Personal Data Protection and Processing Policy
1. INTRODUCTION
Protection of personal data is among the top priorities of Trakya Grup Plastik Alüminyum ve Cam Sanayi Ticaret Limited Şirketi (“Trakya Group” or “Company”). Trakya Group makes every effort to comply with all legislation in force in this regard. The principles adopted in the execution of personal data processing activities carried out by our Company within the framework of Trakya Group Personal Data Protection and Processing Policy (“Policy”) and the compliance of our Company’s data processing activities with the regulations in the Personal Data Protection Law No. 6698 (“Law” or “KVKK”) The basic principles adopted for this purpose are explained.
1.2 Purpose
This Policy; It has been prepared to ensure the management of compliance activities to be carried out by Trakya Grup to comply with KVKK regarding the protection of personal data.
Trakya Group will make the necessary arrangements for the protection and processing of personal data in accordance with the law, in line with the principles set out in this Policy and will establish the necessary system to raise awareness of its employees and business partners in this regard.
1.3. 1.3. Scope
This Policy; Persons whose personal data are processed by our company, especially our employees, employee candidates, company officials, company shareholders, customers, visitors, employees, shareholders and officials of the institutions we cooperate with, and third parties, who are fully or partially automated or are part of any data recording system. It relates to all personal data processed by non-automatic means, provided that
1.4. 1.4. Implementation and Enforcement of the Policy
The relevant legal regulations in force regarding the processing and protection of personal data will primarily be applied. In case of incompatibility between the current legislation and the Policy, our Company accepts that the current legislation will apply.
The effective date of this Policy is 30.09.2020.
2. ISSUES RELATED TO THE PROCESSING OF PERSONAL DATA
This policy serves as a guide on how Trakya Group will implement the rules set out in KVKK and relevant legislation.
Our company, regarding the processing of personal data accordance with Article 20 of the Constitution and Article 4 of the KVKK; In accordance with the law and the rules of honesty; accurate and up to date; Pursuing specific, clear, and legitimate purposes; engages in personal data processing in a limited and measured manner in connection with the purpose.
3. PROCESSING OF PERSONAL DATA IN ACCORDANCE WITH THE LEGISLATION
3.1. 3.1. Processing in Compliance with the Law and the Rules of Honesty
Trakya Grup acts in accordance with the principles brought by legal regulations and the general rule of trust and honesty in the processing of personal data. In this context, personal data is processed to the extent and limited to the business activities of our Company.
3.2. .2. Ensuring Personal Data is Accurate and Up to Date When Necessary
Trakya Group ensures that the personal data it processes are accurate and up to date, considering the fundamental rights of personal data owners and its own legitimate interests. It takes the necessary measures in this regard.
3.3. 3.3. Processing for Specific, Clear and Legitimate Purposes
Our company clearly and precisely determines the purpose of processing personal data that is legitimate and lawful. Our company processes personal data in connection with the service it offers and as much as is necessary for them.
3.4. 3.4. Being Related to the Purpose for Processing, Limited and Proportionate
Our company processes personal data in a manner suitable for achieving the specified purposes and avoids the processing of personal data that is not relevant or needed to achieve the purpose.
3.5. 3.5. Preservation for the Period Envisaged in the Relevant Legislation or Necessary for the Purpose for which they are Processed.
Our company retains personal data only for the period specified in the relevant legislation or necessary for the purpose for which they are processed. In this context, our Company first determines whether a period is stipulated in the relevant legislation for the storage of personal data, if a period is determined, it acts in accordance with this period, and if a period is not determined, it stores personal data for the period necessary for the purpose for which they are processed. If the period expires or the reasons requiring processing disappear, personal data is deleted, destroyed, or anonymized by our Company. Personal data is not stored by our Company for possible use in the future.
4. CONDITIONS FOR PROCESSING PERSONAL DATA
As a rule, personal data should be processed based on one or more of the personal data processing conditions specified in Article 5 of the KVKK. In this context, Trakya Group evaluates whether personal data processing activities fall within the scope of one of these conditions, and personal data processing activities that are not based on one of these conditions are stopped. It is regulated in KVKK that special measures may be taken for the processing of personal data of special nature. In this context, precautions determined by the Board are taken when processing special personal data.
Except for the express consent of the personal data owner, the basis for personal data processing may be only one of the following conditions, or more than one condition may be the basis for the same personal data processing activity:
- Having Explicit Consent of the Personal Data Owner
One of the conditions for processing personal data is the explicit consent of the data owner. Explicit consent of the personal data owner must be expressed on a specific subject, based on informed consent and free will. If the following personal data processing conditions are met, personal data may be processed without the need for the data owner’s explicit consent.
