POLICY ON THE PROCESSING OF PERSONAL DATA
INTRODUCTION
In accordance with Article 20 of the Constitution of the Republic of Turkey, everyone has the right to request the protection of personal data concerning themselves. This right includes the right to be informed about personal data concerning oneself, to access this data, to request its correction or deletion, and to learn whether it is being used in accordance with its intended purposes.
The Law No. 6698 on the Protection of Personal Data ("PDP Law") regulates the protection of the fundamental rights and freedoms of individuals in the processing of personal data and the obligations of natural and legal persons processing personal data, as well as the procedures and principles they must comply with. The purpose of this Policy, prepared in accordance with this, is to ensure compliance with the obligations related to the PDP Law regulations.
The purpose of this Policy is to protect the personal data of customers, visitors, suppliers, and third parties of TUNÇ KESİCİ TAKIMLAR KESİCİ TAKIM SANAYİ VE TİCARET A.Ş. (TUNÇ KESİCİ TAKIMLAR), which is managed by this Policy. The protection of our employees' personal data is managed under the TUNÇ CUTTING TOOLS Employees' Personal Data Processing Policy, which is drafted in parallel with the principles in this Policy.
By approving the section that refers to these RULES, it will be deemed ACCEPTED that the Data Subject is fully aware of these rules, has read them, and has given TUNÇ CUTTING TOOLS the authority regarding this content.
TUNÇ CUTTING TOOLS reserves the right to update these Personal Data Protection regulations, in whole or in part, at any time within the framework of possible changes in the current legislation, and legal legislative changes will be considered binding on both TUNÇ CUTTING TOOLS and our followers. PURPOSE
The Law No. 6698 on the Protection of Personal Data was published in the Official Gazette dated April 7, 2016, and numbered 29677. The Personal Data Protection Law (KVK Law) is designed to protect the fundamental rights and freedoms of individuals whose personal data is processed, including the right to privacy, which is also protected by the Constitution, and to define the obligations of natural and legal persons who process personal data. Furthermore, the Law No. 6563 on the Regulation of Electronic Commerce also contains provisions regarding the protection of personal data. Criminal sanctions are also foreseen in some cases for the protection of personal data through the provisions of the Turkish Penal Code No. 5237. To protect the fundamental rights and freedoms of individuals, primarily the right to privacy, in the processing of personal data, and to regulate the obligations of natural and legal persons who process personal data and the procedures and principles they must comply with, TUNÇ KESİCİ TAKIMLAR KESİCİ TAKIM SANAYİ VE TİCARET A.Ş. (“TUNÇ KESİCİ TAKIMLAR”) has prepared a Personal Data Protection and Processing Policy (“Policy”). With this Policy, TUNÇ KESİCİ TAKIMLAR adopts the principle of conducting and developing its activities in compliance with the principles set forth in the KVK Law. This Policy aims to inform TUNÇ KESİCİ TAKIMLAR employees about the following:
• Who collects personal data,
• For what purposes and how personal data is processed,
• To whom and for what purposes TUNÇ KESİCİ TAKIMLAR transfers personal data,
• What are the methods and legal grounds for collecting personal data,
• What rights TUNÇ KESİCİ TAKIMLAR employees have regarding the processed personal data,
• What administrative and technical measures are taken to ensure data security. SCOPE
Data subjects whose personal data is processed within the scope of this Policy are categorized as follows:
Customers
Natural persons whose personal data is obtained due to business relationships within the scope of activities carried out by TUNÇ KESİCİ TAKIMLAR, regardless of whether there is any contractual relationship,
Third Parties
Suppliers, prospective customers, prospective employees, complainants, interns, etc., whose personal data is processed within the scope of this Policy, even though they are not defined in the Policy. including but not limited to other natural persons
DEFINITIONS
The definitions used in this Policy are as follows:
Explicit consent Consent given freely and based on informed knowledge regarding a specific matter, granting permission and authorization to the recipient on the permitted matter,
Anonymization Making personal data impossible to link to an identifiable natural person, even when combined with other data,
Employee All natural persons working for TUNÇ KESİCİ TAKIMLAR on a fixed or indefinite basis,
Service Provider Personnel of companies (suppliers, subcontractors, etc.) that TUNÇ KESİCİ TAKIMLAR receives and/or provides services to,
Personal data Any information relating to an identified or identifiable natural person,
Processing of personal data The processing of personal data, wholly or partly by automated means or any other means
