This is an English translation provided for convenience. In the event of any discrepancy, the Turkish version of this document prevails.
ÜRMAKSAN PERSONAL DATA PROTECTION AND PROCESSING POLICY — INFORMATION SHEET
Document Name:
ÜRMAKSAN MAKİNE İNŞAAT TAAHÜT SANAYİ VE TİCARET LİMİTED ŞTİ. — Personal Data Protection and Processing Policy.
Target Audience:
All natural persons whose personal data is processed by Ürmaksan.
Prepared by:
Ürmaksan Makine İnşaat Taahüt Sanayi ve Ticaret Limited Şti. Personal Data Protection Committee
Approved by:
Ürmaksan Makine İnşaat Taahüt Sanayi ve Ticaret Limited Şti. Board of Directors
Effective Date:
01/05/2024
1) PURPOSE
At Ürmaksan we are aware of our responsibility regarding the protection of personal data — a constitutional right — and its safeguarding by law, and we attach importance to the secure use of your personal data. The purpose of this policy is to set out the methods and principles to be followed in order to ensure that Ürmaksan processes and protects personal data in compliance with the Law on the Protection of Personal Data (PDPL), published in the Official Gazette dated 7 April 2016 and numbered 29677.
2) SCOPE
This policy applies to all activities carried out by Ürmaksan concerning the processing and protection of personal data. It covers all personal data processed in respect of our officers, the employees of our customers, suppliers, their partners and officers, the employees, shareholders and officers of the organisations with which we cooperate, and third parties. This policy is applied, together with the relevant detailed data procedures, in all activities carried out by Ürmaksan concerning the processing and protection of personal data. In this context, the purposes and principles governing the processing of personal data are explained in detail in the Ürmaksan Information Notice or in the procedures and explanations contained in the relevant applications. When interpreting this policy, it must be assessed together with the said Information Notice and the other procedures and documents regulating the processing of personal data. This document does not replace the Information Notice; it constitutes Ürmaksan’s general policy on personal data.
3) IMPLEMENTATION OF THE POLICY
Ürmaksan implements the requirements of the Ürmaksan network data protection policy through this policy or by other means. Ürmaksan also has separate policies that address data protection in relation to specific functions and business activities. This policy does not override the data protection requirements in Ürmaksan’s other policies where those requirements are set at, or at least meet, the same standards for the protection of personal data as this policy. Where this policy contains additional requirements or demands a higher standard for the protection of personal data, it overrides the data protection requirements in Ürmaksan’s other policies. In the process of processing and protecting personal data, the provisions of the applicable legislation in force shall apply as a matter of priority. In the event of a conflict between the provisions of legislation and the provisions of the policy, Ürmaksan accepts that the current provisions of legislation shall prevail. The policy has been created by structuring Ürmaksan’s practices in accordance with the rules laid down by the relevant legislation.
(1) The data controller is obliged to take all necessary technical and administrative measures to ensure an appropriate level of security in order to:
a) prevent the unlawful processing of personal data;
b) prevent unlawful access to personal data;
c) ensure the safekeeping of personal data.
4) MATTERS RELATING TO THE PROTECTION OF PERSONAL DATA
In line with the applicable laws and the decisions of the Ürmaksan Personal Data Protection Committee on information security, Ürmaksan informs data subjects about the use of their personal data. Ürmaksan carries out a risk analysis identifying what its personal data consists of and what risks may arise in relation to its protection, and pursuant to Article 12 of the PDPL takes the necessary technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of the personal data being processed, prevent unlawful access to personal data, and ensure the safekeeping of personal data. The principal measures taken are listed below.
- All activities carried out by Ürmaksan have been analysed in detail for each business unit and, as a result of this analysis, a process-based personal data processing inventory has been prepared. Risk areas in this inventory are identified and the necessary legal and technical measures are taken on an ongoing basis. (For example, the documents required to be prepared under the PDPL have been prepared taking into account the risks in this inventory.)
- The personal data processing activities carried out by Ürmaksan are audited through information security systems, technical systems and legal methods.
- Access rights are restricted and authorisations are reviewed regularly.
- The technical measures taken are reported regularly to the responsible officer; matters that pose a risk are reviewed again and work is carried out to produce the necessary technological solutions.
- Backup programmes are used to ensure that personal data is stored securely.
- In order to be prepared for any personal data breach, crisis and reputation management has been discussed and, in this context, processes for informing the Personal Data Protection Committee and the data subject have been designed.
5) PERSONAL DATA PROCESSING POLICY
All personal data processed by Ürmaksan is processed in accordance with the PDPL and the relevant legislation. Pursuant to Article 4 of the Law, Ürmaksan processes personal data lawfully and fairly, accurately and, where necessary, keeping it up to date, for specified, explicit and legitimate purposes, and in a manner relevant, limited and proportionate to those purposes:
- Lawful and Fair Processing: Ürmaksan acts in accordance with the principles introduced by legal regulations and with the general rules of good faith and fairness in the processing of personal data. In this context, Ürmaksan takes into account the requirements of proportionality when processing personal data and does not use personal data beyond what the purpose requires.
- Ensuring that Personal Data is Accurate and, Where Necessary, Up to Date: Taking into account the fundamental rights of data subjects and its own legitimate interests, Ürmaksan ensures that the personal data it processes is accurate and up to date.
- Processing for Specified, Explicit and Legitimate Purposes: Ürmaksan determines its legitimate and lawful purpose of processing personal data clearly and precisely. Ürmaksan processes personal data only to the extent connected with, and necessary for, the products and services it provides. The purpose for which personal data will be processed is established before the personal data processing activity begins.
- Being Relevant, Limited and Proportionate to the Purposes of Processing: Ürmaksan processes personal data in a manner suitable for achieving the determined purposes and refrains from processing personal data that is unrelated to, or not required for, the achievement of the purpose.
- Retention Only for the Period Stipulated in the Relevant Legislation or Required for the Purpose of Processing: Ürmaksan retains personal data only for the period stipulated in the relevant legislation or required for the purpose for which it is processed. In this context, Ürmaksan first determines whether a retention period for personal data is prescribed in the relevant legislation; if a period has been determined, it complies with that period, and if no period has been determined, it retains the personal data for the period required for the purpose of processing. Upon expiry of the period or when the reasons requiring processing cease to exist, the personal data is deleted, destroyed or anonymised by Ürmaksan.
5.1 Ürmaksan;
Retention: Personal data may be retained only:
- where required or permitted by legislation;
- where required by professional standards or policies;
- for as long as necessary for the purpose for which Ürmaksan uses the data. Ürmaksan deletes, destroys or permanently anonymises all other personal data it uses.
OTHER MATTERS
In the event of any inconsistency between the provisions of the PDPL and other relevant legislation and this Policy, the provisions of the PDPL and other relevant legislation shall apply as a matter of priority. This Policy, prepared by Ürmaksan, entered into force by way of separate resolutions adopted by the Boards of Directors of the Ürmaksan company.