Our Policies

Personal Data Protection Law Policy

TAŞKINLAR İNŞAAT TAAHHÜT VE TİCARET A.Ş. - PERSONAL DATA PROTECTION POLICY

I. DATA PRIVACY COMMITMENT

1.1. This Personal Data Protection Policy (the “Policy”) sets out the principles to be observed within and/or by Taşkınlar İnşaat Taah. Tic. A.Ş. (the “Company”) in fulfilling its obligations to protect Personal Data and in Processing Personal Data in accordance with the applicable legislation, in particular Law No. 6698 on the Protection of Personal Data.

1.2. The Company undertakes to act in accordance with this Policy and with the procedures to be implemented in connection with this Policy with respect to the Personal Data it holds.

II. PURPOSE OF THE POLICY

The main purpose of this Policy is to set out the principles governing the methods and processes for the Processing and protection of Personal Data by the Company.

III. SCOPE OF THE POLICY

3.1. This Policy covers, and applies to, all activities relating to the Personal Data processed by the Company.

3.2. This Policy does not apply to data that does not qualify as Personal Data.

3.3. In the event of any inconsistency between the PDP Regulations and this Policy, the PDP Regulations shall prevail.

IV. DEFINITIONS

The definitions used in this Policy have the following meanings:

“Explicit Consent” means consent relating to a specific matter, based on information and given of one’s own free will.

“Anonymisation” means rendering Personal Data incapable of being associated in any way with an identified or identifiable natural person, even when matched with other data.

“Obligation to Inform” means the obligation of the Data Controller, or the person authorised by it, to provide information to the Data Subject under Article 10 of the KVKK at the time the Personal Data is obtained.

“Personal Data” means any information relating to an identified or identifiable natural person (within the scope of this Policy, the term “Personal Data” shall, to the extent appropriate, also include the “Special Categories of Personal Data” defined below).

“Processing of Personal Data” means any operation performed on data, such as the collection, recording, storage, preservation, alteration, reorganisation, disclosure, transfer, takeover, making available, classification or blocking of the use of Personal Data, whether by fully or partly automated means or by non-automated means provided that they form part of a data filing system.

[“Committee” means the committee responsible for the implementation of this Policy and of the PDP Procedures to be applied in connection with this Policy.]

“Board” means the Personal Data Protection Board.

“Authority” means the Personal Data Protection Authority.

“KVKK” means Law No. 6698 on the Protection of Personal Data.

“PDP Regulations” means Law No. 6698 on the Protection of Personal Data and other relevant legislation on the protection of Personal Data; binding decisions, principle decisions, provisions and instructions issued by regulatory and supervisory authorities, courts and other official authorities; applicable international agreements on data protection; and all other legislation of any kind.

“PDP Procedures” means the procedures setting out the obligations that the Company, its employees, [the Committee and/or the Data Controller Representative] must comply with under this Policy.

“Special Categories of Personal Data” means data relating to a person’s race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

“Erasure or Deletion” means rendering Personal Data inaccessible and non-reusable in any way for the relevant users.

“Data Processor” means a natural or legal person who processes Personal Data on behalf of the Data Controller, on the basis of the authority granted by the Data Controller.

“Data Subject” means any natural person whose Personal Data is processed by or on behalf of the Company.

“Data Controller” means the natural or legal person who determines the purposes and means of the Processing of Personal Data and who is responsible for establishing and managing the data filing system.

“Data Controller Contact Person” means the natural person notified by the Data Controller at the time of registration with the registry for the purpose of communication with the Authority.

[“Data Controller Representative” means the Company employee selected from within the Committee, who conducts the Company’s relations with the Authority and who is appointed by a resolution of the board of directors.]

“Destruction” means the process of rendering Personal Data inaccessible, irretrievable and non-reusable by anyone in any way.

V. PRINCIPLES OF PERSONAL DATA PROCESSING

5.1. Processing Personal Data Lawfully and in Accordance with the Rules of Good Faith

The Company processes Personal Data lawfully, in accordance with the rules of good faith and on the basis of the principle of proportionality.

5.2. Taking the Necessary Measures to Ensure that Personal Data Is Accurate and, Where Necessary, Up to Date

The Company takes all necessary measures to ensure that Personal Data is complete, accurate and up to date, and updates the relevant Personal Data where the Data Subject requests a change to the Personal Data under the PDP Regulations.

