PERSONAL DATA PROCESSING AND PROTECTION POLICY
1. PURPOSE AND SCOPE
As BORATAŞ TUR.MAK.İNŞ.TAAH.SAN VE TİC LTD.ŞTİ. (hereinafter referred to as Company/Workplace/BORATAŞ) located in Bağyurdu Organized Industrial Zone Anadolu Cad. No:8 Kemalpaşa-İZMİR, in accordance with the Personal Data Protection Law No. 6698, which is regulated as a constitutional right; we attach importance to the protection of personal data belonging to all real persons we come into contact with in any way while performing our activities and to fulfilling the requirements in the KVKK in this context.
This Personal Data Protection Policy has been prepared to inform you about the processes related to the collection, use, sharing and storage of personal data by BORATAŞ TUR.MAK.İNŞ.TAAH.SAN VE TİC LTD.ŞTİ. located in Bağyurdu Organized Industrial Zone Anadolu Cad. No:8 Kemalpaşa-İZMİR. During the processing and protection of personal data; The provisions of the relevant legislation in force will be applied as a priority.
Within this framework, the main purpose of this Personal Data Protection and Processing Policy ("Policy") is to set forth the rules, measures, duties and responsibilities within the scope of the personal data protection legislation adopted by our Company with a methodological approach and to ensure transparency in the measures we implement for the protection of personal data within this scope.
2. DEFINITIONS AND ABBREVIATIONS
The terms used in the implementation of this Policy express the meanings given below.
Employees: Refers to the employees of our Company.
Contact Person: The person responsible for monitoring the personal data processing activities within our Company and the implementation of the KVK Policies and Procedures on an individual basis.
Personal Data: Refers to any information related to an identified or identifiable natural person.
For example; name, surname, address, telephone number, date of birth, place of birth, eye color, T.R. identity number.
Personal Data Owner: The natural person whose personal data is processed. For example; employee, visitor, customer, Interested Person
Processing of Personal Data: Any operation performed on personal data by fully or partially automatic means or non-automatic means provided that it is part of any data recording system. For example; obtaining, recording, storing, changing, transferring.
KVK Law: Refers to the Law on the Protection of Personal Data No. 6698.
3. PRINCIPLES OF PROCESSING PERSONAL DATA
Our workplace processes personal data in accordance with the procedures and principles stipulated in the KVKK and other laws. The following principles are followed in the processing of personal data:
a) Being in compliance with the law and rules of honesty:
Our workplace processes personal data in accordance with the provisions of the legal legislation, the law and rules of honesty. It informs personal data owners.
b) Being accurate and up-to-date when necessary:
Our workplace takes the necessary measures to ensure that the personal data it processes is accurate and up-to-date.
c) Being processed for specific, clear and legitimate purposes:
Our workplace clearly and precisely determines the purpose of processing personal data that is legitimate and lawful. Our workplace processes personal data in connection with the service it provides and to the extent necessary for these.
ç) Being connected, limited and proportionate to the purpose for which they are processed:
Our workplace processes personal data to achieve the purposes determined within the scope of the service it provides, and avoids receiving, processing and storing personal data that is not necessary for the achievement of the purpose.
d) Storage for the period stipulated in the relevant legislation or required for the purpose for which they are processed:
Our workplace stores personal data in accordance with the provisions of the legal legislation. At the end of the period, personal data is deleted, anonymized or destroyed.
CONDITIONS FOR PROCESSING PERSONAL DATA:
Our workplace complies with the following conditions in line with the provisions of the KVKK No. 6698 while processing personal data:
(1) Personal data cannot be processed without the explicit consent of the relevant person.
Personal data can only be processed with the explicit consent of the data owner/relevant person. In this regard, patients are informed about the subject and their explicit consent based on free will is obtained.
(2) In the event of one of the following conditions, it is possible to process personal data without the explicit consent of the relevant person:
a) It is clearly stipulated in the laws.
b) It is necessary for the protection of the life or physical integrity of the person who is unable to express his/her consent due to a de facto impossibility or whose consent is not legally valid, or of another person.
c) If the processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of a contract.
ç) If it is necessary for the data controller to fulfill its legal obligation.
d) If it is made public by the relevant person.
e) If the data processing is necessary for the establishment, exercise or protection of a right.
f) If the data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person.
CONDITIONS FOR PROCESSING SPECIAL PERSONAL DATA
Our company complies with the regulations specified in the KVKK No. 6698 regarding the processing of special personal data.
KVKK defines “ARTICLE 6- (1) Data regarding the race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, appearance and dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures of individuals as special personal data”.
Processing of special personal data is prohibited. However, the processing of this data;
a) The explicit consent of the relevant person,
b) It is clearly provided for by law,
c) It is mandatory for the protection of the life or physical integrity of the person who is unable to express his/her consent due to a de facto impossibility or whose consent is not legally recognized, or of another person,
ç) It is in accordance with the will of the relevant person to make public the personal data he/she has made public,
d) It is mandatory for the establishment, exercise or protection of a right,
e) It is necessary for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of health services by persons or authorized institutions and organizations under the obligation of confidentiality,
f) It is mandatory for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance,
g) It is mandatory for the fulfillment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance of foundations, associations and other non-profit organizations or formations established for political, philosophical, religious or union purposes, provided that it complies with the legislation and purposes to which they are subject, is limited to their fields of activity and is not disclosed to third parties; It is possible if it is directed to current or former members and affiliates or to people who are in regular contact with these organizations and formations.
