Personal Data Processing Disclosure Text
- What is personal data, and who processes it?
According to Article 3 of the Law No. 6698 on the Protection of Personal Data, personal data refers to any information relating to an identified or identifiable natural person. Our company, as the “data controller” under the Law No. 6698, will collect, store, update, process, disclose, and transfer your personal data in accordance with the law for the purpose of establishing an employment contract and creating your personal file, as well as fulfilling the requirements necessary for these purposes.
- For what purposes can your personal data be processed?
The collected personal data may be processed in accordance with Article 4 of the Law on the Protection of Personal Data for the following purposes:
- To fulfill our company’s legal obligations, to carry out necessary operational activities by our business units, to fulfill the contract, and for the legitimate interests of our company.
- To ensure the legal and commercial security of our company, Group Companies, and individuals who have established or are in a business relationship with our company or Group Companies, as well as to plan and execute human resources policies and processes.
- To carry out the activities of our company in accordance with the relevant legislation and our company’s procedures, and to conduct personnel monitoring and control activities.
- To whom and for what purposes can your processed personal data be transferred?
Your collected personal data may be transferred to:
- Real persons or legal entities,
- Our shareholders,
- Our business partners,
- Our subsidiaries and affiliates,
- Our suppliers,
- Our group companies,
- Authorized public institutions and organizations, for the purposes of fulfilling legal obligations, carrying out necessary operational activities, ensuring the legal and commercial security of our company and Group Companies, obtaining legal and commercial support from Group Companies, and planning and executing human resources policies and processes, in accordance with Articles 8 and 9 of the Law on the Protection of Personal Data.
- For what legal reasons, by what methods do we collect, and for how long do we store your personal data?
Your personal data is collected by our company for the legal reasons specified in Article 2 of this Disclosure and Consent Text, through physical and electronic means, orally or in writing during the hiring process and the continuation of the employment contract. Collected personal data may be processed and transferred in accordance with the Law on the Protection of Personal Data and for the purposes specified in Articles 2 and 3 of this Disclosure and Consent Text.
Processed data will be stored as long as the employment contract is in effect, and in the event of termination, for 15 years in accordance with SGK legislation and Occupational Health and Safety legislation, after which it will be deleted, destroyed, or anonymized.
- What special categories of personal data are collected, processed, and transferred by our company?
With your explicit consent given by approving this Disclosure and Consent Text, our company may process the following personal data for the purposes specified below:
- Blood group information, health reports, and other health data shared with us during the job application and throughout the employment contract. This data may be processed, stored, and shared domestically and internationally for providing various rights and benefits under labor law and/or your employment contract.
- Information regarding memberships to associations, foundations, and unions (including civil society organizations), criminal convictions, security measures, and if the “religion” field is present in your Turkish ID card, this data may be processed for maintaining legal records and conducting audit activities. These data may be shared with relevant Group Companies if there is an opportunity for evaluation for open positions.
- What personal data related to communication and company vehicles is processed?
For the reasons specified in Article 2 of this Disclosure and Consent Text:
- The contents of corporate email addresses, communications through company-assigned phone numbers, and use of other IT and communication tools provided by the company may be monitored, backed up, reported, and, if necessary, examined in detail without prior notice.
- In company vehicles, location tracking systems are installed, and information on location, time, and speed is collected and stored in the personnel file by the company.
Rights under the Law No. 6698 on the Protection of Personal Data:
According to Article 11 of the Law No. 6698:
- To learn whether your personal data is being processed,
- To request information if your personal data has been processed,
- To learn the purpose of processing your personal data and whether they are used for that purpose,
- To know the third parties to whom your personal data is transferred, both domestically and abroad,
- To request the correction of incomplete or inaccurate data, and that the correction be notified to third parties to whom the data has been transferred,
- To request the deletion or destruction of your personal data under the conditions set forth in Article 7 of the Law, and for the deletion and destruction to be notified to third parties,
- To object to any result arising from the exclusive automated processing of your data,
- To request compensation for damages incurred due to unlawful processing of your personal data.
- How to apply to the data controller?
You can exercise the above rights by submitting a petition with a wet signature to our company’s address or sending it by registered mail with a copy of your ID (only the front page for ID card) attached. If a third party is applying on behalf of the data subject, a special power of attorney should be provided.
Our company may request additional information from the applicant to verify their identity and may ask questions to clarify the issues stated in the application.
Requests made in accordance with the procedure will be processed free of charge within thirty days. However, if processing the request incurs additional costs, the company may charge the applicant according to the fee specified by the Personal Data Protection Authority.
Sincerely,
ÇELİK ÇESA GROUP