5.3. Processing Personal Data for Specified, Explicit and Legitimate Purposes

Before Personal Data is processed, the Company determines the purpose for which the Personal Data will be processed. In this context, the Data Subject is informed in accordance with the PDP Regulations and, where required, their Explicit Consent is obtained.

5.4. Personal Data Being Relevant, Limited and Proportionate to the Purposes for Which They Are Processed

The Company processes Personal Data only in the exceptional cases provided for under the PDP Regulations (Article 5.2 and Article 6.3 of the KVKK) or for the purpose covered by the Explicit Consent obtained from the Data Subject (Article 5.1 and Article 6.2 of the KVKK), and in accordance with the principle of proportionality. The Data Controller processes Personal Data in a manner suitable for achieving the specified purposes and refrains from processing Personal Data that is not relevant to, or not needed for, achieving the purpose.

5.5. Retaining Personal Data for the Period Provided for in the Relevant Legislation or Required for the Purpose for Which They Are Processed

5.5.1. The Company retains Personal Data only for as long as necessary in line with the purpose. Where the Company wishes to retain Personal Data for longer than the period provided for in the PDP Regulations or required by the purpose of the Processing of Personal Data, the Company acts in accordance with the obligations set out in the PDP Regulations.

5.5.2. Once the period required by the purpose of the Processing of Personal Data has expired, the Personal Data is Erased or Anonymised. In such case, the Company also ensures that the third parties to which it has transferred the Personal Data Erase, Destroy or Anonymise the Personal Data.

VI. PROCESSING OF PERSONAL DATA

Personal Data may be processed by the Company only in accordance with the procedures and principles set out below.

6.1. Explicit Consent

6.1.1. Personal Data is processed after the Data Subjects have been informed in fulfilment of the Obligation to Inform and where the Data Subjects give their Explicit Consent.

6.1.2. Within the scope of the Obligation to Inform, the Data Subjects are notified of their rights before their Explicit Consent is obtained.

6.1.3. The Data Subject’s Explicit Consent is obtained by methods compliant with the PDP Regulations. Explicit Consents are retained by the Company in a verifiable manner for the period required under the PDP Regulations.

6.1.4. [The Data Controller Representative and/or the Committee] is responsible for ensuring, for all Personal Data Processing activities, that the Obligation to Inform is fulfilled, that Explicit Consent is obtained where necessary, and that the Explicit Consent obtained is retained. All employees of departments that process Personal Data are obliged to comply with the instructions of [the Data Controller Representative and/or the Committee], with this Policy and with the PDP Procedures annexed to this Policy.

6.2. Processing of Personal Data Without Explicit Consent

6.2.1. Where the PDP Regulations provide for the Processing of Personal Data without Explicit Consent (Article 5.2 of the KVKK), the Company may process Personal Data without obtaining the Data Subject’s Explicit Consent. Where Personal Data is processed in this manner, the Company processes the Personal Data within the limits set by the PDP Regulations. In this context:

6.2.1.1. Personal Data may be processed by the Company without Explicit Consent where this is expressly provided for by law.

6.2.1.2. Personal Data may be processed by the Company without Explicit Consent where this is necessary to protect the life or physical integrity of the Data Subject, who is unable to give consent due to actual impossibility or whose consent is not legally valid, or of another person.

6.2.1.3. Personal Data may be processed by the Company without the Data Subjects’ Explicit Consent where it is necessary to process the Personal Data of the parties to a contract, provided that this is directly related to the conclusion or performance of that contract.

6.2.1.4. Personal Data may be processed by the Company without the Data Subjects’ Explicit Consent where the Processing of Personal Data is necessary for the Company to fulfil its legal obligation.

6.2.1.5. Personal Data that has been made public by the Data Subject may be processed by the Company without obtaining Explicit Consent.

6.2.1.6. Personal Data may be processed by the Company without obtaining Explicit Consent where the Processing of Personal Data is necessary for the establishment, exercise or protection of a right.

6.2.1.7. Personal Data may be processed by the Company without Explicit Consent where data processing is necessary for the legitimate interests of the Company, provided that this does not harm the fundamental rights and freedoms of the Data Subject.

VII. PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA

7.1. Special Categories of Personal Data may be processed only where the Data Subject has given Explicit Consent or, in respect of Special Categories of Personal Data other than data concerning sexual life and personal health, where processing is expressly required by law.