Any operation performed on data, such as obtaining, recording, storing, preserving, modifying, reorganizing, disclosing, transferring, acquiring, making available, classifying or preventing the use of data, provided that it is part of a data recording system, through non-automatic means,
Personal Data Subject: The natural person whose personal data is processed, considered as "relevant person" in the Personal Data Protection Law,
Personal Data Subject Application Form: The application form that TUNÇ KESİCİ TAKIMLAR employees will use when making applications regarding their rights explained in Article 11 of the Personal Data Protection Law,
Personal Data Protection Law: Law No. 6698 on the Protection of Personal Data,
Personal Data Protection Board: The Personal Data Protection Board,
Special categories of personal data: Data relating to a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data,
Data Inventory TUNÇ KESİCİ TAKIMLAR’s inventory, created and detailed by associating the personal data processing activities it carries out in accordance with its business processes with the purposes of personal data processing, the recipient group to which personal data is transferred, and the relevant personal data owner group.
Data Processor: A natural or legal person who processes personal data on behalf of the data controller, based on the authority given by the data controller. Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.
Data Controllers Registry: The data controllers registry maintained by the Presidency under the supervision of the Personal Data Protection Board.
GENERAL PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA
In accordance with Article 3 of the Personal Data Protection Law, any operation performed on personal data, such as obtaining, recording, storing, preserving, modifying, reorganizing, disclosing, transferring, acquiring, making available, classifying, or preventing the use of data, whether wholly or partly automated or non-automated, provided that it is part of any data recording system, falls within the scope of processing personal data.
The following principles must be adhered to in the processing of personal data:
• a) Compliance with the law and rules of honesty
• Our company conducts its personal data processing activities in accordance with the law and rules of honesty, in compliance with the Constitution, the Personal Data Protection Law, and relevant legislation. • b) Accuracy and timeliness
• Our company takes all necessary administrative and technical measures to ensure the accuracy and timeliness of personal data during the processing of personal data.
• c) Processing for specific, clear and legitimate purposes
• Our company clearly and precisely defines the purpose of personal data processing before commencing any personal data processing activity.
• d) Relevant, limited and proportionate to the purpose for which they are processed
• Personal data is processed by our company only to the extent necessary to achieve the determined purposes. Data processing is not carried out on the assumption that it may be used later.
• e) Retention for the period stipulated in the relevant legislation or necessary for the purpose for which they are processed
• Our company stores personal data for a period limited to the period stipulated in the Personal Data Protection Law and related legislation or required by the purposes of the data processing activity. CONDITIONS FOR PROCESSING PERSONAL DATA
Conditions for Processing Personal Data
Our company may process personal data and special categories of personal data with the explicit consent of the data subject or, in cases stipulated in Articles 5 and 6 of the Personal Data Protection Law, without explicit consent. In the presence of one of the following, TUNÇ KESİCİ TAKIMLAR may process the personal data of the data subject without seeking explicit consent:
• a) When explicitly provided for in the laws.
• b) When it is necessary for the protection of the life or physical integrity of the person who is unable to express their consent due to factual impossibility or whose consent is not legally valid, or for the protection of the life or physical integrity of another person.
• c) When it is necessary to process the personal data of the parties to a contract, provided that it is directly related to the establishment or performance of the contract.
• d) When it is necessary for our company to fulfill its legal obligations.
• e) When the personal data has been made public by the data subject themselves.
• f) When data processing is necessary for the establishment, exercise or protection of a right. • g) The processing of data is necessary for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the personal data owner. Processing of Special Categories of Personal Data:
Our Company processes personal data classified as special categories, which carry the risk of creating discrimination if processed unlawfully, in accordance with the Personal Data Protection Law (KVKK).
