CONFIDENTIALITY AND PERSONAL DATA PROTECTION PRINCIPLES
1. PURPOSE AND SCOPE
This Confidentiality and Personal Data Protection Principles ("Principles") specify the principles adopted by Tezman Holding A.Ş (hereinafter referred to as "TEZMAN HOLDING", “Company” or “Data Controller”) regarding the protection of personal data, while establishing personal data protection principles and aiming at informing Visitors, Customers, Potential Customers, Suppliers, Third Parties and online visitors (“Individuals Groups”) regarding processing of their personal data.
2. PRINCIPLES IN RELATION TO PROCESSING OF PERSONAL DATA
As TEZMAN HOLDING, we process your personal data in the capacity of Data Controller according to the following principles.
2.1 Processing in Compliance with Law and Principles of Honesty
Your personal data are processed in accordance with the principles which have been introduced by legal regulations, and the rule of general trust and honesty.
2.2 Ensuring that Personal Data are Accurate, and Up-To-Date, when Necessary
By taking your legitimate interests into consideration, periodical verifications and updates are made in order to ensure that the data processed are accurate and up-to-date, and the necessary measures are taken accordingly. In this context, systems for controlling the correctness of personal data and making necessary corrections are set up within the corporate body of TEZMAN HOLDING.
2.3 Processing for Specific, Clear and Legitimate Purposes
Your personal data are processed in accordance with clear, specific and legitimate data processing purposes.
2.4 Personal Data Being Relevant, Limited and Proportionate to their Purpose of Processing
Your personal data are processed proportionately to the extent necessary for achieving the envisaged purpose/purposes, and in a manner that is relevant and limited to the purpose, and we abstain from processing any personal data which are not related to achieving the purpose or which are not needed in that respect.
2.5 Retaining the Personal Data for the Period Stipulated in the Relevant Legislation or the Period Required for the Purpose of Processing Thereof
Your personal data are preserved only for the period prescribed in the relevant legislation or the period required for the purpose of processing thereof. In this context, first of all we identify whether a period is stipulated in the relevant legislation for the preservation of personal data, and if such a period is prescribed, we act in accordance with it, and if no such period is prescribed, we preserve the personal data for the period required for the purpose of processing thereof. In case of expiry of such period or in case the reasons requiring them to be processed cease to exist, provided there is no legal reason for allowing them to be processed for longer periods, your personal data are deleted, destroyed or anonymized in accordance with TEZMAN HOLDING’s Policy on Preservation and Destruction of Personal Data.
3. PERSONAL DATA PROCESSING CONDITIONS
Your personal data are processed by TEZMAN HOLDING in accordance with the following conditions.
3.1 Being Explicitly Stipulated by the Laws
Your personal data may be processed if it is explicitly required by the law to process such personal data.
3.2 Inability to Obtain Express Consent of the Relevant Person Due to Actual Impossibility
Where the relevant person cannot give his/her consent or his/her consent is deemed non-admissible due to actual impossibility, but his/her personal data must be processed in order to protect the life or body integrity of such person or any other person, then the personal data of such person may be processed.
3.3 Directly related to the Conclusion or Performance of a Contract
Where the processing of personal data belonging to the parties to a contract is necessary, such personal data may be processed provided that it is directly related to the conclusion or performance of the said contract.
3.4 Performance by TEZMAN HOLDING of its Legal Obligation
Your personal data may be processed, if the processing thereof is compulsory in order for us, as the Data Controller, to fulfill our legal obligations.
3.5 Personal Data that Became Public
If your personal data has been made public by you, we will be able to process them.
3.6 Obligation to Process Data for Securing or Protecting a Right
In case data processing is mandatory for securing, exercising or protecting a right, your personal data may be processed.
3.7 Processing of Data Based on Legitimate Interest
Your personal data may be processed if it is necessary based on the legitimate interests of TEZMAN HOLDING.
3.8 Processing of the Data Based on Express Consent
Your personal data may be processed on the basis of express consent in cases where they cannot be processed based on any of the conditions specified in these principles.
4. CATEGORIZATION OF PERSONAL DATA
5. PURPOSE OF PROCESSING OF PERSONAL DATA
TEZMAN HOLDING may process personal data for the purposes set out below and based on the relevant individuals group, under the personal data processing conditions specified in Article 5 and 6 of the Law no. 6698.