7.2. Personal Data concerning health and sexual life may be processed without obtaining Explicit Consent only by persons under a duty of confidentiality (e.g. the Company physician) or by authorised institutions and organisations, for the purposes of protecting public health, preventive medicine, medical diagnosis, the provision of treatment and care services, and the planning and management of health services and their financing.

7.3. When Special Categories of Personal Data are processed, the measures determined by the Board are taken.

7.4. With respect to employees involved in the processes of Processing Special Categories of Personal Data, the Company shall:

7.4.1. Provide regular training on the PDP Regulations and on the security of Special Categories of Personal Data.

7.4.2. Enter into confidentiality agreements.

7.4.3. Clearly define the scope and duration of the authorisations of users who have access to Special Categories of Personal Data.

7.4.4. Carry out periodic authorisation checks.

7.4.5. Immediately revoke the authorisations in this area of employees who change roles or leave the Company, and immediately take back the inventory allocated to the relevant employee.

7.5. Where Special Categories of Personal Data are transferred to electronic media, the Company shall, with respect to the electronic media in which Special Categories of Data are processed, stored and/or accessed:

7.5.1. Store Special Categories of Personal Data using cryptographic methods.

7.5.2. Keep cryptographic keys in secure and separate environments.

7.5.3. Securely log the transaction records of all actions performed on Special Categories of Personal Data.

7.5.4. Continuously monitor security updates for the environments in which Special Categories of Personal Data are held, regularly carry out or have carried out the necessary security tests, and record the test results.

7.5.5. Where Special Categories of Personal Data are accessed through software, set up user authorisations for that software, regularly carry out or have carried out security tests of such software, and record the test results.

7.5.6. Where Special Categories of Personal Data are accessed remotely, provide at least a two-factor authentication system.

7.6. Where Special Categories of Personal Data are processed in physical media, the Company shall, with respect to the physical environments in which the Data is processed, stored and/or accessed:

7.6.1. Ensure that adequate security measures are taken according to the nature of the environment in which Special Categories of Personal Data are held (against electrical leakage, fire, flooding, theft, etc.).

7.6.2. Ensure the physical security of these environments and prevent unauthorised entry and exit.

7.7. Where Special Categories of Personal Data are transferred, the Data Controller shall:

7.7.1. Use an encrypted corporate e-mail address or a Registered Electronic Mail (“KEP”) account where Special Categories of Personal Data need to be transferred by e-mail.

7.7.2. Encrypt the data using cryptographic methods and keep the cryptographic key in a separate environment where Special Categories of Personal Data need to be transferred via media such as portable memory devices, CDs or DVDs.

7.7.3. Carry out the transfer by setting up a VPN between the servers or by the SFTP method where Special Categories of Personal Data need to be transferred between servers located in different physical environments.

7.7.4. Take the necessary measures against risks such as the theft or loss of documents or their being seen by unauthorised persons, and send the documents in the format of “classified documents”, where Special Categories of Personal Data need to be transferred on paper.

7.8. In addition to the provisions above, the Company shall act in accordance with the PDP Regulations, in particular the Personal Data Security Guide published by the Board, regarding ensuring the security of Personal Data, including Special Categories of Data.

7.9. In every case requiring the Processing of Special Categories of Personal Data, the relevant employee informs [the Data Controller Representative and/or the Committee].

7.10. Where it is unclear whether certain data constitutes Special Categories of Personal Data, the relevant department obtains the opinion of [the Data Controller Representative and/or the Committee].

VIII. RETENTION PERIOD OF PERSONAL DATA

Personal Data is kept within the Company for the relevant statutory retention periods and is retained for the period necessary to carry out the activities related to such data and to achieve the purposes set out in this Policy. Personal Data whose purpose of use has ended and whose statutory retention period has expired is erased, destroyed or anonymised by the Company in accordance with Article 7 of the KVKK.

IX. ERASURE, DESTRUCTION AND ANONYMISATION OF PERSONAL DATA

9.1. When the legitimate purpose for the Processing of Personal Data ceases to exist, the relevant Personal Data is Erased, Destroyed or Anonymised. Cases in which Personal Data must be Erased, Destroyed or Anonymised are monitored by [the Data Controller Representative and/or the Committee].