- Clearly Provided in Laws
If the personal data of the data owner is clearly foreseen by the law, in other words, if there is a clear provision in the relevant law regarding the processing of personal data, it can be said that this data processing condition exists.
- Failure to Obtain Explicit Consent of the Person Relevant Due to Actual Impossibility
If it is necessary to process the personal data of a person who is unable to express his/her consent due to actual impossibility or whose consent cannot be recognized as valid, in order to protect the life or physical integrity of himself or another person, the personal data of the data owner may be processed.
- Directly Related to the Establishment or Performance of the Contract
This condition may be deemed to be fulfilled if the processing of personal data is necessary, provided that it is directly related to the establishment or performance of a contract to which the data owner is a party.
- Fulfillment of the Company’s Legal Obligations
If processing is mandatory for our company to fulfill its legal obligations, the personal data of the data owner may be processed.
- Personal Data Owner’s Publicization of Personal Data
If the data owner has made his/her personal data public, the relevant personal data may be processed on a limited basis for the purpose of publicization.
- Data Processing is Necessary for the Establishment or Protection of a Right
If data processing is mandatory for the establishment, exercise or protection of a right, the personal data of the data owner may be processed.
- Data Processing Is Necessary for Our Company’s Legitimate Interests
Personal data of the data owner may be processed if data processing is necessary for the legitimate interests of our Company, provided that the fundamental rights and freedoms of the personal data owner are not harmed.
4.2. 4.2. Processing of Special Personal Data..
Article 6 of the KVKK states that, when processed unlawfully, there is a risk of causing victimization or discrimination to individuals; Data regarding race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, appearance and clothing, association, foundation or union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data are considered “special quality” is organized as personal data.
Our company complies with the regulations stipulated in the Law when processing special personal data. Special categories of personal data are processed by our Company in accordance with the principles specified in this Policy and by taking all necessary administrative and technical measures, including the methods determined by the Board, and if the following conditions are met:
- Special personal data other than health and sexual life
If it is clearly provided for in the law, in other words, if there is a clear provision regarding the processing of personal data in the law governing the relevant activity, it may be processed without the explicit consent of the data owner. Otherwise, explicit consent of the data owner will be obtained in order to process such special personal data.
- Special personal data regarding health and sexual life
It may be processed without explicit consent by persons under the obligation of confidentiality or authorized institutions and organizations for the purpose of protecting public health, carrying out preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing. Otherwise, explicit consent of the data owner will be obtained in order to process such special personal data.
5. CLARIFICATION OF THE PERSONAL DATA OWNER
In accordance with Article 10 of the KVKK, Trakya Group informs personal data owners about how their data will be processed during the collection of personal data. Within the scope of the relevant legislation, Trakya Group; It has identified all the processes through which personal data is obtained, and information texts have been prepared by our company specifically for all of these processes. Through these texts, personal data owners:
- The identity of our company as the data controller,
- For what purpose your personal data will be processed,
- To whom and for what purpose personal data can be transferred,
- Method and legal reasons for collecting personal data,
- Their rights as personal data owners
They are informed about this by our company.
6. TRANSFER OF PERSONAL DATA
Even if there is no explicit consent of the personal data owner, personal data may be transferred to third parties by Trakya Group by taking necessary care and taking all necessary security measures, including the methods prescribed by the Board, if one or more of the conditions stated below are present:
- Relevant activities regarding the transfer of personal data are clearly foreseen by law,
- The transfer of personal data by the Company is directly related to and necessary for the establishment or performance of a contract,
- Transfer of personal data is mandatory for our Company to fulfill its legal obligations,
- Transfer of personal data by our Company in a limited way for the purpose of publicization, provided that it has been made public by the data owner,
- Transfer of personal data by the Company is mandatory for the establishment, exercise or protection of the rights of the Company or the data owner or third parties,
- It is mandatory to transfer personal data for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of the data owner,
- It is necessary for the person who is unable to express his consent due to actual impossibility or whose consent is not given legal validity, to protect his own life or physical integrity, or someone else’s.
6.2. 6.2. Transfer of Special Personal Data
Special categories of personal data may be transferred by our Company in accordance with the principles specified in this Policy and by taking all necessary administrative and technical measures, including the methods determined by the Board, and if the following conditions are met:
- Special personal data other than health and sexual life
If it is clearly provided for in the law, in other words, if there is a clear provision in the relevant law regarding the processing of personal data, the data may be transferred without the explicit consent of the data owner. Otherwise, explicit consent of the data owner will be obtained.
