This is an English translation provided for convenience. In the event of any discrepancy, the Turkish version of this document prevails.
PERSONAL DATA PROTECTION LAW INFORMATION NOTICE
As ÜRMAKSAN MAKİNA İNŞAAT TAAHHÜT SANAYİ TİCARET LTD. ŞTİ., we treat the security of your personal data with the utmost care. With this awareness, we attach great importance to processing and storing every kind of personal data belonging to all persons connected with the Company in accordance with Law No. 6698 on the Protection of Personal Data (the “PDPL”). Fully aware of this responsibility, and in our capacity as “Data Controller” as defined under the PDPL, we process your personal data in the manner explained below and within the limits prescribed by legislation.
In this information notice:
- Personal Data: means any information relating to an identified or identifiable natural person;
- Law on the Protection of Personal Data (“PDPL”): means Law No. 6698 on the Protection of Personal Data, published in the Official Gazette and entered into force on 07.04.2016;
- Data Controller: means the natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system;
- Data Processor: means the natural or legal person who processes personal data on behalf of the Data Controller, based on the authority granted by the Data Controller.
Data Controller:
Pursuant to the PDPL, the personal data you share in your capacity as a counterparty, supplier, customer, employee, intern, visitor and similar will be handled within the scope set out below by ÜRMAKSAN, the legal entity designated as the data controller.
- Collection and Processing of Personal Data and Purposes of Processing
Although your personal data may vary depending on the relationship between you and our Company, it may be collected verbally, in writing or electronically by automated or non-automated means, through our Company’s departments, our website, social media channels, mobile applications and similar means. Your personal data may be created and processed on an updated basis for as long as your relationship with our Company continues.
The personal data collected will be processed in accordance with the conditions and purposes of processing personal data set out in Articles 5 and 6 of the PDPL, for the purposes of carrying out the work necessary for you to benefit from our Company’s services through the relevant business units, ensuring the legal and commercial security of our Company and of the persons who have a business relationship with our Company, determining and implementing our Company’s strategies, and ensuring the execution of our Company’s human resources policies, and will be processed in compliance with the following principles:
- lawfulness and fairness;
- being accurate and, where necessary, kept up to date;
- being processed for specified, explicit and legitimate purposes;
- being relevant, limited and proportionate to the purposes for which they are processed;
- being retained only for the period stipulated in the relevant legislation or required for the purpose of processing.
- To Whom and For Which Purposes Processed Personal Data May Be Transferred:
The personal data collected may be transferred to our business partners, our suppliers, and legally authorised public institutions and private persons, within the framework of the conditions and purposes of processing personal data set out in Article 8 of the PDPL, for the purposes of carrying out the work necessary for you to benefit from our Company’s services through the relevant business units, ensuring the legal and commercial security of our Company and of the persons who have a business relationship with our Company, determining and implementing our Company’s commercial and business strategies, and ensuring the execution of our Company’s human resources policies.
- Method and Legal Basis of Collecting Personal Data:
Your personal data is obtained verbally, in writing or by electronic means, for the purposes set out above, in order to enable our services to be provided and, in this context, to enable our Company to fulfil its contractual and statutory obligations completely and correctly. Personal data collected on this legal basis may also be processed and transferred for the purposes set out in paragraphs (1) and (2) of this notice, within the scope of the conditions and purposes of processing personal data set out in Articles 5 and 6 of the PDPL.
- Rights of the Data Subject Listed in Article 11 of the PDPL:
As data subjects, if you submit your requests concerning your rights to our Company using the methods set out below, our Company will conclude the request free of charge within no later than 30 days, depending on the nature of the request. However, if a fee is prescribed by the Personal Data Protection Board, the fee in the tariff determined by our Company will be charged. In this context, data subjects have the right to:
- learn whether their personal data is being processed;
- request information if their personal data has been processed;
- learn the purpose of processing their personal data and whether the data is used in accordance with that purpose;
- know the third parties in Turkey or abroad to whom their personal data has been transferred;
- request the rectification of their personal data if it has been processed incompletely or inaccurately;
- request the erasure or destruction of their personal data within the conditions set out in Article 7 of the PDPL;
- request notification of the third parties to whom the personal data has been transferred of the operations carried out pursuant to sub-paragraphs (e) and (f);
- object to an adverse outcome concerning them that arises from the analysis of processed data solely by automated systems;
- claim compensation for damages arising from the unlawful processing of their personal data.