9.2. [The Data Controller Representative and/or the Committee] is responsible for operating the Erasure, Destruction and Anonymisation processes. In this context, the necessary procedure is established by [the Data Controller Representative and/or the Committee].

9.3. The Company does not retain Personal Data on the basis that it may be used in the future.

9.4. All Erasure, Destruction and Anonymisation activities to be carried out by the Company on Personal Data shall be performed in accordance with the principles set out in the Personal Data Retention, Destruction and Anonymisation Policy.

X. TRANSFER OF PERSONAL DATA AND PROCESSING OF PERSONAL DATA BY THIRD PARTIES

The Company may, in line with the purposes of the Processing of Personal Data and by taking the necessary measures, transfer Personal Data to a third-party natural or legal person located in Turkey and/or abroad in accordance with the PDP Regulations. In such case, the Company ensures that the third parties to which it transfers Personal Data also comply with this Policy. In this context, the necessary protective provisions are added to the contracts concluded with the third party. The clause to be added to contracts concluded with third parties to which any Personal Data is transferred is obtained from [the Data Controller Representative and/or the Committee]. Each employee is obliged to follow the process set out in this Policy whenever Personal Data is to be transferred. If the third party to which Personal Data is transferred requests an amendment to the clause provided by [the Data Controller Representative and/or the Committee], the employee immediately notifies [the Data Controller Representative and/or the Committee] of the situation.

10.1. Transfer of Personal Data to Third Parties Located in Turkey

10.1.1. Personal Data may be transferred by the Company to third parties located in Turkey without Explicit Consent in the exceptional cases set out in Article 5.2 of the KVKK and, provided that adequate measures are taken, in Article 6.3, or, in other cases, subject to obtaining the Data Subject’s Explicit Consent (Article 5.1 and Article 6.2 of the KVKK).

10.1.2. Company employees and [the Data Controller Representative or the Company] are jointly and severally responsible for ensuring that the transfer of Personal Data to third parties located in Turkey complies with the PDP Regulations.

XI. THE COMPANY’S OBLIGATION TO INFORM

11.1. In accordance with Article 10 of the KVKK, the Company informs Data Subjects before Processing Personal Data. In this context, the Company fulfils the Obligation to Inform at the time the Personal Data is obtained. The notice to be given to Data Subjects under the Obligation to Inform includes the following elements, respectively:

11.1.1. The identity of the Data Controller and of its representative, if any,

11.1.2. The purpose for which the Personal Data will be processed,

11.1.3. To whom and for what purpose the processed Personal Data may be transferred,

11.1.4. The method and legal basis of the collection of Personal Data,

11.1.5. The rights of Data Subjects listed in Article 11 of the KVKK.

11.2. In accordance with Article 20 of the Constitution of the Republic of Turkey and Article 11 of the KVKK, the Company provides the necessary information where the Data Subject requests information.

11.3. Where requested by Data Subjects in accordance with the PDP Regulations, the Company notifies the Data Subject of the Personal Data of the Data Subject that it processes.

11.4. The employee overseeing the relevant process and [the Data Controller Representative or the Company] are jointly and severally responsible for ensuring that the necessary Obligation to Inform is fulfilled before Personal Data is processed. In this context, the necessary PDP Procedure is established by [the Data Controller Representative and/or the Committee] for the purpose of reporting each new data processing activity to [the Data Controller Representative and/or the Committee].

11.5. Where the Data Processor is a third party other than the Company, the third party must undertake, by means of a written contract and before the Processing of Personal Data begins, that it will act in accordance with the obligations set out above. The clause to be added to contracts in cases where third parties transfer Personal Data to the Company is obtained from [the Data Controller Representative and/or the Committee]. Each employee is obliged to follow the process set out in this Policy whenever Personal Data is transferred to the Company by a third party. If the third party transferring the Personal Data requests an amendment to the clause provided by [the Data Controller Representative and/or the Committee], the employee immediately notifies [the Data Controller Representative and/or the Committee] of the situation.