5.1 CUSTOMERS
Personal data of customers may be processed according to the personal data processing conditions specified in Article 5 and 6 of the Law no. 6698, in order to carry out the necessary business and operational procedures for the benefit of the customers with the products and services offered by the Company; to monitor the performance of this contract, financial and accountancy affairs; to plan and execute customer relations management and customer satisfaction activity processes; to monitor the contract processes, customer’s requests and complaints; to plan and perform transfer processes; to plan data security processes; to establish, manage, audit and perform information technologies infrastructure.
5.2 POTENTIAL EMPLOYEES
Personal data of potential employees may be processed according to the personal data processing conditions specified in Article 5 and 6 of the Law no. 6698, in order to plan and execute human resources processes; to carry out activities for the personnel; fulfill obligations that arise from the legislation; to plan and provide benefits; to carry out personnel recruitment processes.
5.3 POTENTIAL CUSTOMERS
Personal data of potential customers may be processed according to the personal data processing conditions specified in Article 5 and 6 of the Law no. 6698, in order to make the necessary efforts for the planning and execution of the activities necessary for customizing and marketing the products and services of the company in accordance with preferences, usage habits and needs of data subjects, and promote the company; carrying out the commercial activities of the Company and to perform the related work processes; to carry out the necessary works and related business processes to ensure that products and services offered by the Company can be benefited from; to plan and execute the necessary activities for customization of the products and services to be offered by the Company and for their promotion; and to plan and execute customer relations management processes.
5.4 VISITORS
The personal data of visitors may be processed according to the personal data processing conditions specified in Article 5 and 6 of the Law no. 6698, in order to ensure the safety of buildings, establishments and/or plants; to create and monitor the visitor records; to ensure the safety of fixtures and/or resources; to ensure technical and commercial occupational safety, to ensure the safety of organizational operations; and to inform the authorized institutions and organizations.
5.5 THIRD PARTIES
The personal data of third parties may be processed according to the personal data processing conditions specified in Article 5 and 6 of the Law no. 6698, in order to carry out the necessary business and operational procedures to benefit the customers from the products and services offered by the Company; to carry out the commercial activities of the Company and execute the related work processes; to carry out the necessary works and related business processes for ensuring that products and services offered by the Company can be benefited from; to plan and carry out the necessary activities for customization of the products and services to be offered by the Company and for their promotion; and to fulfill the obligations under this contract.
5.6 SUPPLIERS / BUSINESS PARTNERS
The personal data of Suppliers / Business Partners may be processed according to the personal data processing conditions specified in Article 5 and 6 of the Law no. 6698, in order to carry out the necessary business and operational procedures for the benefit of the customers from the products and services offered by the Company; to carry out the commercial activities of the Company and to execute the related work processes; to carry out the necessary works and related business processes to ensure that products and services offered by the Company can be benefited from.
5.7 ONLINE VISITORS
Personal data of Online Visitors may be processed according to the personal data processing conditions specified in Article 5 and 6 of the Law no. 6698, in order to carry out marketing analysis works, advertisement/campaign/promotion processes, communication works, to carry out product and service development works, and to fulfill legal obligations.
6. TRANSFER OF PERSONAL DATA
Your personal data may be transferred in a restricted manner to our domestic and overseas business partners, suppliers, affiliates, group companies, legally authorized public institutions and private persons, according to principles and objectives specified in Article 3 and 5 of these Principles personal data processing conditions and purposes specified in Article 8 and 9 of the Law no. 6698.
7. METHOD OF AND LEGAL GROUNDS FOR COLLECTION OF PERSONAL DATA
Your personal data transmitted to TEZMAN HOLDING electronically or physically are processed as follows based on the relevant individuals groups.
7.1 CUSTOMERS
The personal data of the Customers are processed by automated means by using written and verbal data transmission tools in physical and electronic media by obtaining such data directly from the persons or third parties as part of data recording system on the legal grounds that according to the provisions of Article 5 of the Law no. 6698, there is a “necessity to process personal data belonging to the parties of a contract, provided that it is directly related to the formation or performance of the contract”, “provided that it does not harm the fundamental rights and freedoms of the data subject, “data processing is mandatory for data controller’s fulfillment of its legal obligation”, “the data processing is mandatory for the legitimate interests of the data controller”.