Pursuant to Article 13(1) of the PDPL, you may submit your request concerning the exercise of the rights set out above to our Company in writing or by the other methods determined by the Personal Data Protection Board. Since the Personal Data Protection Board has not yet determined any other method, your application must be submitted to our Company in writing as required by the PDPL. The channels and procedures for submitting written applications to our Company under Article 11 of the PDPL are explained below.
In order to exercise the rights set out above, you must deliver your request — clearly and comprehensibly, containing the information necessary to identify you together with your explanations regarding the right listed in Article 11 of the PDPL that you wish to exercise, and enclosing documents establishing your identity and address details — in writing and with a wet-ink signature, in person, by post or through a notary public, to insankaynaklari@urmaksan.com or to the address Yeşiltepe Mah. Uluyol Cad. No:21 Erenler / SAKARYA.
ÜRMAKSAN CCTV PRIVACY NOTICE
INFORMATION NOTICE ON CAMERA RECORDINGS UNDER LAW NO. 6698 ON THE PROTECTION OF PERSONAL DATA
The personal data processing activities carried out by Ürmaksan Mak. San. Taah. Tic. Ltd. Şti. at building entrances and inside its facilities are conducted in accordance with the Constitution of the Republic of Turkey, the Law on the Protection of Personal Data (PDPL) and other relevant legislation.
Legal Basis of Camera Monitoring and Method of Collecting Personal Data
Video recording is carried out for the purpose of ensuring building security by means of a total of 55 security cameras located at the entrance doors inside Ürmaksan buildings, the garden, the building façade, the canteen, offices, the training hall and archive entrance, the visitor waiting area, the car park, the security booth, floor corridors and the production area. The recording process is supervised by the “Ürmaksan Personal Data Protection Committee”.
Conducting Security Camera Monitoring in Accordance with Personal Data Protection Law
Ürmaksan carries out security camera monitoring for the purpose of ensuring security in its buildings and production area, for the purposes prescribed in the applicable legislation and in accordance with the personal data processing conditions listed in the PDPL.
Announcement of Camera Monitoring
In accordance with Article 10 of the PDPL, the data subject is informed. In addition to the information it provides on general matters, Ürmaksan issues notices regarding camera monitoring through more than one method. The aim is to prevent harm to the fundamental rights and freedoms of the data subject and to ensure transparency and the proper informing of the data subject. To this end, Ürmaksan posts notice signs at the entrances to the areas where monitoring takes place.
Purpose and Processing of Camera Monitoring
In accordance with Article 4 of the PDPL, Ürmaksan processes personal data in a manner relevant, limited and proportionate to the purposes for which it is processed. The purpose of maintaining closed-circuit camera monitoring at Ürmaksan is limited to the purposes listed in this Policy. Accordingly, the monitoring areas, the number of security cameras and the times at which monitoring takes place are implemented so as to be sufficient for, and limited to, achieving the security objective. Areas where monitoring could constitute an intrusion into privacy beyond security purposes (for example, changing rooms, washbasins, toilets and similar) are not monitored.
Ensuring the Security of the Data Obtained
In accordance with Article 12 of the PDPL, Ürmaksan takes the necessary technical and administrative measures to ensure the security of the personal data obtained as a result of camera monitoring.
Retention Period of Personal Data Obtained Through Camera Monitoring
The retention period for personal data obtained by Ürmaksan through cameras is 15 days.
To Whom and For Which Purposes the Personal Data Obtained May Be Transferred
A limited number of employees have access to the information obtained as a result of monitoring. Camera footage may be transferred to authorised public institutions in accordance with legislation, for the purpose of ensuring the security of Ürmaksan’s sites and buildings, within the framework of the personal data processing conditions and purposes set out in Article 8 of the PDPL. The limited number of persons who have access to the recordings declare, by way of a confidentiality agreement, that they will protect the confidentiality of the data they access. The personal data in question may be transferred to judicial authorities or the relevant law enforcement agencies upon request, for the resolution of legal disputes or as required by the relevant legislation.