1. PURPOSE AND SCOPE

Bağyurdu Organized Industrial Zone Anadolu Cad. Protection of Personal Data No: 6698, which is regulated as a constitutional right as BORATAŞ TUR.MAK.İNŞ.TAAH.SAN VE TİC LTD.ŞTİ. In accordance with the Law; While performing our activities, we attach importance to the protection of personal data of all real persons we come into contact with in any way, and to fulfill the requirements of the KVKK in this context.

This Personal Data Protection Policy; Personal data Bagyurt Organize Sanayi Bolgesi Anadolu Cad. It has been prepared by BORATAŞ TUR.MAK.İNŞ.TAAH.SAN VE TİC LTD.ŞTİ operating at the address of No:8 Kemalpaşa-İzmir-Türkiye to inform you about the processes related to collection, use, sharing and storage. In the process of processing and protecting personal data; The provisions of the relevant legislation in force will be applied with priority.

In this context, the main purpose of this Personal Data Protection and Processing Policy (“ Policy ”); To reveal the rules, measures, duties and responsibilities within the scope of the personal data protection legislation adopted by our company with a methodological approach and to ensure transparency in the measures we apply for the protection of personal data.

2. DEFINITIONS AND ABBREVIATIONS

The terms used in the application of this Policy have the following meanings.

Employees: Refers to the employees of our company.

Contact Person: It is the person responsible for following the personal data processing activities within our company and the implementation of the KVK Policies and Procedures on an individual basis.

Personal Data: It means all kinds of information related to an identified or identifiable natural person.
E.g; name, surname, address, phone number, date of birth, place of birth, eye color, TR ID number.

Personal Data Owner: The real person whose personal data is processed. E.g; employee, visitor, customer, Interested Person.

Processing of Personal Data: All kinds of operations performed on personal data, which are fully or partially automated or non-automatic, provided that they are part of any data recording system. E.g; obtain, save, store, change, transfer.

KVK Law: Refers to the Law on Protection of Personal Data No. 6698.

3. PRINCIPLES OF PROCESSING PERSONAL DATA

Our workplace processes personal data in accordance with the procedures and principles stipulated in the KVKK and other laws.
The following principles are complied with in the processing of personal data:

a) Compliance with the law and honesty rules:
Our workplace processes personal data in accordance with the provisions of the legal regulations, the law and the rules of honesty. It informs the personal data owners.

b) Being accurate and up-to-date when necessary:
Our workplace takes the necessary measures to ensure that the personal data it processes is accurate and up-to-date.

c) Processing for specific, explicit and legitimate purposes:
Our workplace clearly and precisely determines the legitimate and lawful purpose of processing personal data. Our workplace processes personal data in connection with the service it offers and as much as is necessary for them.

ç) Being connected, limited and proportional to the purpose for which they are processed:
Our workplace processes personal data for the realization of the purposes determined within the scope of the service it provides, and avoids receiving, processing and storing personal data that is not necessary for the realization of the purpose.

d) Preservation for the period required by the relevant legislation or for the purpose for which they are processed:
Our workplace stores personal data in accordance with the provisions of the legal legislation. At the end of the period, personal data is deleted, anonymized or destroyed.

PERSONAL DATA PROCESSING CONDITIONS:

Our workplace complies with the following conditions in line with the provisions of the KVKK No. 6698 while processing personal data:

(1) Personal data cannot be processed without the express consent of the person concerned.
Personal data is only processed with the express consent of the data owner/relevant person. In this direction, patients are informed about the subject and their explicit consent based on free will is obtained.

(2) In case of existence of one of the following conditions, it is possible to process personal data without seeking the explicit consent of the data subject:
a) It is clearly stipulated in the laws.
b) It is compulsory for the protection of life or physical integrity of the person or another person, who is unable to express his consent due to actual impossibility or whose consent is not legally valid.
c) It is necessary to process the personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract.
ç) It is mandatory for the data controller to fulfill its legal obligation.
d) The person concerned has been made public by himself.
e) Data processing is mandatory for the establishment, exercise or protection of a right.
f) Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

PROCESSING CONDITIONS OF SPECIAL QUALITY PERSONAL DATA

Our workplace complies with the regulations specified in the KVKK No. 6698 for the processing of special quality personal data.
KVKK “ARTICLE 6- (1) Regarding the race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, costume and dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures. data and biometric and genetic data are defined as “special quality personal data”.
Private personal data of our workplace;
Works with the express consent of the person concerned,
Personal data other than health and sexual life are processed without seeking the explicit consent of the person concerned, in cases stipulated by the laws,
Personal data related to health and sexual life are processed without seeking the explicit consent of the person concerned, for the purpose of protecting public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing, by persons or authorized institutions and organizations under the obligation of keeping confidentiality.

METHODS OF COLLECTING AND PROCESSING PERSONAL DATA

In accordance with Articles 4, 5 and 6 of the Law on the Protection of Personal Data, and based on the Personal Data Processing Inventory, which must be regulated within the scope of Articles 5, 7, 9 and 10 of the Regulation and contain the information below, processes personal data of individuals.