It is carried out in accordance with the data processing conditions set forth in Article 6 of the Law. Processing of special categories of personal data without the explicit consent of the personal data owner is prohibited. However, provided that adequate measures determined by the Personal Data Protection Board are taken, special categories of personal data may be processed even without the explicit consent of the personal data owner in the following cases:
a. Processing of Personal Health Data:
Personal health data may be processed if one of the following conditions exists, provided that (i) adequate measures to be foreseen by the Personal Data Protection Board are taken, (ii) general principles are followed, and (iii) there is an obligation of confidentiality:
• - The explicit written consent of the personal data owner
• - Protection of public health
• - Preventive medicine
• - Conduct of medical diagnosis, treatment and care services,
• - Planning and management of health services and their financing
b. Processing of Special Categories of Personal Data Other Than Health and Sexual Life
Data within this scope will be possible with the explicit consent of the personal data owner or in cases foreseen by the laws. CATEGORIZATION OF PERSONAL DATA PROCESSED BY OUR COMPANY
Categories of Personal Data Processed by Orient Insurance
Personal Data Category Description Data Subject Category to Which the Relevant Personal Data Belongs
Prospective Customer Data Information obtained and generated about the relevant person as a result of the operations carried out by our business units within this framework, in order to benefit from commercial activities. Prospective Customers
Dealer/Agent Data Natural persons who, using the Company's applications, make sales on behalf of the Company in a specific place or region based on a contract with the Company, who carry out preparatory work before the conclusion of the contract and who assist in the implementation of the contract and the payment of compensation. Customers, Agents, Brokers, Agency Partners
Customer Data Information obtained and generated about the relevant person as a result of our commercial activities and the operations carried out by our business units within this framework. Customers
Third Parties Suppliers, guarantors, victims/right holders, family members, etc. whose personal data is processed including but not limited to other natural persons Suppliers
Supplier Data Information required for the provision of the product or service Suppliers
LEGAL OBLIGATIONS
In accordance with the Personal Data Protection Law, TUNÇ KESİCİ TAKIMLAR has legal obligations within the scope of the protection and processing of personal data. These obligations are listed as follows:
Obligation to Inform
TUNÇ KESİCİ TAKIMLAR is obliged to inform the data subject during the collection of personal data and to provide the data subject with information on the following matters within the scope of the relevant legislation:
• • The identity of the data controller and, if any, its representative,
• • The purpose for which personal data will be processed,
• • To whom and for what purpose the processed personal data may be transferred,
• • The legal basis for the collection of personal data,
• • The rights of the data subject.
Within the scope of the obligation to inform, TUNÇ KESİCİ TAKIMLAR will inform data subjects about the processing of their personal data through various means.
Information Obligation
The rights of the data subject regarding the protection of their personal data, as regulated in Article 11 of the Personal Data Protection Law (KVKK), are as stated in the "Your Rights Section" of this document.
In accordance with the KVKK, TUNÇ KESİCİ TAKIMLAR is obliged to evaluate the requests submitted regarding these rights and to inform the Data Subjects about the process and scope of the request, and this notification will be made within the period mandated by legal regulations. These requests must be submitted to TUNÇ KESİCİ TAKIMLAR in writing by the Data Subjects or through other methods determined by the KVKK Board. TUNÇ KESİCİ TAKIMLAR is working to provide the Data Subject with more opportunities to apply and exercise their rights, without contradicting the Board's decision on this matter. Obligation to Ensure Data Security and Privacy
In accordance with Article 12 of the Personal Data Protection Law, our company takes all necessary technical and administrative measures to ensure an appropriate level of security to prevent the unlawful processing of personal data and unlawful access to personal data, and to ensure the preservation of personal data.