XII. RIGHTS OF DATA SUBJECTS

12.1. The Company responds, in accordance with the PDP Regulations, to the following requests of Data Subjects whose Personal Data it holds, concerning themselves:

12.1.1. To learn whether Personal Data is processed by the Company,

12.1.2. To request information in this regard if their Personal Data has been processed,

12.1.3. To learn the purpose of the processing of Personal Data and whether it is used in accordance with that purpose,

12.1.4. To know the third parties in Turkey or abroad to which Personal Data has been transferred,

12.1.5. To request the rectification of Personal Data if it has been processed incompletely or inaccurately by the Company,

12.1.6. To request the Erasure or Destruction of Personal Data by the Company, to be assessed within the principles of purpose, duration and legitimacy, where the reasons requiring the Processing of Personal Data have ceased to exist,

12.1.7. To request that, where Personal Data is rectified, Erased or Destroyed by the Company, such operations be notified to the third parties to which the Personal Data has been transferred,

12.1.8. To object to a result arising to the detriment of the Data Subject by means of the analysis of the processed Personal Data exclusively through automated systems,

12.1.9. To claim compensation for damage where the Data Subject suffers damage due to the unlawful processing of Personal Data.

Where Data Subjects wish to exercise their rights and/or consider that the Company has not acted in accordance with this Policy when processing Personal Data, you may submit your requests and applications to our Company by completing the Taşkınlar İnşaat Taah. Tic. A.Ş. Data Subject Application Form, or by preparing your own request in a manner meeting the requirements set by the Personal Data Protection Authority, and sending it to the contact addresses below by hand delivery with a petition bearing a wet signature, through a notary public or by registered mail with return receipt, or by using a registered electronic mail (KEP) address, a secure electronic signature, a mobile signature or your e-mail address previously notified to us and registered in our system. Please verify the current application methods in the legislation before applying.

Postal address : Oruç Reis Mah. Tekstilkent Cad. No.10-AM/201 Esenler - İstanbul

E-mail address : kvkk@taskinlar.com.tr

KEP address : taskinlar@hs01.kep.tr

12.2. Where Data Subjects submit their requests concerning the rights listed above to the Company in writing, the Company concludes the request free of charge within thirty days at the latest, depending on the nature of the request. If concluding the requests entails an additional cost for the Data Controller, the Data Controller may charge the fees set out in the tariff determined by the Personal Data Protection Board.

XIII. DATA MANAGEMENT AND SECURITY

13.1. The Company [appoints a Data Controller Representative and/or establishes a Committee] to fulfil its obligations under the PDP Regulations, to ensure and supervise the implementation of the PDP Procedures necessary for the application of this Policy, and to make recommendations regarding their operation.

13.2. All employees involved in the relevant process are jointly and severally responsible for the protection of Personal Data in accordance with this Policy and the PDP Procedures.

13.3. The Company’s Personal Data Processing activities are monitored through technical systems according to technological capabilities and implementation costs.

13.4. Personnel with knowledge of technical matters relating to Personal Data Processing activities are employed.

13.5. Company employees are informed and trained on the protection and lawful processing of Personal Data.

13.6. The necessary PDP Procedure is established to provide access to Personal Data for those Company employees who need access to such Personal Data.

13.7. Company employees may access Personal Data only within the scope of the authorisation defined for them and in accordance with the relevant PDP Procedure. Any access and processing carried out by an employee in excess of their authorisation is unlawful and constitutes just cause for termination of the employment contract.

13.8. Where a Company employee suspects that the security of Personal Data is not adequately ensured, or detects such a security vulnerability, they immediately notify [the Data Controller Representative and/or the Committee] of the situation.

13.9. A detailed PDP Procedure on the security of Personal Data is established by [the Data Controller Representative and/or the Committee].

13.10. Each person to whom a Company device is allocated is responsible for the security of the devices allocated for their use.

13.11. Each Company employee, or person working within the Company, is responsible for the security of the physical files within their area of responsibility.

13.12. Where security measures are requested, or will additionally be requested, under the PDP Regulations for the security of Personal Data, all employees are obliged to comply with the additional security measures and to ensure the continuity of such security measures.

13.13. Software and hardware including virus protection systems and firewalls are installed within the Company, in line with technological developments, so that Personal Data is stored in secure environments.

13.14. Backup programs are used and adequate security measures are taken within the Company to prevent the loss of or damage to Personal Data.

13.15. The necessary measures shall be taken within the Company to protect documents containing Personal Data with cryptographic (encrypted) systems. In this context, Personal Data shall not be stored in shared areas or on the desktop. Files, folders and similar documents containing Personal Data shall not be moved to the desktop or to a shared folder, and information on Company computers may not be transferred to USB or other devices or taken outside the Company.