- Special personal data regarding health and sexual life
It may be transferred without seeking explicit consent by persons under the obligation of confidentiality or authorized institutions and organizations for the purpose of protecting public health, carrying out preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and their financing. Otherwise, explicit consent of the data owner will be obtained. If special personal data is to be transferred abroad, in addition to the conditions stated above, special personal data will be transferred to foreign countries with adequate protection or to foreign countries where the batch controller who undertakes adequate protection is located.
6.3. 6.3. Third Parties to whom Personal Data is Transferred by Trakya Grup and Purposes of Transfer
Our company can transfer the personal data and sensitive personal data of the personal data owner to third parties (third party companies, official and private authorities, third real parties) by taking the necessary security measures in line with the legal personal data processing purposes. In this regard, our company acts in accordance with the regulations stipulated in Article 8 of the Law.
In accordance with Articles 8 and 9 of the KVKK, our Company may transfer the personal data of data owners managed by this Policy to the categories of persons listed below:
- To Trakya Grup business partners,
- To Trakya Grup suppliers,
- To legally authorize public institutions and organizations
- To legally authorized private law persons
| Persons to whom data can be transferred | Definition | Purpose of Data Transfer |
| Business partner | It defines the parties with whom our company establishes business partnerships for purposes such as carrying out various projects and receiving services while carrying out its commercial activities. | Limited to ensure the fulfillment of the purposes for which the business partnership was established. |
| Supplier | It defines the parties that provide services to our Company on a contractual basis in accordance with the orders and instructions of Trakya Group while carrying out the commercial activities of our Company. | Limited to ensure that the services that Trakya Group outsources from the supplier and necessary to carry out Trakya Group’s commercial activities are provided to our Company. |
| Legally Authorized Public Institutions and Organizations | Public institutions and organizations authorized to receive information and documents from Trakya Group in accordance with the relevant legislation provisions | Limited to the purpose requested by the relevant public institutions and organizations within their legal authority |
| Legally Authorized Private Legal Persons | Private law persons authorized to receive information and documents from Trakya Group in accordance with the relevant legislation provisions | Limited to the purpose requested by the relevant private law persons within their legal authority |
7. CATEGORIZATION AND PROCESSING PURPOSES OF PERSONAL DATA PROCESSED BY OUR COMPANY
Before our Company, the relevant persons are informed in accordance with Article 10 of the Law and secondary legislation, and in line with our Company’s personal data processing purposes, personal data can be processed based on and limited to at least one of the personal data processing conditions specified in Articles 5 and 6 of the Law. Personal data is processed in accordance with the general principles specified in the Law, including the principles specified in Article 4 of the relevant Law. Within the framework of the purposes and conditions specified in this Policy, detailed information about the categories of personal data processed and the categories is as follows:
| PERSONAL DATA CATEGORIZATION | PERSONAL DATA CATEGORIZATION DESCRIPTION |
| Identity Information | These are data containing information regarding the identity of the person; name-surname, T.R. identification number, nationality information, place of birth, date of birth, gender, workplace information, registration number, tax number, title, biography, etc. information and documents such as driver’s license, professional ID, identity card and passport |
| Communication information | Phone number, address, e-mail address, fax number, etc. informations. |
| Transaction Security Information | Your personal data processed to ensure our technical, administrative, legal and commercial security during the conduct of our activities (e.g. log records, IP information, authentication information) |
| Transaction Information | Data such as survey information, declaration information, shopping information, call center records, membership information, cookie records, processed within the framework of the activities carried out by our Company, related to the services offered or in order to protect the legal and other interests of the Company and the personal data owner. |
| Family Members and Relative Information | Information about the personal data owner’s family members (e.g. spouse, mother, father, child), relatives and other persons who can be reached in emergency situations, within the framework of the activities carried out by our Company, related to the services offered or for the purpose of protecting the legal and other interests of the Company and the personal data owner. |
| Physical Space Security Information | Personal data regarding records and documents taken upon entering the physical location and during the stay in the physical location; camera records, vehicle information records and records taken at security points, etc. |
| Financial Information | Personal data processed regarding information, documents and records showing all kinds of financial results created according to the type of legal relationship our Company has established with the personal data owner, and data such as bank account number, IBAN number, income information, debt/receivable information. |