Technical Measures Taken to Ensure the Lawful Processing of Personal Data and Prevent Unlawful Access to Personal Data
TUNÇ CUTTING TOOLS has taken all kinds of technical and technological security measures to protect your personal data and has secured your personal data against possible risks. Administrative Measures Taken to Ensure the Lawful Processing of Personal Data and Prevent Unlawful Access to Personal Data
• - Training and raising awareness among company employees regarding the Personal Data Protection Law,
• - In cases where personal data transfer is involved
• Ensuring that a clause is added to the contracts concluded with the persons to whom personal data is transferred, stating that the party to whom the personal data is transferred will ensure data security,
• - Identifying what needs to be done for compliance with the Personal Data Protection Law and preparing internal policies for their implementation,
Measures to be Taken in Case of Unlawful Disclosure of Personal Data
In case the processed personal data is obtained by others through unlawful means, our Company will notify the relevant data owner and the Board as soon as possible.
Obligation to Register with the Data Controllers Registry
TUNÇ KESİCİ TAKIMLAR is obliged to register with the Data Controllers Registry within the period determined and announced by the Personal Data Protection Board in accordance with the Regulation and other legislation, pursuant to Article 16 of the Personal Data Protection Law. RULES FOR PROCESSING PERSONAL DATA
Principles to be followed regarding the processing of personal data:
All collected personal data will be processed in accordance with the principles listed in Article 4 of the Personal Data Protection Law (KVKK) and the conditions specified in Articles 5 and 6. TUNÇ KESİCİ TAKIMLAR is responsible, in accordance with Article 4 of the KVKK, for processing personal data in a lawful and fair manner, accurately and, when necessary, up-to-date, with specific, clear and legitimate purposes, in a manner that is relevant to the purpose, limited and proportionate. Within this framework:
• TUNÇ KESİCİ TAKIMLAR is obliged to act in accordance with the rules, prohibitions, rights and principles stipulated by laws and other legal regulations during the processing of personal data. • TUNÇ KESİCİ TAKIMLAR will be transparent during the processing of personal data and will comply with the obligation to inform and enlighten, as required by the principles of fairness.
• TUNÇ CUTTING TOOLS may process personal data only for legitimate and lawful reasons, i.e., only for limited purposes that are clearly defined and lawful according to the law, and only within the scope of the permission granted to it when it is required to do so. • TUNÇ CUTTING TOOLS will process personal data only to the extent necessary. In this context, taking into account the principle of proportionality, personal data will not be used outside of the activities carried out by TUNÇ CUTTING TOOLS and the purposes within the scope of these activities. Furthermore, processing of unnecessary or unnecessarily needed personal data that exceeds the extent necessary to achieve the purpose will be avoided. • TUNÇ CUTTING TOOLS will retain personal data for the period stipulated in the relevant legislation or necessary for the purpose for which it is processed, and after the expiration of this period, it will not retain this data without anonymizing it (where possible) for any reason. PURPOSES OF PROCESSING PERSONAL DATA AND RETENTION PERIODS
Purposes of Processing Personal Data
TUNÇ CUTTING TOOLS processes personal data in accordance with Articles 5 and 6 of the Personal Data Protection Law, for the purposes listed below and similar purposes, and in cases where consent is required, with the consent of the data subject within the scope of legal regulations.
Personal and contact data: Name-surname, telephone, e-mail information is processed by Human Resources, Information Technology and Customer Relations departments:
• • To answer questions and provide effective service,
• • To record address and other necessary information for communication,
• • To organize all records (IP, log) and documents (contact form) that will serve as the basis for processing in electronic (internet) or paper format,
• • To provide information to public officials upon request and as required by legislation regarding matters related to public security,
• • To evaluate complaints and suggestions regarding our services,
• • To fulfill our legal obligations and to enable the exercise of rights arising from current legislation. Supplier Data; Personal data is processed by the Purchasing and Administrative Affairs unit for the purpose of maintaining relationships and transactions with company suppliers.
It is processed by the Accounting unit for the purpose of carrying out the BA/BS reporting process and is transferred to independent accountants, financial advisors and employees.
It is processed by the Administrative Affairs unit for the purpose of tracking cargo transactions.