13.16. [The Data Controller Representative and/or the Committee] is responsible for taking technical and administrative measures for the protection of all Personal Data within the Company, continuously monitoring developments and administrative activities, preparing the necessary PDP Procedures, announcing them within the Company, and ensuring and supervising compliance with them. In this context, [the Committee and/or the Data Controller Representative] organises the necessary training to raise employees’ awareness.

13.17. Where a department within the Company processes Special Categories of Personal Data, that department shall be informed by [the Committee and/or the Data Controller Representative] about the importance, security and confidentiality of the Personal Data it processes, and the relevant department shall act in accordance with the instructions of [the Committee and/or the Data Controller Representative]. Authorisation to access Special Categories of Personal Data shall be granted only to a limited number of employees, and the list of such employees shall be kept and monitored by [the Committee and/or the Data Controller Representative].

13.18. All Personal Data processed within the Company is regarded by the Company as “Confidential Information”.

13.19. Company employees have been informed that their obligations regarding the security and confidentiality of Personal Data will continue after the termination of the employment relationship, and an undertaking to comply with these rules has been obtained from Company employees.

XIV. TRAINING

14.1. The Company provides its employees with the necessary training on the protection of Personal Data within the scope of the Policy, the PDP Procedures annexed to it and the PDP Regulations.

14.2. The training specifically addresses the definitions of Special Categories of Personal Data and the practices for their protection.

14.3. Where a Company employee accesses Personal Data physically or in a computer environment, the Company provides that employee with training specific to such access (for example, the computer program being accessed).

XV. AUDIT

The Company has the right to audit, regularly, at any time and ex officio, without any prior notice, whether all of its employees, departments and contractors act in accordance with this Policy and the PDP Regulations, and carries out the necessary routine audits in this context. [The Committee and/or the Data Controller Representative] establishes a PDP Procedure for these audits, submits it to the Board of Directors for approval and ensures the implementation of that procedure.

XVI. BREACHES

16.1. Each Company employee reports to [the Data Controller Representative and/or the Committee] any work, transaction or action that they consider to be contrary to the procedures and principles set out in the PDP Regulations and in this Policy. In this context, [the Data Controller Representative and/or the Committee] draws up an action plan for the relevant breach in accordance with this Policy and the PDP Procedures.

16.2. Following the notifications made, [the Data Controller Representative and/or the Committee] prepares the notification of the breach to be made to the Data Subject or the Authority, taking into account the provisions of the legislation in force on the matter, in particular the PDP Regulations. In such case, the Data Controller Contact Person conducts the correspondence and communication with the Authority.

XVII. AMENDMENTS TO THE POLICY

17.1. This Policy may be amended by the Company from time to time with the approval of the Board of Directors.

17.2. The Company shares the updated Policy text with its employees by e-mail in a manner that allows the amendments made to the Policy to be reviewed, or makes it available to employees and Data Subjects via the web address below. Relevant web address: http://taskinlar.com.tr/

XVIII. EFFECTIVE DATE OF THE POLICY

This version of the Policy entered into force on 01/03/2021 upon approval by the Company’s Board of Directors.

Website Privacy Notice and Privacy Policy

PRIVACY NOTICE AND PRIVACY POLICY

This Privacy Notice and Privacy Policy (the “Privacy Policy”) is issued by Taşkınlar İnşaat Taah. ve Tic. A.Ş (“TAŞKINLAR İNŞAAT”) within the scope of our duty to inform under Law No. 6698 on the Protection of Personal Data (“KVKK”), and aims to explain the data collected through the website at http:/taskinlar.com.tr/ (hereinafter also referred to as the “Site”) from you, the visitors/users of the Site, in the course of operating the Site, and how we use such data. This Privacy Policy relates exclusively to Personal Data; data that is not deemed Personal Data falls outside the scope of this policy.

CHANGES TO THE PRIVACY POLICY

Each time you use the Site, you will be subject to the Privacy Policy in force at that time, and you should review this text on each visit to the Site to make sure that you accept its terms. TAŞKINLAR İNŞAAT may amend this Privacy Policy from time to time. The current Privacy Policy shall take effect as of the moment it is published on the Site. If you have any questions regarding this Privacy Policy or any issues not addressed herein, please contact TAŞKINLAR İNŞAAT through the communication channels set out in this Privacy Policy.

