ÜNALLAR METAL İNŞAAT SANAYİ VE TİCARET ANONİM ŞİRKETİ
PROTECTION AND PROCESSING OF PERSONAL DATA POLICY
ÜNALLAR METAL İNŞAAT SANAYİ VE TİCARET ANONİM ŞİRKETİ
PERSONAL DATA STORAGE AND DESTRUCTION POLICY INFORMATION FORM
Document Name:
Ünallar Metal İnşaat Sanayi ve Ticaret Anonim Şirketi Personal Data Storage and Destruction Policy
Target Group:
All natural persons whose personal data are processed by Ünallar Metal İnşaat Sanayi ve Ticaret Anonim Şirketi
Prepared by:
Ünallar Metal İnşaat Sanayi ve Ticaret Anonim Şirketi Personal Data Protection Compliance Officer
Version:
2.0
Approved by:
Ünallar Metal İnşaat Sanayi ve Ticaret Anonim Şirketi Board of Directors
Effective Date:
20/02/2023
The Policy has been prepared in Turkish language and in case of translation into any other language, if there is a discrepancy between the translation and the Turkish text, the Turkish text should be taken into consideration.
CONTENTS
SECTION 1 1 – INTRODUCTION
1.1. INTRODUCTION
1.2. SCOPE
1.3. IMPLEMENTATION OF THE POLICY AND THE RELEVANT LEGISLATION
1.4. EFFECTIVENESS OF THE POLICY
SECTION 2 2 – ISSUES REGARDING THE PROTECTION OF PERSONAL DATA
2.1. ENSURING THE SECURITY OF PERSONAL DATA
2.2. PROTECTION OF PERSONAL DATA OF SPECIAL NATURE
2.3. RAISING AWARENESS AND SUPERVISION OF WORK UNITS ON THE PROTECTION AND PROCESSING OF PERSONAL DATA
SECTION 3 3 – ISSUES REGARDING THE PROCESSING OF PERSONAL DATA
3.1. PROCESSING OF PERSONAL DATA IN COMPLIANCE WITH THE PRINCIPLES STIPULATED IN THE LEGISLATION
3.2. CONDITIONS OF PROCESSING PERSONAL DATA
3.3. PROCESSING OF SENSITIVE PERSONAL DATA
3.4. CLARIFICATION OF THE PERSONAL DATA OWNER
3.5. TRANSFER OF PERSONAL DATA
SECTION 4 4 – CATEGORIZATION OF PERSONAL DATA PROCESSED BY OUR COMPANY AND PURPOSES OF PROCESSING
SECTION 5 5 – STORAGE AND DESTRUCTION OF PERSONAL DATA
SECTION 6 6 – SPECIAL CONDITIONS FOR THE PROCESSING OF PERSONAL DATA OF COMPANY EMPLOYEES
6.1. PROCESSING OF YOUR PERSONAL DATA FOR THE PURPOSE OF PROVIDING FRINGE BENEFITS AND INTERESTS
6.2. PROCESSING OF YOUR PERSONAL DATA WITHIN THE SCOPE OF ENSURING EQUAL OPPORTUNITIES
6.3. PROCESSING OF YOUR PERSONAL DATA TO COMBAT IRREGULARITIES
6.4. PROCESSING OF YOUR PERSONAL DATA FOR REFERENCE
6.5. PROCESSING OF YOUR PERSONAL DATA IN COMPANY MERGERS AND ACQUISITIONS AND OTHER TRANSACTIONS THAT CHANGE THE COMPANY STRUCTURE
6.6. PROCESSING OF YOUR PERSONAL DATA IN DISCIPLINARY PROCEEDINGS AND AUDIT PROCESSES
6.7. SEPARATE STORAGE OF HEALTH DATA AND PERSONS AUTHORISED TO PROCESS HEALTH DATA
6.8. PROCESSING OF PERSONAL DATA REGARDING THE USE OF ELECTRONIC COMMUNICATION TOOLS
6.9. PROCESSING OF PERSONAL DATA REGARDING SECURITY CAMERA APPLICATION
6.10. PROCESSING OF PERSONAL DATA REGARDING INTERNET USE
6.11. PROCESSING OF PERSONAL DATA REGARDING THE VEHICLES ALLOCATED BY THE COMPANY
6.12. PROCESSING OF PERSONAL DATA WITHIN THE SCOPE OF REQUESTING INFORMATION ABOUT EMPLOYEES FROM THIRD PARTIES
SECTION 7 7 – RIGHTS OF PERSONAL DATA HOLDERS AND EXERCISE OF THESE RIGHTS
7.1. RIGHTS OF THE PERSONAL DATA HOLDER
7.2. EXERCISE OF RIGHTS BY THE PERSONAL DATA HOLDER
7.3. RESPONSE BY OUR COMPANY TO APPLICATIONS
ANNEX 1 – Personal Data Holders
SECTION 1 1 – INTRODUCTION
1.1. INTRODUCTION
Processing and ensuring the security of personal data in compliance with the regulations in the relevant legislation, thus disciplining the processing of personal data is among the priorities of Ünallar Metal İnşaat Sanayi ve Ticaret Anonim Şirketi (“Company”). Within the framework of this Ünallar Metal İnşaat Sanayi ve Ticaret Anonim Şirketi Personal Data Protection and Processing Policy (“Policy”), the principles that are adopted by our Company in the execution of personal data processing activities carried out by our Company and the basic principles adopted in terms of the compliance of our Company’s data processing activities with the regulations in the Personal Data Protection Law No. 6698 (“Law”) and the relevant secondary legislation are explained and thus, our Company provides the necessary transparency by informing the personal data holders.