| Audio/Visual Information | Photographs and camera records (except for records falling within the scope of Physical Space Security Information) |
| Corporate Memory Information | Memoirs, interviews, etc. processed within the scope of activities carried out by Trakya Group in order to create the corporate memory of our company informations. |
| Special Personal Data | Data regarding people’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data |
| Legal Action and Compliance Information | Personal data processed within the scope of determining and pursuing our legal receivables and rights, fulfilling our debts, and complying with our legal obligations and our Company’s policies. |
| Audit and Inspection Information | Personal data processed regarding the execution of our company’s operational, financial, fraud and compliance audit activities |
| Request/Complaint Management Information | Personal data regarding the receipt and evaluation of any requests or complaints directed to our Company. |
- THE PURPOSES OF PROCESSING SUCH PERSONAL DATA ARE AS FOLLOWS:
| MAIN OBJECTIVES (PRIMARY) | SUB-PURPOSES (SECONDARY) |
| Planning and Executing the Company’s Human Resources Policies and Processes | Carrying out personnel recruitment processes |
| Carrying out the necessary work by our relevant business units to carry out the commercial activities carried out by the company and carrying out the related business processes | event management |
| Planning and execution of corporate communication activities | |
| Planning, auditing and execution of information security processes | |
| Establishing and managing information technology infrastructure | |
| Follow-up of finance and/or accounting affairs | |
| Planning and execution of corporate sustainability activities | |
| Planning and/or execution of activities to analyze the effectiveness/productivity and/or appropriateness of business activities | |
| Planning and execution of corporate governance activities | |
| Planning and Execution of the Company’s Commercial and/or Business Strategies | Management of relationships with business partners and/or suppliers |
| Execution of strategic planning activities | |
| Planning and Execution of Company Human Resources Policies and Processes | Employee request and complaint management |
| Planning analysis and improvement activities regarding company wage management | |
| Planning and supporting the processes of providing fringe benefits and benefits to company employees | |
| Supporting company employees’ wage management planning activities | |
| Planning and supporting processes regarding the training and career development of company employees | |
| Planning and managing processes to increase the satisfaction and loyalty of company employees | |
| Managing the processes related to the Company’s Strategic Human Resources Planning, Backup Processes and performance evaluation of the Company’s employees. Assisting in Organizational Development Activities | Managing processes regarding performance evaluation of company employees |
| Supporting the company’s development and backup planning activities | |
| Supporting the management of the appointment and promotion processes of personnel and managers within the company | |
| Preserving the Confidence that Trakya Group’s Reputation Instills in Commercial Life and Consumers | Carrying out work to protect the reputation of company values |
| Follow-up of company customer requests and/or complaints | |
| Planning and/or execution of corporate social responsibility and/or civil company activities | |
| Planning and execution of processes for company employee loyalty and satisfaction | |
| Ensuring the legal, technical and commercial-occupational security of the Company and relevant persons in business relations with the Company | Follow-up of legal affairs |
| Creating and tracking visitor records | |
| Planning and execution of operational activities necessary to ensure that company activities are carried out in accordance with company procedures and/or relevant legislation. | |
| Ensuring the security of company assets and/or resources | |
| Ensuring the security of company operations | |
| Providing information regarding legislation to authorized institutions | |
| Carrying out company and partnership law transactions | |
| Assisting the company in carrying out corporate and partnership law transactions | |
| Ensuring that data is accurate and up to date | |
| Ensuring the security of company campuses and/or facilities | |
| Planning and execution of company audit activities | |
| Planning and Execution of Trakya Group’s Audit Activities | Supporting company fraud reporting and investigation processes |
| Planning and execution of audit activities to ensure that the company’s activities are carried out in accordance with the legislation |
8. ISSUES RELATED TO THE PROTECTION OF PERSONAL DATA
8.1. 8.1. Ensuring the Security of Personal Data
In accordance with Article 12 of the Law, our company takes the necessary measures, depending on the nature of the data to be protected, to prevent unlawful disclosure, access, transfer of personal data or security deficiencies that may occur in other ways. In this context, our Company takes administrative measures and carries out inspections or has them carried out to ensure the necessary security level in accordance with the guides published by the Personal Data Protection Committee (“Committee”).
8.2. 8.2. Protection of Special Personal Data
The law attaches special importance to certain personal data due to the risk of causing victimization or discrimination when processed unlawfully. These data; Data regarding race, ethnicity, political thought, philosophical belief, religion, sect or other beliefs, appearance and clothing, association, foundation or union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data.