2. INFORMATION ABOUT YOUR PERSONAL DATA

2.1. Identity of the Data Controller

With respect to the Personal Data you share through the channels described under this section, the Data Controller under the KVKK is Taşkınlar İnşaat Taah. ve Tic. A.Ş, registered with the Istanbul Trade Registry under registration number 237161-0, with Mersis number 0828004282200017, and having its registered office at Oruç Reis Mahalesi Tekstilkent Cad. No.10AM/201 Esenler/İstanbul.

2.2. Collection of Personal Data, Legal Grounds and Purposes of Processing

In all of its Personal Data processing activities, TAŞKINLAR İNŞAAT acts in compliance with all obligations required under the relevant legislation, in particular the KVKK, and takes the necessary security measures to ensure that your Personal Data is stored securely and to prevent its unlawful use. Within the scope of the activities carried out on the Site, your Personal Data is collected electronically by TAŞKINLAR İNŞAAT, by automated or non-automated means, through the channels listed below:

• the “Contact Us” form on the Site, which enables you to contact TAŞKINLAR İNŞAAT and to submit your opinions and suggestions;
• cookies and similar technologies used on the Site.

Your Personal Data may be processed in accordance with this Privacy Policy for the purposes of your visit to the Site; enabling you to benefit from the services offered on the Site; following up on the opinions and suggestions you convey to us through the Site and on your questions and answers concerning our projects/services, and making the necessary referrals; system administration, identifying problems and improving the Site; sending you important updates regarding changes to the Site and its terms; and responding to requests from official authorities or to communication matters. In this context, your Personal Data may be processed by TAŞKINLAR İNŞAAT without seeking your Explicit Consent under Article 5/2 of the KVKK where processing is expressly provided for by law, is related to the establishment or performance of a contract, is necessary for the fulfilment of our legal obligations, is necessary for the establishment, exercise or protection of a right, is necessary for the legitimate interests of the Company, or where the data has been made public by the user himself/herself.

2.3. Sharing of Your Personal Data with Third Parties and Transfer Abroad

Your Personal Data may be transferred by TAŞKINLAR İNŞAAT, within and limited to the purposes stated in this Privacy Policy, in particular enabling users to benefit from the Site and the activities carried out on the Site and ensuring the data security of the Site, to third parties located in Turkey and abroad from whom we obtain storage, archiving and information technology support (such as servers, hosting, software, cloud computing and website content managers), to business partners, service providers, consultancy firms and other related parties to which transfer is necessary for the specified purposes, and to official institutions and organisations authorised to resolve disputes, such as courts or arbitral tribunals, including law enforcement authorities.

2.4. Protection of Your Data

TAŞKINLAR İNŞAAT endeavours to maintain appropriate physical, technical and administrative security for its workplaces and information systems, and thereby to prevent the loss, misuse, unauthorised access, disclosure or alteration of Personal Data. We protect our website and our other systems by taking the necessary technical and organisational measures against loss, destruction, unauthorised access, and alteration or disclosure of your Personal Data by unauthorised persons. Although we make every effort to protect your Personal Data when you submit it, no data transmission over the internet or any public network can be guaranteed to be 100% secure. Where links to other applications are provided through the Site, TAŞKINLAR İNŞAAT accepts no responsibility for the privacy policies or content of such applications.

2.5. Data Processing Period

The Personal Data you have shared with TAŞKINLAR İNŞAAT through the channels mentioned in this Privacy Policy will be processed in compliance with the periods mandated by the legislation on the protection of personal data, in particular the KVKK, and by other legislation, and in any event for as long as the processing purposes set out in this Privacy Policy continue to exist.

2.6. Your Rights

Pursuant to Article 11 of the KVKK, by applying to our Company, you have the right to:

• learn whether your Personal Data is being processed;
• request information in this regard if your Personal Data has been processed;
• withdraw any permission you have previously given us regarding the use of your Personal Data;
• learn the purpose of processing of your Personal Data and whether it is used in accordance with its purpose;
• know the third parties in Turkey or abroad to whom Personal Data has been transferred;
• request the rectification of Personal Data if it has been processed incompletely or inaccurately;
• request its erasure or destruction, to be assessed within the principles of purpose, duration and legitimacy;
• request that the rectification, erasure or destruction of Personal Data be notified to the third parties to whom the Personal Data has been transferred;
• object to a result arising to your detriment where the processed data is analysed exclusively by means of automated systems;
• claim compensation for damages if you suffer damage due to the unlawful processing of Personal Data.