1.2.c
This Policy is related to all personal data of our Company’s employees and other natural persons, which are processed by completely or partially automatic methods within the scope of our Company’s activities or by non-automatic methods provided that they are part of any data recording system. Detailed information regarding the said personal data holders is provided in the annex of this Policy. (“ANNEX 1: Personal Data Holders”)
1.3. IMPLEMENTATION OF THE POLICY AND THE RELEVANT LEGISLATION
In the processing and protection of personal data, firstly the relevant effective regulations shall be complied with. In the event that there is an incompatibility between the effective legislation and policy, the regulations in the effective legislation shall apply. This Policy regulates and embodies the Company’s practices in compliance with the procedures and principles in the relevant legislation.
1.4. EFFECTIVENESS OF THE POLICY
This Policy, prepared by our Company and entered into force on 25/10/2019, was updated on 20 February 2023 and the updated version entered into force on the same date. In the event that all or specific articles of the Policy are updated, the effective date of the Policy will also be updated. The Policy is published on our Company’s website at https://unallarmetal.com/en/protection-of-personal-data/kvkk-policy/ and made available to the relevant persons upon the request of the personal data holders.
SECTION 2 2 – ISSUES REGARDING THE PROTECTION OF PERSONAL DATA
2.1. ENSURING THE SECURITY OF PERSONAL DATA
In accordance with Article 12 of the Law, our company takes the necessary measures according to the nature of the data to be protected in order to prevent the unlawful disclosure, access, transfer or security deficiencies that may occur in other ways. Within this scope, our Company takes technical and administrative measures to ensure the necessary security level in compliance with the guidelines published by the Personal Data Protection Board (“Board”) and the Board’s Decisions.
2.2. PROTECTION OF PERSONAL DATA OF SPECIAL NATURE
Special importance has been attached to the sensitive personal data within the scope of the Law due to the risk of causing victimization or discrimination of the persons when processed unlawfully. These personal data of “special nature” are are data related to race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance, membership of associations, foundations or trade unions, data on health and sexual life, criminal convictions and security measures, and biometric and genetic data.
Within this scope, the technical and administrative measures taken by our Company for the protection of personal data are diligently implemented and necessary audits are performed within our company.
Detailed information regarding the processing of personal data of special nature is provided in section 3.3. of this Policy.
2.3. 2.3. RAISING AWARENESS AND SUPERVISION OF WORK UNITS ON THE PROTECTION AND PROCESSING OF PERSONAL DATA
Necessary training is organized within the Company for raising awareness to prevent the unlawful processing of personal data, and unlawful access to data and to ensure the safe storage of data.
Necessary measures are taken to create awareness of our personnel on the protection of personal data, and consultancy services are received on the subject when necessary. Our Company evaluates the attendance to the relevant training and information meetings and organizes new training in parallel with the update of the relevant legislation.
