Personal Data Protection Policy

Collection and Processing of Personal Data and Purposes of Processing

Your personal data may be obtained verbally, in writing or electronically through automated or non-automated means, including our website, communication channels, job application forms, contractual relationships, physical premises, security systems and similar channels.

Personal data may be processed for purposes including conducting company operations, delivering product and service processes, communications, customer and supplier relations, finance and accounting, compliance with legal obligations, physical and information security, human resources and recruitment processes, managing requests and complaints, and providing information to authorised persons, institutions and authorities.

Processing activities are carried out in accordance with the principles set out in Article 4 of the KVKK, including lawfulness and fairness, accuracy and keeping data up to date where necessary, processing for specified, explicit and legitimate purposes, being relevant, limited and proportionate, and retention only for the period required.

Transfer of Processed Personal Data

Where necessary and proportionate, your personal data may be transferred to business partners, suppliers, service providers, shareholders, legally authorised public authorities and private-law persons for purposes such as ensuring legal and commercial security, fulfilling contractual and statutory obligations, finance and accounting, procurement and service processes, human resources activities and responding to requests from authorised authorities.

Where a transfer of personal data abroad takes place, the current Article 9 of Law No. 6698 and the conditions and appropriate safeguard mechanisms prescribed by the applicable secondary legislation shall be observed.

Method and Legal Basis of Personal Data Collection

Your personal data may be collected through website forms, e-mail, telephone, contracts, application forms, physical documents, camera systems and other channels used within the scope of company activities.

Depending on the specific processing activity, personal data may be processed on legal grounds including explicit provision by law, necessity for the establishment or performance of a contract, compliance with a legal obligation of the data controller, establishment, exercise or protection of a right, legitimate interests of the data controller provided that the fundamental rights and freedoms of the data subject are not harmed, and explicit consent where required.

Retention, Security and Erasure

Personal data is retained for the periods prescribed by applicable legislation or for as long as necessary for the purposes for which it is processed. When all conditions requiring processing cease to exist, personal data is erased, destroyed or anonymised in accordance with applicable legislation.

The Company implements appropriate administrative and technical measures to prevent unlawful processing and access and to ensure secure retention of personal data.

Your Rights under Article 11 of the KVKK

• ✓

  To learn whether your personal data is being processed.

• ✓

  To request information if your personal data has been processed.

• ✓

  To learn the purpose of processing and whether the data is used in accordance with that purpose.

• ✓

  To know the third parties to whom your personal data is transferred domestically or abroad.

• ✓

  To request correction of incomplete or inaccurate personal data.

• ✓

  To request erasure or destruction where the conditions prescribed by law are met.

• ✓

  To request notification of correction, erasure or destruction to third parties to whom the data has been transferred.

• ✓

  To object to a result arising against you through the analysis of processed data exclusively by automated systems.

• ✓

  To claim compensation if you suffer damage due to unlawful processing of personal data.

Application to the Data Controller

You may submit requests concerning your rights under the KVKK to the Company by one of the methods prescribed in the Communiqué on the Procedures and Principles of Application to the Data Controller, clearly stating your identity and the subject of your request.

Applications are concluded as soon as possible and no later than thirty days depending on the nature of the request. Where the transaction requires an additional cost, the fee tariff determined by the Personal Data Protection Board may apply.

You may use the contact channels below for your applications and information requests.