Employee Information Notice

PURSUANT TO THE PERSONAL DATA PROTECTION LAW NO. 6698

REGARDING THE PROTECTION OF PERSONAL DATA

EMPLOYEE INFORMATION NOTICE AND EMPLOYEE CONSENT TEXT

This notice and consent text has been prepared to inform employees about the protection, processing, transfer, storage, deletion, destruction and anonymization of personal data within the scope of Law No. 6698 on the Protection of Personal Data.

PURPOSE AND SCOPE

This information notice has been prepared in order to inform our employees, in the capacity of data controller as the employer, about the processing, protection and sharing of their personal data with third parties when necessary, within the scope of the Personal Data Protection Law No. 6698, which entered into force upon publication in the Official Gazette dated 07.04.2016.

Within the scope of this notice, detailed information is provided regarding which personal data are processed, for what purposes they are processed, to whom they may be transferred, and the rights of the data subjects.

DEFINITIONS AND ABBREVIATIONS

In this Information Notice;

PERSONAL DATA OF EMPLOYEES BEING PROCESSED

Within the scope of the activities carried out by our Company, the following personal data categories belonging to employees are processed:

Identity Information: Name, surname, Turkish ID number, nationality, place and date of birth, marital status, gender, identity document details, signature data

Contact Information: Address, telephone number, e-mail address, emergency contact information

Financial Information: Salary, payroll information, bank account details, expense records, execution and lien information

Personnel Information: Employment contract, job application form, CV, performance records, leave information, disciplinary records, entry-exit records

Legal Transaction Information: Information in correspondence with judicial authorities, litigation files, enforcement proceedings

Security Information: Camera recordings, visitor records, system login-logout logs, internet access logs, IP records

Special Categories of Personal Data: Health information, disability status, blood type, criminal record information

Physical Space Security Information: Camera recordings, entry-exit logs

Education Information: Diploma information, certificates, training participation records

Family Information: Information regarding spouse and children

Employment Information: Title, position, department, working hours, duties and responsibilities

4. CONDITIONS FOR PROCESSING PERSONAL DATA

An employee’s explicit consent is only one of the legal grounds that makes lawful processing of personal data possible. If one of the conditions below exists, our Company may process employee personal data without seeking explicit consent.

Except for explicit consent, one or more of the following conditions may constitute the legal basis of the same personal data processing activity.

5. PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA

Special importance is attributed under the Law to sensitive personal data because unlawful processing may cause victimization or discrimination. Such “special categories” include data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, association, foundation or union membership, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Special categories of personal data are processed by our Company in accordance with the principles stated in this Policy, by taking all necessary administrative and technical measures including the methods determined by the Board, and where the following conditions exist:

• Special categories of personal data other than health and sexual life may be processed without explicit consent where clearly stipulated in laws. Otherwise, explicit consent of employees is obtained.
• Special categories of personal data relating to health and sexual life may be processed without explicit consent by persons under confidentiality obligation or authorized institutions and organizations for purposes such as public health protection, preventive medicine, medical diagnosis, treatment and care services, and planning and management of health services and financing. Otherwise, explicit consent of employees is obtained.

PURPOSES OF PROCESSING PERSONAL DATA

Employee personal data are processed for the following purposes:

• Execution of employment contracts
• Carrying out human resources processes
• Managing payroll and financial processes
• Ensuring compliance with legal obligations
• Ensuring occupational health and safety
• Planning and execution of training processes
• Performance evaluation processes
• Ensuring company security
• Execution of internal audit processes
• Strategic planning and business development activities

TRANSFER OF PERSONAL DATA

Employee personal data may be transferred, in compliance with the law and by taking the necessary security measures, to the following persons and institutions:

• Authorized public institutions and organizations
• Social security institutions
• Banks and financial institutions
• Insurance companies
• Information technology service providers
• Legal, financial and tax advisors
• Third-party service providers

In data transfers carried out domestically or abroad, the provisions of Articles 8 and 9 of the Law are complied with.

METHODS OF COLLECTION OF PERSONAL DATA AND LEGAL GROUNDS

Personal data are collected through physical and electronic environments such as:

• Employment contracts
• Job application forms
• Human resources processes
• Company internal software systems
• E-mail and communication channels
• Camera and security systems
• Payroll and personnel records

Collected personal data are processed based on legal grounds such as legal obligations, contractual necessity, and legitimate interests.

OBLIGATION TO INFORM

In accordance with Article 10 of the Personal Data Protection Law No. 6698, our Company fulfills its obligation to inform by providing data subjects with information regarding:

• The identity of the data controller
• The purposes for which personal data are processed
• To whom and for what purposes the processed personal data may be transferred
• The method and legal grounds of data collection
• The rights of the data subject listed in Article 11 of the Law

The obligation to inform is fulfilled through information notices, contracts, forms, and various communication channels such as e-mail, SMS, and written notifications.

In necessary cases, layered information methods may also be used.

RETENTION OF PERSONAL DATA

Personal data processed by our Company are retained for the period stipulated in the relevant legislation or for the period necessary for the purposes for which they are processed.

In this context, our Company first determines whether a retention period is prescribed in the relevant legislation; if a period is prescribed, it acts in accordance with this period. If there is no legal period, personal data are retained for the period necessary for the purpose for which they are processed.

At the end of the retention periods, personal data are destroyed by appropriate methods in accordance with periodic destruction periods or upon the request of the data subject.

DELETION, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA

In accordance with Article 7 of the Law, personal data are deleted, destroyed, or anonymized by our Company ex officio or upon the request of the data subject in cases where the reasons requiring their processing cease to exist.

Deletion of personal data means rendering personal data inaccessible and unusable for relevant users.

Destruction of personal data means rendering personal data inaccessible, irretrievable, and unusable by anyone.

Anonymization of personal data means rendering personal data impossible to associate with an identified or identifiable natural person, even by matching with other data.

During these processes, our Company takes into account the provisions set forth in the relevant legislation and the principles determined by the Personal Data Protection Board.

MEASURES TAKEN FOR THE PROTECTION OF PERSONAL DATA

Our Company takes the necessary technical and administrative measures to ensure the appropriate level of security in order to prevent unlawful processing of personal data, prevent unlawful access to personal data, and ensure the preservation of personal data.

RIGHTS OF THE DATA SUBJECT

In accordance with Article 11 of the Law, employees have the following rights:

• To learn whether personal data are processed
• To request information regarding processing
• To learn the purpose of processing and whether they are used appropriately
• To know third parties to whom data are transferred
• To request correction of incomplete or incorrect data
• To request deletion or destruction of personal data
• To request notification of transactions made to third parties
• To object to results arising from automated systems
• To request compensation for damages

APPLICATION METHODS

Data subjects may submit their requests regarding their rights listed above to our Company using the following methods:

Your applications will be concluded as soon as possible and within a maximum of 30 (thirty) days depending on the nature of your request.

Applications are generally processed free of charge. However, if the process requires an additional cost, a fee may be charged according to the tariff determined by the Personal Data Protection Board.

If the application is accepted, the request will be fulfilled promptly. If rejected, the reason for rejection will be notified to the applicant in writing or electronically.

In case the application is rejected, the response is found insufficient, or no response is given within the legal period, the data subject has the right to file a complaint to the Personal Data Protection Board within 30 days from the date of learning the response, and in any case within 60 days from the application date.

DATA CONTROLLER IDENTITY AND CONTACT INFORMATION

This information notice has been prepared by Çağ Çelik - Ceyhun Günen, established in Türkiye, in the capacity of “Data Controller”, to inform the relevant data subjects.