SECTION 3 3 – ISSUES REGARDING THE PROCESSING OF PERSONAL DATA
3.1. PROCESSING OF PERSONAL DATA IN COMPLIANCE WITH THE PRINCIPLES STIPULATED IN THE LEGISLATION
3.1.1 Processing in Compliance with Law and Good Faith
Personal data are processed in compliance with the general rule of trust and honesty in accordance with the relevant legislation so as not to harm the fundamental rights and freedoms of individuals and not to cause their victimization. Within this framework, personal data are processed to the extent required by the work activities of our Company, in accordance with its
3.1.2. Ensuring that Personal Data is Accurate and Up-to-Date When Necessary
Our Company takes the necessary measures to ensure that personal data is accurate and up-to-date during the period of processing and makes notifications regarding the accuracy and up-to-dateness of personal data for specific periods of time.
3.1.3. Processing for Specific, Explicit and Legitimate Purposes
Our Company clearly presents the purposes of processing personal data and processes them in compliance with the relevant purposes within the framework of the execution of work activities.
3.1.4. Being Relevant, Limited and Proportionate to the Processing Purpose
Our company collects personal data only to the extent and quality necessary for the performance of work activities and processes them limited to the specified purposes.
3.1.5. Storing Personal Data for the Period Stipulated in the Relevant Legislation or Required for the Processing Purpose
Our company stores personal data for the period necessary for the processing purpose and the minimum period stipulated in the relevant legislation. Within this scope, firstly, our Company determines whether a period is stipulated for the storage of personal data in the relevant legal regulations to which the activity is subject, and if a legal period is stipulated, our Company acts in compliance with this period. If there is no legal period, personal data is stored for the period necessary for the processing purpose. Personal data are destroyed at the end of the specified storage periods in compliance with the periodic destruction periods or data holder requests and with the specified destruction methods (erasure, destruction or anonymization).
3.2. CONDITIONS OF PROCESSING PERSONAL DATA
Our Company conducts data processing activities based on the presence of one or more of the conditions specified in articles (ii) to (viii) below. In the event that said conditions are not present, personal data processing activity is conducted depending on the explicit consent of the data holder. In the event that processed data are personal data of special nature, conditions in Section 3.3 (Processing of Personal Data of Special Nature”) of this Policy shall apply.
(i) Presence of Explicit Consent of the Personal Data Holder
One of the processing conditions of personal data is the explicit consent of the data holder. The explicit consent of the personal data holder must be related to a specific subject, based on the information and with free will.
In the event of the existence of the following personal data processing conditions, personal data may be processed without the explicit consent of the data owner.
(ii) expressly stipulated in the law
If the personal data of the data owner is clearly stipulated in the law, in other words, if there is a clear provision regarding the processing of personal data in the relevant law, the existence of this data processing requirement may be mentioned.
(iii) Failure to Obtain the Explicit Consent of the Person Concerned Due to Actual Impossibility
In the event that the processing of personal data is necessary in order to protect the life or bodily integrity of the person or another person, who is unable to express his/her consent due to actual impossibility or whose consent cannot be validated, personal data of the data owner can be processed.
(iv) In case it is directly related to the establishment or performance of the contract
Provided that it is directly related to the conclusion or performance of a contract to which the data owner is a party, this condition may be deemed to be fulfilled if the processing of personal data is necessary.
(v) Fulfilling its legal obligation by the company
If the processing is mandatory for our company to fulfill its legal obligations, the personal data of the data owner may be processed.
(vi) Publicization of the Personal Data of the Personal Data Owner
If the data owner has made his personal data public, the relevant personal data may be processed on a limited basis for the purpose of making it public.
(vii) Mandatory Data Processing for the Establishment or Protection of a Right
If data processing is mandatory for the establishment, exercise or protection of a right, the personal data of the data owner may be processed.
(viii) Mandatory Data Processing for the Legitimate Interest of Our Company
Provided that the fundamental rights and freedoms of the personal data owner are not harmed, the personal data of the data owner may be processed if the data processing is mandatory for the legitimate interests of our Company.