Personal Data Retention Periods
Our company determines whether a retention period for personal data is stipulated in the relevant legislation. If a period is stipulated in the relevant legislation, it complies with this period; if no period is stipulated, it retains personal data for as long as necessary for the purpose for which it was processed. If the purpose of processing personal data has ended and the retention periods determined by the relevant legislation and/or our Company have expired, it may only be retained for the purpose of constituting evidence in possible legal disputes, asserting the relevant right related to the personal data, or establishing a defense. Personal data is not retained by our Company based on the possibility of future use.
PERSONAL DATA TRANSFER POLICY
Personal data and sensitive personal data of the data subject may be transferred to third parties within and outside the country. For the fulfillment of services, your personal data may be processed by TUNÇ KESİCİ TAKIMLAR in accordance with the Law and other legislation (including but not limited to the Insurance Law, the Tax Procedure Law, the Law No. 1136 on Attorneys, and other regulations related to these laws, regulations of supervisory and regulatory institutions and organizations, and cases where public authorities mandate it), and may be shared with third parties from whom TUNÇ KESİCİ TAKIMLAR receives services, contracted institutions, lawyers for the resolution of legal disputes, natural and legal persons with whom we have a power of attorney relationship, our business partners, domestic/foreign individuals and institutions from whom we receive cloud storage services, domestic/foreign organizations with whom we have agreements regarding the sending of commercial electronic messages, and other third parties. However, in any case, except for exceptional circumstances, personal data cannot be transferred without the explicit consent of the data subject. Domestic Transfer of Personal Data
In accordance with Article 8 of the Personal Data Protection Law, the domestic transfer of personal data will be possible only if one of the conditions specified in Section 6 of this Policy, titled "Conditions for Processing Personal Data," is met.
International Transfer of Personal Data
In accordance with Article 9 of the Personal Data Protection Law, in case of transfer of personal data abroad, in addition to the fulfillment of the conditions for domestic transfers, one of the following conditions must be met:
- The country to which the data will be transferred must be among the countries declared by the Board as having adequate protection, or
- If adequate protection is not available in the country to which the data will be transferred, the data controllers in Turkey and the relevant foreign country must provide a written guarantee of adequate protection, and the Board's permission must be obtained. Personal data cannot be transferred without the explicit consent of the personal data owner. Groups of Individuals to Whom Our Company Transfers Personal Data
In accordance with Articles 8 and 9 of the Personal Data Protection Law and within the scope of this Policy, our company may transfer the personal data of data subjects to the following groups of individuals for the purposes stated below:
GROUPS OF INDIVIDUALS DEFINITION PURPOSE OF TRANSFER
Legally Authorized Public Institutions and Organizations Public institutions and organizations authorized to receive our company's information and documents in accordance with the relevant legislation Limited to the purpose requested by the relevant public institutions and organizations within their legal authority.
Legally Authorized Private Entities Private legal entities authorized to receive information and documents from our company in accordance with the relevant legislation Limited to the purpose requested by the relevant private legal entities within their legal authority. DELETION, DESTRUCTION, AND ANONYMIZATION OF PERSONAL DATA
In accordance with Article 7 of the Personal Data Protection Law (KVKK), personal data will be deleted, destroyed, or anonymized by our Company, either automatically or upon the request of the data subject, if the reasons requiring the processing of personal data cease to exist, even if the data has been processed in accordance with the relevant legislation.
The procedures and principles regarding this matter will be carried out in accordance with the KVKK and the secondary legislation that will be created based on this Law.
RIGHTS OF PERSONAL DATA SUBJECTS AND THE EXERCISE OF THESE RIGHTS
In accordance with Article 13 of the KVKK, the evaluation of the rights of personal data subjects and the information to be provided to personal data subjects are carried out through this Policy as well as the TUNÇ CUTTING TOOLS Personal Data Subject Application Form. Personal data subjects can submit their complaints or requests regarding the processing of their personal data to us within the framework of the principles specified in the relevant form.