7.2 POTENTIAL EMPLOYEES
The personal data of the Potential Employees are processed by automated means by obtaining such data directly from the persons or third parties who deliver application forms in electronic media or as physical forms as part of data recording system on the legal grounds that according to the provisions of Article 5 of the Law no. 6698, there is a “necessity to process personal data belonging to the parties of a contract, provided that it is directly related to the formation or performance of the contract”, “provided that it does not infringe the fundamental rights and freedoms of the data subject, “data processing is mandatory for data controller’s fulfillment of its legal obligation”, “the data processing is mandatory for the legitimate interests of the data controller”.
7.3 POTENTIAL CUSTOMERS
The personal data of the Potential Customers are processed by automated means by using written and verbal data transmission tools in physical and electronic media by obtaining such data directly from the persons or third parties as part of data recording system on the legal grounds that according to the provisions of Article 5 of the Law no. 6698, “the personal data has been made public by the data subject itself”, “data processing is mandatory for securing, exercising or protection of a right”, “provided that it does not harm the fundamental rights and freedoms of the data subject, the data processing is mandatory for the legitimate interests of the data controller”, and “data processing is mandatory for data controller’s fulfillment of its legal obligation”.
7.3 VISITORS
The personal data of the Visitors are processed by automated means by recording security footages with security cameras located at the entrance doors, external facade of the building, meeting rooms, activity rooms, dining rooms, cafeterias, waiting areas, parking area, elevators and floor corridor service areas on the legal grounds that according to the provisions of Article 5 of the Law no. 6698, “data processing is mandatory for data controller’s fulfillment of its legal obligation”, “provided that it does not infringe the fundamental rights and freedoms of the relevant person, the data processing is mandatory for the legitimate interests of the data controller”.
7.4 THIRD PARTIES
The personal data of Third Parties are processed by automated means by obtaining such data directly from the persons or third parties using written and verbal data transmission tools in physical or electronic media on the legal grounds that according to the provisions of Article 5 of the Law no. 6698, “provided that it does not infringe the fundamental rights and freedoms of the data subject, the data processing is mandatory for the legitimate interests of the data controller” and according to the data processing conditions specified in article 6.
7.5 SUPPLIER / BUSINESS PARTNER
The personal data of the Suppliers / Business Partners are processed by automated means by obtaining such data directly from the person or third parties as part of data recording system by using written and verbal data transmission tools in physical and electronic media according to the provisions of Article 5 of the Law no. 6698, “the processing of personal data belonging to the parties of a contract should be necessary, provided that these are directly related to the conclusion or performance of the said contract”, “data processing is mandatory for data controller’s fulfillment of its legal obligation”, “provided that it does not infringe the fundamental rights and freedoms of the relevant person, the data processing is mandatory for the legitimate interests of the data controller”.
7.6 ONLINE VISITORS
The personal data of the Online Visitors are processed by automated means, under the Law No. 5651 on Regulation of Online Publications and Fighting Against Crimes Committed Through Such Publications, and on the legal grounds that, according to the provisions of Article 5 of the Law no. 6698, “provided that it does not harm the fundamental rights and freedoms of the relevant person, the data processing is mandatory for the legitimate interests of the data controller”, and “data processing is mandatory for data controller’s fulfillment of its legal obligation”.
8. SECURITY OF PERSONAL DATA
8.1 In order to ensure the safety of personal data and prevent unlawful processing thereof, TEZMAN HOLDING takes reasonable measures, which will prevent risks of unauthorized access, accidents and data losses, deliberate deletion of data or damages to data.
8.2 For prevention of access to personal data by the persons other than those who are authorized to access thereto, all the necessary technical and physical measures are taken. In this context, the authorization system in particular is designed in such a way that it will be impossible for anyone to access personal data to an extent which is more than required
8.3 TEZMAN HOLDING performs and procures the performance of necessary audits within its own organization in order to ensure implementation of the provisions of the Law no. 6698.