3.3. PROCESSING OF SENSITIVE PERSONAL DATA
Sensitive personal data are processed by our Company in accordance with the principles set out in this Policy and by taking all necessary administrative and technical measures, including the methods to be determined by the Board, and subject to the following conditions:
(i) Sensitive personal data other than health and sexual life may be processed without the explicit consent of the data owner, provided that it is expressly stipulated in the law, in other words, there is a clear provision in the relevant law regarding the processing of personal data. Otherwise, the explicit consent of the data owner will be obtained.
(ii) Special categories of personal data regarding health and sexual life may be processed, without explicit consent, by persons or authorized institutions and organizations that are under the obligation to keep secrets, for the purpose of protecting public health, conducting preventive medicine, medical diagnosis, treatment and care services, planning and managing health services and financing. Otherwise, the explicit consent of the data owner will be obtained.
3.4. CLARIFICATION OF THE PERSONAL DATA OWNER
In accordance with Article 10 of the Law and secondary legislation, our company informs the personal data owners about who, as the data controller, and for what purposes their personal data is processed, for what purposes they are shared, with which methods and for which legal reason they are collected, and what rights they have within the scope of the processing of their personal data.
3.5. TRANSFER OF PERSONAL DATA
Our company may transfer the personal data and sensitive personal data of the personal data owner to third parties (third party legal and natural persons) by taking the necessary security measures in line with the lawful and legitimate personal data processing purposes. Accordingly, our company acts in accordance with the regulations stipulated in Articles 8 and 9 of the Law. You can get detailed information about this subject from the table “Third Parties to which Personal Data Transferred by Our Company and Purposes of Transfer” contained in Article 3.5.3 of this Policy.
3.5.1. Transfer of Personal Data
Even without the explicit consent of the personal data owner, in case one or more of the conditions stated below are present, personal data may be transferred to third parties by taking all necessary security measures, including the methods prescribed by the Board, with due care by our Company.
Personal data may be transferred to foreign countries declared to have adequate protection by the Board (“Foreign Country with Sufficient Protection”) in the presence of any of the following conditions: The relevant activities regarding the transfer of personal data are clearly stipulated in the laws,
The transfer of personal data by the Company is directly related to and necessary for the establishment or performance of a contract,
The transfer of personal data is mandatory for our Company to fulfill its legal obligation,
Transferring personal data by our Company in a limited manner for the purpose of making it public, provided that the personal data has been made public by the data owner,
The transfer of personal data by the Company is mandatory for the establishment, exercise or protection of the rights of the Company or the data owner or third parties,
It is mandatory to carry out personal data transfer activities for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the data owner,
It is compulsory for the person or someone else, who is unable to express his consent due to actual impossibility, or whose consent is not legally valid, to protect his or her life or physical integrity,
In case the parties to which data is transferred are abroad.
In the absence of sufficient protection, it can be transferred to foreign countries where the data controllers in Turkey and the relevant foreign country undertake an adequate protection in writing in line with the data transfer
conditions stipulated in the legislation and where the Board has the permission (“Foreign country where the data controller is committed to adequate protection”).
3.5.2. Transfer of sensitive personal data
Sensitive personal data are processed by our Company in accordance with the principles set out in this Policy and by taking all necessary administrative and technical measures, including the methods to be determined by the Board, and in the presence of the following conditions:
(i) Sensitive personal data other than health and sexual life may be processed without the explicit consent of the data owner, provided that it is expressly stipulated in the law, in other words, there is a clear provision in the relevant law regarding the processing of personal data. Otherwise, the explicit consent of the data owner will be obtained.
(ii) Special categories of personal data regarding health and sexual life may be processed, without explicit consent, by persons or authorized institutions and organizations that are under the obligation to keep secrets, for the purpose of protecting public health, conducting preventive medicine, medical diagnosis, treatment and care services, planning and managing health services and financing. Otherwise, the explicit consent of the data owner will be obtained.
In the case of transferring personal data to foreign countries, personal data may be transferred in the foreign country where the data controller is committed to adequate protection, provided that any of the above conditions exist. In the absence of sufficient protection, in line with the data transfer conditions stipulated in the legislation, it can be transferred to foreign countries where the data controller is committed to adequate protection.
