes. In this context, the necessary procedure is established by the Committee. In this context, the necessary procedure is established by the Committee.
9. TRANSFER OF PERSONAL DATA
9.1. The Company may transfer the Personal Data of the Relevant Persons to third parties at home and/or abroad in accordance with the KVK Regulations, by taking the necessary security measures in line with the purposes of lawful Personal Data processing. In this case, the necessary protective regulations are added to the contracts concluded with third parties.
9.2. Even if the Relevant Person does not have Explicit Consent, Personal Data may be transferred to third parties by the Company if one or more of the following conditions are present, by taking the necessary administrative and technical measures in accordance with the KVK Regulations:
- Relevant activities regarding the transfer of Personal Data are clearly foreseen by law,
- The transfer of Personal Data by the Company is directly related to and necessary for the establishment or performance of a contract,
- Transfer of Personal Data is mandatory for the Company to fulfill its legal obligations,
- Transfer of Personal Data by the Company in a limited way for the purpose of publicization, provided that it has been made public by the Relevant Person,
- Transfer of Personal Data by the Company is mandatory for the establishment, use or protection of the rights of the Company or the Relevant Person or third parties,
- It is mandatory to transfer Personal Data for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the Relevant Person,
- It is necessary for the person who is unable to express his consent due to actual impossibility or whose consent is not given legal validity, to protect his own life or physical integrity, or that of another person.
9.3. In addition to the above, Personal Data may be transferred to foreign countries declared by the Board to have adequate protection (“ Foreign Country with Adequate Protection ”), if any of the above conditions are met. In case there is not sufficient protection, in accordance with the data transfer conditions stipulated in the legislation, to foreign countries where the Data Controllers in Turkey and the relevant foreign country have committed in writing to adequate protection and have the permission of the Board (" Foreign Country Where the Data Controller Committed to Adequate Protection is Located ") transferable.
10. TRANSFER OF SPECIAL PERSONAL DATA
10.1. Special Personal Data can be transferred by the Company in accordance with the principles set out in this Policy and by taking all necessary administrative and technical measures, including the methods determined by the Board, and if the following conditions are met:
- Special Personal Data other than health and sexual life are processed without the Explicit Consent of the Relevant Person if it is clearly provided for in the law, in other words, if there is a clear provision in the relevant law regarding the Processing of Personal Data. Otherwise, Explicit Consent of the Relevant Person is required for the processing of Special Personal Data other than health and sexual life.
- Special Personal Data regarding health and sexual life are collected for the purposes of protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing, by persons who are under the obligation of confidentiality (e.g. workplace physician working under the company payroll). ) or by authorized institutions and organizations without the Explicit Consent of the Relevant Person. Otherwise, Explicit Consent of the Relevant Person is required for the processing of Special Personal Data other than health and sexual life.
10.2. In addition to the above, Special Personal Data can be transferred to Foreign Countries with Adequate Protection if any of the above conditions are met. In case there is not sufficient protection, it may be transferred to Foreign Countries Where the Data Controller Who Undertakes Adequate Protection is Located, in line with the data transfer conditions stipulated in the legislation.
11. COMPANY'S OBLIGATION TO DISCLOSE
11.1. The Company informs the Relevant Persons before the processing of Personal Data, in accordance with Article 10 of the KVKK and the provisions of the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation. In this context, the Company informs the Relevant Persons in accordance with the KVK Regulations, by whom their Personal Data is processed as the Data Controller, for what purposes, for what purposes it is shared with whom, by what methods it is collected and the legal reason and within the scope of processing the Personal Data of the Relevant Persons. informs them about their rights.
11.2. Necessary KVK Procedures are created by the Committee for the purpose of reporting all new Personal Data processing processes to the Committee.
11.3. If the Data Processor is a third party other than the Company, the third party undertakes before starting the Personal Data Processing with a written contract that the third party will comply with the above-mentioned obligations. Each employee is obliged to go through the process set out in this Policy and KVK Procedures in case Personal Data is transferred to the Company by a third party.