9. UNDERTAKINGS WITH REGARDS TO THIRD PARTY PERSONAL DATA
The relevant Individuals Groups agree and consent to processing by TEZMAN HOLDING of their 3rd party personal data delivered by them to TEZMAN HOLDING. The relevant Individuals Groups also undertake that they have performed the necessary information duties and have received the required consents with respect to the persons whose information has been transferred, and their information, pursuant to the Law No. 6698 on the Protection of Personal Data. Otherwise, all damages to be incurred shall belong to the relevant Individuals Group.
10. APPLICATION PROCEDURES AND PRINCIPLES
As a data subject, you may submit an application in relation to your requests under article 11 of the Law No. 6698 ,in line with the procedures and principles provided in the Application Form for Protection of Personal Data found on the webpage www.tezmanholding.com, by submitting a written application bearing wet signature in person or through the notary public to the address Hacı Ahmet Mahallesi, Irmak Caddesi, DLP No.1/5, 34440 Beyoğlu, İstanbul / Türkiye and to the address kvkk@tezmanholding.com by using mobile signature/e-signature. On a free-of-charge basis, TEZMAN HOLDING will accede to your requests depending on the nature of the request.within the shortest time possible, but no later than thirty days. However, in case the process requires any additional cost, TEZMAN HOLDING shall obtain the fee specified by the Board of Protection of Personal Data.
We would like to emphasize your rights in this context as the data subject that you have the right
• To learn whether or not your personal data are being processed,
• To request information on the procedure, if your personal data have been processed,
• To obtain information on the purpose of processing Personal Data and find out whether personal data has been used as fit for the purpose;
• To obtain information about the third persons to whom personal data were communicated domestically or abroad,
• To request the correction of personal data that may have been incompletely or inaccurately processed;
• To request the deletion or destruction of personal data within the framework of the conditions set forth in the applicable legislation,
• To request notification of the procedures set out under the last two sub-paragraphs above to third parties to whom the personal data has been transferred,
• To object to the occurrence of a result which is detrimental to the person concerned as a result of analyzing the processed data exclusively through automatic systems; and
• To request indemnification for damages in the case that damages are sustained as a result of unlawful processing of personal data.
CLARIFICATION TEXT FOR PROCESSING OF PERSONAL DATA OF “POTENTIAL EMPLOYEES”
a) Data Controller
Pursuant to the Law on Protection of Personal Data No. 6698 (“Law No. 6698”), your personal data such as identity details, contact details, curriculum vitae details will be processed by Tezman Holding A.Ş (“TEZMAN HOLDING”) acting in its capacity as data controller within scope provided in this document.
b) Purposes of Processing Personal Data
Your personal data which has been collected may be processed in order to carry out personnel recruitment processes; to plan and execute human resources processes; to fulfill obligations that arise from the legislation which are subject to the disclosure of your personal data to us pursuant to the personal data processing conditions specified in article 5 and 6 of the Law no. 6698;
c) Persons to Whom Personal Data that is Processed May be Disclosed, and Purpose of Such Disclosure
Your personal data which has been collected may be forwarded to the parties you described as reference persons, affiliates, group companies, legally authorized private and public institutions within the framework of personal data processing conditions and purposes specified in article 8 and 9 of the Law no. 6698, to achieve the objectives described above in a restricted manner.
d) Method of and Reason for Collecting Personal Data
Your Personal Data are collected and protected by the Company in physical and/or electronic media through different channels based on different legal reasons. Your personal data are collected and processed based on legal reasons such as granting you Rights and Benefits in order to establish a business relationship, maintaining and developing the activities of the Company and fulfilling the obligations arising from the legislation.
e) Your Rights as a Relevant Person set out in Article 11 of the Law no 6698
As the data subject, you may submit an application in relation to your requests under article 11 of the Law No. 6698 ,in line with the procedures and principles provided in the Application Form for Protection of Personal Data found on the webpage and Human Resources Department www.tezmanholding.com, by submitting a written application bearing wet signature in person or through the notary public to the address Hacı Ahmet Mahallesi, Irmak Caddesi, DLP No.1/5, 34440 Beyoğlu, İstanbul / Türkiye and to the address kvkk@tezmanholding.comby using mobile signature/e-signature. On a free-of-charge basis, TEZMAN HOLDING will accede to your requests depending on its nature within the shortest time possible, but no later than thirty days. However, in case the process requires any additional cost, TEZMAN HOLDING shall obtain the fee specified by the Board of Protection of Personal Data.