3.5.3. Third parties to whom personal data is transferred by our company and the purposes for which personal data is transferred
Our company may transfer the personal data of customers to the following categories of persons in accordance with Articles 8 and 9 of the Law:
- Business Partners
- Suppliers
- Legally Authorized Private Legal Persons
- Public Institutions and Organizations Authorized by Law
The scope of the above-mentioned persons to whom the transfer is made and the data transfer purposes are stated below.
People to whom data can be transferred | Definition | Purpose of Data Transfer |
Business Partner | Parties providing subcontractor services, Parties providing services in communication and event activities | Limited to ensure the fulfillment of the purposes for which the business partnership was established |
Supplier | Parties providing services to our Company, in line with our Company’s data processing purposes and instructions, within the scope of the execution of our company’s commercial activities (Parties providing hosting, maintenance and support services to Digital Systems, Parties providing training services within the scope of Occupational Health and Safety processes, Meta Inc., which provides social media accounts service abroad within the scope of communication activities, and Google LLc, which provides the website cookie service) | Limited to ensure the provision of services that are outsourced by our company from the supplier and necessary to carry out the commercial activities of our company. |
Public Institutions and Organizations Authorized by Law | Public institutions and organizations authorized to receive information and documents from our Company in accordance with the provisions of the relevant legislation For example; Judicial authorities, Tax Offices, Enforcement offices, Social Security Institution, Işkur, the Ministry of Health | Limited to the purposes requested by the relevant public institutions and organizations within their legal authority |
Legally Authorized Private Legal Persons | It means the institutions or organizations that have been established in accordance with certain conditions determined by law in accordance with the provisions of the relevant legislation and continue their activities within the framework determined by the law (For example; independent auditors, lawyers, notaries, banks, insurance companies, OSGB (Joint Health and Safety Unit)) | Personal data is shared on a limited basis related to the issues within the scope of the activities carried out by the relevant private institutions and organizations. |
SECTION 4 4 – CATEGORIZATION OF PERSONAL DATA PROCESSED BY OUR COMPANY AND PURPOSES OF PROCESSING
Our company processes personal data in accordance with the general principles set forth in the Law, primarily the principles set forth in article 4 of the Law on the processing of personal data, based on and limited to at least one of the personal data processing conditions specified in articles 5 and 6 of the Law, in line with the personal data processing purposes of our Company, by informing the relevant persons in accordance with Article 10 of the Law and secondary legislation. Within the framework of the purposes and conditions specified in this Policy, detailed information about the personal data categories and categories and information about the personal data processing purposes are given in the tables below.
Categories of Personal Data Processed by Our Company
PERSONAL DATA CATEGORIES | EXPLANATION |
ID Information | Data that contains information about the identity of the person; name-surname, T.R. identity number, place of birth, date of birth, gender, workplace information, vehicle license plate/model, military status, customer number, body information, title, etc. and documents such as driver’s license, professional identity card and passport |
Contact Details | Information of telephone number, address, e-mail address, fax number, etc. |
Personnel Information | All kinds of personal data processed for obtaining information that will form the basis for the personal rights of natural persons who are in a working relationship with the company (including CV Information) |
Family Members and Close Relatives Information | Information obtained and processed about the family members and relatives of these persons within the framework of activities carried out by the business units of the Company or in order to protect the legal interests of the Company and employees. |
Physical Location Security Information | Personal data regarding the records and documents taken at the entrance to the physical space, during the stay in the physical space; camera recordings, recordings taken at the security point, etc. |
Process Security Information | Your personal data processed to ensure our technical, administrative, legal and commercial security during the execution of our activities (for example, device IDs, system and application user account information, IP information, authentication information, data such as internet access records) |
Financial Information | Personal data processed for information, documents and records showing all kinds of financial results created according to the type of legal relationship our company has established with the personal data owner and data such as bank account number, IBAN number, debit/credit information, wage information, overtime, expense/per diem information, severance pay information |
Employee Candidate Information | Personal data processed related to individuals who have applied to become an employee of our Company or who have been evaluated as an employee candidate in accordance with the human resources needs of our company in accordance with commercial practice and honesty rules, or who are in a working relationship with our Company |