12. RIGHTS OF RELATED PERSONS
12.1. Relevant Persons have the following rights:
- Learning whether personal data is being processed or not,
- Requesting information if personal data has been processed,
- Learning the purpose of processing personal data and whether they are used for their intended purpose,
- Knowing the third parties to whom Personal Data is transferred at home or abroad,
- Requesting correction of Personal Data if it has been processed incompletely or incorrectly and requesting that the action taken in this context be notified to third parties to whom Personal Data has been transferred,
- Requesting the deletion or destruction of your Personal Data, even though it has been processed in accordance with the law and other relevant legal provisions, in case the reasons requiring processing are eliminated and requesting that the action taken in this context be notified to third parties to whom your Personal Data has been transferred,
- Objecting to the emergence of a result against the person by analyzing the processed data exclusively through automatic systems,
- Request compensation of the damage in case of damage due to the unlawful processing of personal data.
12.2. Relevant Persons, section 12.1 of this Policy. They will be able to submit their requests regarding their rights listed in the section to the Company through the methods determined by the Board. In this regard, they will be able to benefit from the Relevant Person Application Form, which can be accessed from the Company's electronic common area or forwarded by the Company's Human Resources Department upon request. However, in any case, current application methods and application content should be checked in the relevant legislation before application and applications should be made in accordance with the said procedures and principles.
12.2. If the Relevant Persons submit their requests regarding their rights listed above to the Company in writing, the Company will finalize the request free of charge within 30 (thirty) days at the latest, depending on the nature of the request, in accordance with the KVK Regulations. If an additional cost arises for the conclusion of the requests by the Data Controller, the fees in the tariff determined by the Board may be requested by the Data Controller.
13. PERSONAL DATA MANAGEMENT AND SECURITY
13.1. The Company establishes a Committee to fulfill its obligations under the KVK Regulations, to ensure and supervise the preparation and implementation of the KVK Procedures necessary for the implementation of this Policy, and to make recommendations regarding their operation.
13.2. The Company takes all necessary administrative and technical measures to ensure the security of Personal Data in accordance with the KVK Regulations. In this context, the Processing of Personal Data activities by the Company are audited by technical systems according to technological possibilities and implementation costs.
13.3. Personnel who are knowledgeable in technical matters regarding the Processing of Personal Data are employed.
13.4. Company employees are informed and trained regarding the protection of Personal Data and their processing in accordance with the law.
13.5. Necessary KVK Procedures are created to ensure that employees who need to access Personal Data in the Company have access to such Personal Data, and the Committee is responsible for its creation and implementation.
13.6. Company employees can only access Personal Data within the authority defined for them and in accordance with the relevant KVK Procedures.
13.7. If Company employees suspect that the security of Personal Data is not adequately ensured or if they detect such a security vulnerability, they immediately report the situation to the Committee.
13.8. Detailed KVK Procedures for the security of Personal Data are created by the Committee.
13.9. Each person who is allocated a Company device is responsible for the security of the devices allocated for his/her use.
13.10 Each Company employee is responsible for the security of the physical files within his/her area of responsibility.
13.11. In case of additional security measures requested or to be requested additionally for the security of Personal Data within the scope of KVK Regulations, all employees are obliged to comply with the additional security measures and ensure the continuity of these security measures.
13.12. All Personal Data processed within the Company is considered "Confidential Information" by the Company.
13.13. Company employees have been informed that their obligations regarding the security and confidentiality of Personal Data will continue after the termination of the employment relationship, and a commitment has been taken from Company employees to comply with these rules.
14. AUDIT
The Company has the right to regularly and ex officio audit, without any prior notice, whether all employees and Data Processors of the Company comply with the KVK Regulations, this Policy and the KVK Procedures, and carry out the necessary routine audits within this scope. does. The Committee creates KVK Procedures regarding these audits and ensures the implementation of the said procedures.
15. RESPONSIBILITIES
The Committee responsible for the preparation, revision and implementation of this Policy is appointed by the Company's Board of Directors by the decision of the Board of Directors, and changes within this scope are made in the same way.
16. CHANGES TO BE MADE IN THE POLICY
16.1. This Policy may be amended by the Company from time to time with the approval of the Board of Directors.
16.2. Company1 makes the current Policy version available to Relevant Persons via its website address.
17. EFFECTIVE DATE OF THE POLICY
This version of this Policy has been approved by the Company's Board of Directors and has entered into force with retroactive effect as of the KVKK effective date; The new version will remain in effect until approved by the Board of Directors.
ANNEX 1 – Personal Data Categories and Purposes of Processing Personal Data