Trakya Grup acts sensitively in the protection of special personal data, which are determined as “special nature” by the Law and processed in accordance with the law. In this context, the technical and administrative measures taken by our Company to protect personal data are carefully implemented in terms of special personal data and the necessary inspections are provided within Trakya Grup.
8.3. 8.3. Increasing Awareness and Control of Business Units on the Protection and Processing of Personal Data
Trakya Group provides necessary training to business units to increase awareness on preventing unlawful processing of personal data, unlawful access to personal data and ensuring the preservation of personal data. Trakya Group establishes the necessary systems to raise awareness of its employees about the protection of personal data and works with consultants if necessary. In this regard, our Company evaluates the participation in relevant trainings, seminars and information sessions and updates and renews its trainings in parallel with the updating of the relevant legislation.
9. STORAGE AND DESTRUCTION OF PERSONAL DATA
Our company retains personal data for the period necessary for the purpose for which they are processed and in accordance with the minimum periods stipulated in the legal legislation governing the relevant activity. In this context, our Company first determines whether a period of time is stipulated in the relevant legislation for the storage of personal data, and if a period is determined, it acts in accordance with this period. If there is no legal period, personal data is stored for the period necessary for the purpose for which they are processed. If there is no legal period, personal data is stored for the period necessary for the purpose for which they are processed. At the end of the specified storage periods, personal data is destroyed in accordance with the periodic destruction periods or the data owner’s application and with the specified destruction methods (deletion and/or destruction and/or anonymization).
In this regard, a Personal Data Storage and Destruction Policy has been prepared by our company, and you can find detailed information on the subject in the Trakya Grup Personal Data Storage and Destruction Policy.
10. RIGHTS OF PERSONAL DATA OWNERS AND THE USE OF THESE RIGHTS
Personal data owners have the following rights:
- Learning whether personal data is processed or not,
- Requesting information if personal data has been processed,
- Learning the purpose of processing personal data and whether they are used for their intended purpose,
- Knowing the third parties to whom personal data is transferred at home or abroad,
- Requesting correction of personal data in case personal data has been processed incompletely or incorrectly and requesting that the action taken in this context be notified to third parties to whom personal data has been transferred,
- Requesting the deletion or destruction of personal data in case the reasons requiring processing no longer exist, even though it has been processed in accordance with the KVK Law and other relevant legal provisions, and requesting that the action taken in this context be notified to third parties to whom personal data has been transferred,
- Objecting to the emergence of a result that is unfavorable to the individual by analyzing the processed data exclusively through automatic systems,
- Requesting compensation for the damage in case of damage due to illegal processing of personal data,
10.2. 10.2. Exercise of Personal Data Owner’s Rights
In accordance with your legal rights listed in Article 10 of this Policy and stipulated in the relevant law and other legislation, you can personally submit your requests to our address above, or have them delivered through a notary. In addition, in accordance with Article 5 of the “Communiqué on the Procedures and Principles of Application to the Data Controller”, by using the registered e-mail (KEP) address, secure electronic signature, mobile signature or the e-mail address you have previously notified our Company and registered in our systems, info@trakyagrup You can send it to .com.tr.
It is not possible for third parties to make requests on behalf of personal data owners. In order for a person other than the personal data owner to make a request, there must be a special power of attorney issued by the personal data owner on behalf of the person making the application.
In their application to exercise their rights, personal data owners will be able to use the Application Form for Applications to be Made to the Data Controller by the Relevant Person (Personal Data Owner) in accordance with the Personal Data Protection Law No. 6698, prepared by our Company. The application method to be made in this form is also explained in detail.
11.3. 11.3. Personal Data Owner’s Right to Complain to the KVK Board
In cases where the personal data owner’s application is rejected, the response is found insufficient, or the application is not responded to in due time, in accordance with Article 14 of the Personal Data Protection Law; He/she may file a complaint with the KVK Board within thirty days from the date of learning our company’s answer, and in any case within sixty days from the date of application.
11.4. 11.4. Our Company’s Response to Applications
As personal data owners, if you submit your requests regarding your rights to our company using the methods set out in the Personal Data Protection and Processing Policy, our company will finalize the request free of charge within thirty days at the latest, depending on the nature of the request. However, if a fee is stipulated by the Personal Data Protection Board, our company will charge the fee in the tariff determined by the Personal Data Protection Board.
Regards,
Trakya Grup Plastic Aluminum and Glass Industry Trade Limited Company