Health Data-Sensitive Personal Data | Health data such as examination results, blood type, accident report, disability/death information processed within the scope of personal and occupational health and safety processes |
Data Related to Criminal Convictions and Security Measures – Sensitive Personal Data | Data on the criminal record information of employees |
Request/Complaint Information | Personal data related to the receipt and evaluation of all kinds of requests or complaints directed to our Company |
Occupational Experience Information | Data such as educational status, foreign language knowledge, title, work experience information processed during the employment of employees |
Visual Audial Data | Photos and camera recordings (except for recordings entered within the scope of Physical Space Security Information) |
Legal Action and Alignment Information | Tracking of legal transactions, tracking and fulfillment of our receivables and debts, as well as fulfillment of our legal obligations, personal data processed within the scope of dispute resolution (including signature, traffic ticket information, enforcement, salary seizure, child support information) |
Process Information | Data such as cookie records, travel information, and shift information within the scope of work activities of our Company |
Performance and Career Development Information | Data such as assignment/promotion, performance evaluation information processed for the purpose of tracking the performance and career development of employees during their employment |
Location Information | Data such as GPS records processed within the scope of activities to ensure the legal and commercial security of our company’s activities |
Client Process Information | Data such as every kind of instruction received from its clients and order status of clients within the scope of our Company |
Personal Data Processing Purposes
PROCESSING PURPOSES |
Conducting personnel recruitment processes |
Planning and execution of employees’ right to access information |
Fulfillment of obligations arising from employment contracts and/or legislation for company employees |
Planning the wage increases of the employees, |
Wage Management |
Planning and Monitoring of Employee Performance Evaluation Processes |
Planning and Execution of Personnel Dismissal Procedures |
Planning and execution of occupational health and/or safety processes |
Monitoring and/or supervision of working activities of the employees |
Planning, supervision and execution of information security processes |
Planning and/or Execution of Activities for Ensuring Business Continuity |
Tracking of finance and accounting affairs |
Execution of the Purchase Processes of Goods / Services, |
Planning and Execution of Sales Processes of Products and/or Services |
Execution of Storage and Archive Activities |
Planning and Execution of the Operational Activities Required for the Ensuring that the Company Activities are carried out in accordance with Company Procedures and/or Related Legislation |
Providing information to authorized organizations based on legislation |
Execution of Corporate and Partnership Law Transactions |
Tracking and execution of legal proceedings |
Tracking of Contract Processes and/or Legal Requests |
Planning and Execution of Corporate Communication Activities |
Activitiy Management |
Ensuring the Security of Company Operations |
Creation and Tracking of Visitor Records |
Ensuring the Security of Company Fixtures and/or Resources |
Ensuring the Security of Company Campuses and/or Facilities |
SECTION 5 5 – STORAGE AND DESTRUCTION OF PERSONAL DATA
Our Company stores personal data for the period necessary for the purpose for which they are processed and for the limited period stipulated in the relevant legal legislation. In this context, our Company firstly determines whether a period of time is stipulated for the storage of personal data in the relevant legislation and acts in accordance with this period if a period of time is determined. If there is no legal period, personal data are stored for the period necessary for the purpose for which they are processed. Personal data are destroyed at the end of the specified storage periods in accordance with the periodic destruction periods or the application of the data owner and with the determined destruction methods (deletion and/ or destruction and/ or anonymization).
SECTION 6 6 – SPECIAL CONDITIONS FOR THE PROCESSING OF PERSONAL DATA OF COMPANY EMPLOYEES
6.1. PROCESSING OF YOUR PERSONAL DATA FOR THE PURPOSE OF PROVIDING FRINGE BENEFITS AND INTERESTS
While transferring employee data to third party business partners and/or suppliers, from which fringe rights and benefits will be provided by our company within the scope of personal data processing activities aimed at providing fringe benefits to employees, no more personal data is shared than the minimum level required for the benefit to be provided to the employee, in accordance with the data minimization principle. In addition, measures are taken to prevent the processing of the shared personal data by these persons for other purposes. If the shared personal data is a sensitive personal data, the measures applied about this type of personal data are taken.
6.2. 6.2. PROCESSING OF YOUR PERSONAL DATA WITHIN THE SCOPE OF ENSURING EQUAL OPPORTUNITIES
While processing personal data of employees, our company acts with the principle of preventing discrimination among employees due to differences such as race, ethnicity, religion, sect, disability and sexual preferences, and ensuring equality of opportunity among all employees.