1- Data category
2- Personal data processing purposes and legal reason
3- Transferred recipient/recipient groups
4- Data subject groups
5- The maximum retention period required for the purposes for which personal data is processed
6- Transfer to foreign countries
7- Administrative and technical measures taken regarding data security

THIRD PARTIES TO WHICH PERSONAL DATA IS TRANSFERRED BY OUR WORKPLACE AND THEIR PURPOSE

Our company carefully complies with the conditions set forth in the KVKK regarding the sharing of personal data with third parties, without prejudice to the provisions of other laws. In this context, personal data, Bağyurdu Organized Industrial Zone Anadolu Cad. No: 8 Kemalpaşa-İzmir-Türkiye, the data is not transferred to third parties without the explicit consent of the data owner by BORATAŞ TUR.MAK.İNŞ.TAAH.SAN VE TİC LTD.ŞTİ. However, in the presence of one of the following conditions regulated by KVKK, personal data may be transferred by our Company without obtaining the explicit consent of the data owner:

- expressly stipulated in laws,
- It is compulsory for the protection of the life or physical integrity of the person or another person, who is unable to express his consent due to actual impossibility or whose consent is not legally recognized,
- It is necessary to process the personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract,
- It is mandatory for the data controller to fulfill its legal obligations,
- It has been made public by the data owner himself,
- Data processing is mandatory for the establishment, exercise or protection of a right,
- Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data owner. Provided that adequate precautions are taken; stipulated in the laws in terms of special quality personal data other than health and sexual life, and in terms of special quality personal data related to health and sexual life,
- Protection of public health,
- Preventive medicine,
- medical diagnosis,
- Execution of treatment and care services,
- Your personal data may be transferred without obtaining explicit consent for purposes such as planning and management of health services and financing. In the transfer of sensitive personal data, the conditions specified in the processing conditions of this data are complied with.

STORAGE OF PERSONAL DATA UNDER RELATED LEGISLATION

Our company's personal data, in accordance with the provisions of the KVKK and other relevant laws, Bağyurdu Organize Sanayi Bolgesi Anadolu Cad. No:8 Kemalpaşa-İzmir-Türkiye, BORATAŞ TUR.MAK.İNŞ.TAAH.SAN VE TİC LTD.ŞTİ is securely stored in physical or electronic environment for an appropriate period of time in order to carry out its commercial activities. First of all, it examines whether there is a period for the storage of personal data and acts in accordance with this period. In the absence of a legal period, the required period is determined and personal data is stored in accordance with this period. When the period expires, personal data is deleted, destroyed and anonymized.

However, in cases where the data controller has a legitimate interest, personal data may be stored until the expiry of the general statute of limitations (ten years) regulated in the Code of Obligations, provided that the fundamental rights and freedoms of the data subjects are not harmed, despite the expiration of the purpose of processing and the periods specified in the relevant laws.

In this context, our Company provides the necessary training to the relevant units and raises awareness.

MEASURES TAKEN FOR DATA SECURITY

Bağyurdu Organized Industrial Zone Anadolu Cad. No: 8 Kemalpaşa-İzmir-Türkiye, BORATAŞ TUR.MAK.İNŞ.TAAH.SAN VE TİC LTD.ŞTİ takes all necessary technical and administrative measures to ensure the appropriate level of security required for the protection of personal data.

12 (1) of the KVKK. The measures envisaged in the article are as follows:
- To prevent the unlawful processing of personal data,
- To prevent unlawful access to personal data,
- To ensure the protection of personal data.
The measures taken by our company in this context are listed below:

Administrative Measures

- Our company carries out the necessary inspections in order to ensure the implementation of the provisions of the Law.
- In case the processed personal data is obtained by others illegally, our Company notifies the relevant person and the Board as soon as possible.
- Regarding the sharing of personal data, it signs a framework agreement with the persons to whom the personal data is shared or provides data security with the provisions it will add to the agreements.
- Employs knowledgeable and experienced personnel about the processing of personal data and provides necessary KVK training to its personnel.

Technical Measures

- Our company employs knowledgeable and experienced people to ensure data security and provides necessary KVK training to its personnel.
- Performs necessary internal controls within the scope of established systems.
- Provides the technical infrastructure to prevent and/or monitor personal data from leaking out of the institution and the creation of relevant matrices.

KVKK of PERSONAL DATA OWNERS11. RIGHTS ACCORDING TO ARTICLE:

Within the framework of Article 11 of the Law on the Protection of Personal Data No. 6698 (KVKK), personal data owners apply to the address of our Company;
a- Learning whether personal data is processed,
b- If personal data has been processed, requesting information about it,
c- Learning the purpose of processing personal data and whether they are used in accordance with the purpose,
ç- Knowing the third parties to whom personal data is transferred in the country or abroad,
d- Requesting correction of personal data if it is incomplete or incorrectly processed,
e- Requesting the deletion or destruction of personal data in accordance with the provisions of KVKK and other relevant legislation,
f- In case of correction, deletion or destruction of your personal data, requesting the notification of these transactions to the third parties to whom the personal data has been transferred,
g- Objecting to this result if a result arises against you by analyzing your processed personal data exclusively through automated systems,
ğ- In case you suffer damage due to unlawful processing of personal data, it has the right to demand the compensation of the damage.