PERSONAL DATA COLLECTION AND PROCESSING METHODS
It processes personal data belonging to real persons in accordance with Articles 4, 5 and 6 of the Personal Data Protection Law and based on the Personal Data Processing Inventory, which must be prepared within the scope of Articles 5, 7, 9 and 10 of the Regulation and must include the following information.
THIRD PARTIES TO WHICH PERSONAL DATA IS TRANSFERRED BY OUR BUSINESS AND THE PURPOSES OF TRANSFER
Our company carefully complies with the conditions set forth in the KVKK regarding the sharing of personal data with third parties, without prejudice to the provisions of other laws. Within this framework, personal data is not transferred to third parties without the explicit consent of the data owner by BORATAŞ TUR.MAK.İNŞ.TAAH.SAN VE TİC LTD.ŞTİ., located at Bağyurdu Organized Industrial Zone Anadolu Cad. No:8 Kemalpaşa-İZMİR. However, if one of the following conditions regulated by the KVKK exists, personal data may be transferred by our workplace without obtaining the explicit consent of the data owner:
• It is clearly prescribed by the laws,
• It is mandatory for the protection of the life or physical integrity of the person who is unable to give his consent due to a de facto impossibility or whose consent is not legally valid, or of another person,
• It is necessary to process personal data belonging to the parties to the contract, provided that it is directly related to the establishment or performance of a contract,
• It is mandatory for the data controller to fulfill its legal obligation,
• It is made public by the data owner himself,
• Data processing is mandatory for the establishment, exercise or protection of a right,
• Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data owner. Provided that adequate measures are taken; Your personal data may be transferred without obtaining explicit consent for purposes such as the following:
• Protection of public health,
• Preventive medicine,
• Medical diagnosis,
• Execution of treatment and care services,
• Planning and management of health services and their financing. In the transfer of special personal data, the conditions specified in the processing conditions of this data are also complied with.
STORAGE OF PERSONAL DATA WITHIN THE SCOPE OF RELEVANT LEGISLATION
Our company's personal data is stored securely in a physical or electronic environment for an appropriate period of time in order to carry out the commercial activities of BORATAŞ TUR.MAK.İNŞ.TAAH.SAN VE TİC LTD.ŞTİ at Bağyurdu Organized Industrial Zone Anadolu Cad. No:8 Kemalpaşa-İZMİR in accordance with the provisions of the KVKK and other relevant laws. First of all, it examines whether there is a period for the storage of personal data and acts in accordance with this period. If there is no legal period, the required period is determined and personal data is stored in accordance with this period. When the period ends, personal data is deleted, destroyed, and anonymized.
However, in cases where the data controller has a legitimate interest, personal data may be stored until the end of the general limitation period (ten years) regulated in the Code of Obligations, despite the expiration of the purpose of processing and the periods specified in the relevant laws, provided that it does not harm the fundamental rights and freedoms of the data owners.
In this context, we provide the necessary training to the relevant units within our workplace and raise awareness.
MEASURES TAKEN FOR DATA SECURITY
BORATAŞ TUR.MAK.İNŞ.TAAH.SAN VE TİC LTD.ŞTİ. located at Bağyurdu Organize Sanayi Bölgesi Anadolu Cad. No:8 Kemalpaşa-İZMİR takes all necessary technical and administrative measures to ensure the appropriate security level required for the protection of personal data.
The measures stipulated in Article 12(1) of the KVKK are as follows:
• To prevent the unlawful processing of personal data,
• To prevent unlawful access to personal data,
• To ensure the preservation of personal data.
The measures taken by our company in this context are listed below:
Administrative Measures
• Our Company conducts the necessary inspections to ensure the implementation of the provisions of the Law.
• In the event that the processed personal data is obtained by others through illegal means, our Company notifies the relevant person and the Board as soon as possible.
• Regarding the sharing of personal data, it signs a framework agreement with the persons with whom personal data is shared or ensures data security with the provisions it will add to the agreements.
• It employs personnel who are knowledgeable and experienced in the processing of personal data and provides the necessary KVK training to its personnel.
Technical Measures
• Our company employs knowledgeable and experienced people to ensure data security and provides its personnel with the necessary KVK training.
• It carries out the necessary internal controls within the scope of the established systems.
• It ensures that the technical infrastructure that will prevent and/or monitor the leakage of personal data outside the institution is provided and the relevant matrices are created.
RIGHTS OF PERSONAL DATA OWNERS PURSUANT TO ARTICLE 11 OF THE KVKK:
Personal data owners may apply to our Company's address within the framework of Article 11 of the Law on the Protection of Personal Data No. 6698 (KVKK); a- To learn whether personal data is processed,
b- To request information if personal data has been processed,
c- To learn the purpose of processing personal data and whether they are used in accordance with the purpose,
ç- To know the third parties to whom personal data is transferred domestically or abroad,
d- To request correction of personal data if it is processed incompletely or incorrectly,
e- To request deletion or destruction of personal data in accordance with the provisions of the KVKK and other relevant legislation,
f- To request notification of these operations to third parties to whom personal data is transferred in the event that your personal data is corrected, deleted or destroyed,
g- To object to a result that is against you as a result of the analysis of your processed personal data exclusively through automated systems,
ğ- To request compensation for the damages incurred due to the unlawful processing of personal data.
We would like to inform you that we continue our activities with the awareness that personal data security is at the forefront in all the products and services we offer to you.