6.3. PROCESSING OF YOUR PERSONAL DATA TO COMBAT IRREGULARITIES
Personal data sets in different units may be compared in order to prevent irregular processes that may occur within the company. In this context, any process, especially the financial transactions of the employees, may be controlled and the personal data sets in different units related to these may be examined or compared. If, as a result of the preliminary examination, there is a doubt about the existence of a serious irregularity, the personal data related to this transaction may be examined by third parties who are experts on the subject.
6.4. PROCESSING OF YOUR PERSONAL DATA FOR REFERENCE
Employees can be referred to the necessary issues such as work and education. In this context, the unit manager to which each employee is connected and the managers at the lower level, if any, may be a reference to that employee. In order for a manager to be a reference to any employee, that manager must agree to be a reference to the relevant employee.
If a reference is provided, the employee’s identity information, performance at the workplace, information about the employee’s personal characteristics and qualifications may be processed. In addition, the information requested by the employee by giving his explicit consent and deemed appropriate by the person who will be the reference, the information requested by the person requesting the reference may also be processed. A confidential reference about himself (a form of reference in which the employee cannot see the content of the reference) may not be given unless the employee explicitly gives consent.
6.5. PROCESSING OF YOUR PERSONAL DATA IN COMPANY MERGERS AND ACQUISITIONS AND OTHER TRANSACTIONS THAT CHANGE THE COMPANY STRUCTURE
Company mergers and acquisitions and other transactions that change the company structure will be referred to as “Change of the company’s legal form ” under this section. During the company form change process, personal data is shared by anonymizing as much as possible.
In the event that personal data that cannot be anonymized needs to be shared within the scope of procedures on the Change of the company’s legal form, the parties to whom this data is shared are provided to undertake to provide data security measures, particularly the following:
that the Company will use this personal data only limited to the form change operations,
that the personal data will be treated in accordance with confidentiality rules,
that the personal data will not be transferred to third parties unless there is a separate legal reason or it is mandatory.
6.6. PROCESSING OF YOUR PERSONAL DATA IN DISCIPLINARY PROCEEDINGS AND AUDIT PROCESSES
Only as much personal data as required by the process is processed within the scope of our company’s audit processes and disciplinary investigations regarding employees. Necessary efforts are made to control the accuracy and up-to-dateness of personal data, and necessary actions are taken in this context, provided that the effectiveness of the investigation and audit is not significantly impaired.
6.7. SEPARATE STORAGE OF HEALTH DATA AND PERSONS AUTHORISED TO PROCESS HEALTH DATA
Health data is stored separately from other personal data in order to protect against unauthorized access and provide higher security to the extent possible by the Company. The company takes care to process health data in the narrowest possible scope. In cases where health data needs to be processed, information is provided so that the persons authorized to perform this processing understand the sensitivity of this data and take the necessary precautions. In this context, administrative and technical measures set forth by the Board are taken.
6.8. PROCESSING OF PERSONAL DATA REGARDING THE USE OF ELECTRONIC COMMUNICATION TOOLS
Employee data regarding the use of mobile phones, laptop computers, tablets and similar electronic communication tools that have been provided or may be provided by the Company to the employee may be processed within the framework of this Policy. Communication devices provided to employees by the Company should be used only for business requirements and should not be used for personal purposes. The personal data obtained regarding the use of electronic communication tools for personal purposes will be deleted in accordance with the provisions contained in this Policy.
Care is taken to use personal data regarding the communication made over the company phone, the numbers made and the duration of the communication limited only for the purpose for which they are processed. In the processing of personal data obtained through the employee’s corporate e-mail account by the Company, all the provisions of this Policy shall be applicable.
6.9. PROCESSING OF PERSONAL DATA REGARDING SECURITY CAMERA APPLICATION
If personal data is obtained due to the use of camera recordings for security or similar purposes at work; your personal data obtained may be processed in the future for purposes such as investigating a suspicious transaction, resolving a dispute or using it as evidence in the event of a complaint, or for other purposes specified in this Policy.