Right to Apply
In accordance with Article 11 of the Personal Data Protection Law, anyone whose personal data is processed may apply to our Company and make requests regarding the following matters concerning themselves:
In accordance with the Personal Data Protection Law, the Data Subject has the right to:
• a) Learn whether their personal data is being processed,
• b) Request information regarding the processing of their personal data, if it has been processed,
• c) Learn the purpose of the processing of their personal data and whether it is being used in accordance with its purpose,
• d) Learn the third parties to whom their personal data has been transferred domestically or abroad,
• e) Request the correction of their personal data if it has been processed incompletely/incorrectly or has changed,
• f) Request the deletion, destruction or anonymization of their personal data if the reasons requiring its processing cease to exist,
• g) Request that the third parties to whom their personal data has been transferred be notified of the actions taken in accordance with clauses (e) and (f) above,
• h) Object to a result that is detrimental to the data subject arising from the analysis of their processed personal data exclusively through automated systems,
• i) Request that their personal data be processed in accordance with the law
The procedures and principles to be applied in personal data transfers are regulated in Articles 8 and 9 of the Personal Data Protection Law.
The right to claim compensation for damages incurred due to the unlawful processing of personal data. Data subjects may submit their requests regarding their rights specified in the law to our Company in writing (with identity verification for documents received in person or via a notary) using the GDPR application form on the website, or by using a Registered Electronic Mail (KEP) address, Secure Electronic Signature, Mobile Signature, or an electronic mail address previously notified to the data controller by the data subject and registered in the data controller's system. Title: TUNÇ KESİCİ TAKIMLAR KESİCİ TAKIM SANAYİ VE TİCARET A.Ş.
Email address: info@tunctech.com
Physical Mail address: HANLI MAHALLESİ ŞEHİT ONBAŞI ZEKERİYA GÖZYUMAN CADDESİ NO 29/B ARİFİYE/SAKARYA
Data Controller: TUNÇ KESİCİ TAKIMLAR KESİCİ TAKIM SANAYİ VE TİCARET A.Ş.
Situations Outside the Scope of the Right to Apply
According to Article 28 of the Personal Data Protection Law, personal data owners will not be able to assert their rights in the following cases:
a. Processing of personal data by natural persons solely within the scope of activities related to themselves or family members living in the same household, provided that the data is not given to third parties and that obligations regarding data security are complied with,
b. Processing of personal data for purposes such as research, planning and statistics through official statistics and anonymization,
c. Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that it does not violate national defense, national security, public security, public order, economic security, privacy or personal rights or constitute a crime,
d. Processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations that have been given duties and powers by law to ensure national defense, national security, public security, public order or economic security,
e. Processing of personal data by judicial authorities or enforcement agencies in relation to investigation, prosecution, trial or execution proceedings.
In accordance with Article 28, paragraph 2 of the Personal Data Protection Law, personal data owners will not be able to assert their rights (except for the right to claim compensation for damages) in the following cases:
a. When the processing of personal data is necessary for the prevention of crime or for criminal investigation.
b. When the processing of personal data that has been made public by the data subject themselves.
c. When the processing of personal data is necessary for the performance of supervisory or regulatory duties, or for disciplinary investigation or prosecution, by authorized and competent public institutions and organizations and professional organizations with the status of public institutions, based on the authority granted by law. d. When the processing of personal data is necessary for the protection of the economic and financial interests of the State in relation to budget, tax and financial matters. Response Procedure
In accordance with Article 13 of the Personal Data Protection Law, our Company will process the applications made by the personal data owner as soon as possible and within a maximum of 30 (thirty) days, free of charge, depending on the nature of the request. The personal data owner's application may be rejected in the following cases:
a. It hinders the rights and freedoms of other individuals.
b. It requires disproportionate effort.
c. The information is publicly available.
d. It jeopardizes the privacy of others.
e. One of the situations excluded from the scope of the Personal Data Protection Law exists.
PUBLICATION OF THIS DATA POLICY
This data policy and rules, along with the disclosure obligation under the legal legislation, will be notified to users whose personal data is held and will also be published on the websites of TUNÇ KESİCİ TAKIMLAR. This Policy may be revised by TUNÇ KESİCİ TAKIMLAR when deemed necessary. In case of revision, the most up-to-date version of the Policy will be published on the Company's website.