6.10. PROCESSING OF PERSONAL DATA REGARDING INTERNET USE
Employees’ internet usage may be monitored by the Company in order to ensure and control compliance with the Company’s relevant policies and procedures. In the event that personal data is obtained in this context; the provisions contained in this Policy regarding the personal data obtained will be applied.
6.11. PROCESSING OF PERSONAL DATA REGARDING THE VEHICLES ALLOCATED BY THE COMPANY
In order to ensure and control the compliance with the relevant policies and procedures of the Company, the vehicles allocated to the Employees by the Company or that may be in the future may be tracked. In the event that personal data is obtained in this context; the provisions contained in this Policy regarding the personal data obtained will be applied.
6.12. PROCESSING OF PERSONAL DATA WITHIN THE SCOPE OF REQUESTING INFORMATION ABOUT EMPLOYEES FROM THIRD PARTIES
In certain cases, information about Employees may be requested from third parties. These third parties may be banks, credit rating agencies and similar research companies. If there is an application in this direction, the provisions contained in this Policy regarding the processed personal data will be applied.
SECTION 7 7 – RIGHTS OF PERSONAL DATA HOLDERS AND EXERCISE OF THESE RIGHTS
7.1. RIGHTS OF THE PERSONAL DATA HOLDER
Personal data holders have the following rights:
Learn if the personal data is processed or not;
Demand information if the personal data is processed with regards to this;
Learn the purpose of personal data processing and whether they are used relevant to their purpose;
Know the third parties to whom the personal data information is transferred both abroad and at home;
In the event that personal data is processed incompletely or incorrectly, demanding a correction and requesting that the procedure carried out within this scope is communicated to the third persons to whom the personal data is transferred;
Requesting the deletion or destruction of personal data in the event that the reasons requiring its processing cease to exist despite the fact that it has been processed in accordance with the provisions of the law and other relevant laws, and requesting the notification of the transaction made within this scope to the third parties to whom the personal data has been transferred,
Objecting to the occurrence of a result against the person himself by analyzing the processed data exclusively through automated systems,
Requesting the compensation of the damage in case of damage due to unlawful processing of personal data.
7.2. EXERCISE OF RIGHTS BY THE PERSONAL DATA HOLDER
Personal data holders will be able to convey their requests to our Company regarding the rights stated in section 7.1. (“Rights of Personal Data Holders”) using the methods determined by the Board. Accordingly, they will be able to utilize the “Ünallar Metal İnşaat Sanayi ve Ticaret A.Ş. Data Holder Application Form” that can be accessed from https://unallarmetal.com/wp-content/uploads/2023/01/KVK-BasvuruFormu.pdf address.
7.3. RESPONSE BY OUR COMPANY TO APPLICATIONS
Our Company takes all necessary administrative and technical measures to resolve the applications made by personal data holders in accordance with the Law and secondary legislation.
In the event that the personal data holder duly conveys their request regarding the rights included in section 7.1. (“Rights of Personal Data Holders”), our Company will finalize the said request free of charge, in the shortest duration possible and 30 (thirty) days at the latest depending on the nature of the request. However, if the process requires an additional cost, an amount may be charged per the tariff determined by the Board.
ANNEX 1 – Personal Data Holders
ANNEX 1 – Personal Data Holders
CATEGORIES OF PERSONAL DATA HOLDERS | EXPLANATION |
Person Receiving the Product or Service | Natural persons who procure products or services from our Company regardless of whether they have a contractual relationship with our Company or not |
Visitor | Natural persons who enter the physical premises of our Company or visit our websites |
Employee | Natural persons who have a work relationship with our Company within the coverage of a contract of employment |
Employee Candidate | Natural persons who applied for a job through any method or disclosed their Curriculum Vitae and relevant information to review by our Company (including intern candidates) |
Company Official | A board of directors member of our Company and other authorized natural persons |
Employees, Shareholders and Officials from Institutions we Cooperate with | Natural persons who work for institutions with which our Company has any business relationship (including but not limited to business partners, suppliers, and sub-employer), including shareholders and officials of these institutions |
Shareholder | Natural person partners of the company |
Party to Legal Proceedings | Natural persons (ex-employee, etc.) who are parties to the legal proceedings carried out by the company |
Participant | Natural persons who attend events organized by the company |