In this context, you may submit your requests regarding the rights listed above to the Company, together with information and documents establishing your identity, either by completing the application form on our Website or by preparing your own request in a manner that meets the conditions set by the Personal Data Protection Authority, through the methods specified below:

• in person with a wet signature, or through a notary public, to our postal address below:

  Address: : Oruç Reis Mahalesi Tekstilkent Cad. No.10-AM/201 Esenler/İstanbul

• to our KEP (registered electronic mail) address or e-mail address below, by an e-mail sent from the e-mail address you have previously notified to us and that is registered in our system (please check the e-mail address registered in our system), or with a secure electronic signature or mobile signature:

  E- mail address : kvkk@taskinlar.com.tr

  KEP address : taskinlar@hes01.kep.tr

Please verify the current application methods and application content requirements in the legislation beforehand. Applications that do not comply with the content requirements set by the Authority, or that are submitted by methods not accepted by the Authority, will not be accepted. TAŞKINLAR İNŞAAT will conclude your request free of charge as soon as possible, depending on its nature, and within 30 (thirty) days at the latest. If fulfilling your requests gives rise to a cost, we may only charge you the fees set out in the tariff determined by the Personal Data Protection Board.

2.7. Information About Cookies

When you visit our website, our site may send a cookie to your device. This cookie is a small piece of information stored on your hard disk that informs us that your computer has accessed our website. This cookie is not capable of identifying you directly. We will process your personal information with regard to how you use our website, and we may use our cookies in line with our legitimate interests to determine which pages are the most popular and at what times site usage peaks, and also to obtain other information such as Internet Protocol (IP) addresses, referring website addresses, application activity logs and error logs, which we use to improve content and to make navigation of our website easier. If you do not wish to use cookies, you may change your browser settings to reject cookies. These settings are usually found in the “options” or “preferences” menu of your browser. You can find more information here or in your browser’s ‘Help’ menu:

• Cookie settings in Internet Explorer
• Cookie settings in Chrome
• Cookie settings in Firefox

Personal Data Retention, Destruction and Anonymisation Policy

PERSONAL DATA RETENTION, DESTRUCTION AND ANONYMISATION POLICY

I. SCOPE

• This Personal Data Retention, Destruction and Anonymisation Policy (the “Policy”) covers all departments and employees of Taşkınlar İnşaat ve Tic. A.Ş (“Taşkınlar İnşaat”) and all third parties involved in any process in which Personal Data is processed.
• This Policy covers all Destruction activities that Taşkınlar İnşaat will carry out on Personal Data and shall apply in the event of any Destruction requirement.
• This Policy shall not apply to data that does not constitute Personal Data.
• Where new legislation on the subject is introduced or the relevant legislation is amended, Taşkınlar İnşaat shall comply with the statutory requirements by updating its Policy so as to be consistent with the relevant legislation.
• Where it is concluded that there is a legal impediment to the implementation of this Policy by Taşkınlar İnşaat, Taşkınlar İnşaat may, if deemed necessary, redetermine the steps it will take.

II. DEFINITIONS

Explicit Consent:	means consent relating to a specific matter, based on information and freely given.
Recipient Group:	means the category of natural or legal persons to whom Personal Data is transferred by the Data Controller.
Rendering Anonymous or Anonymisation:	means rendering Personal Data incapable of being associated in any way with an identified or identifiable natural person, even when matched with other data.
Destruction:	means the deletion, destruction and anonymisation of Personal Data.
Relevant User:	means persons who process Personal Data within the Data Controller’s organisation or in line with the authority and instructions received from the Data Controller, excluding the person or unit responsible for the technical storage, protection and backup of the data.
Law:	means Law No. 6698 on the Protection of Personal Data (“KVKK”).
Recording Medium:	means any medium containing Personal Data processed by fully or partially automated means, or by non-automated means provided that it forms part of a Data Recording System.
Personal Data:	means any information relating to an identified or identifiable natural person (within the scope of this Policy, the term “Personal Data” shall, to the extent appropriate, also include Special Categories of Personal Data as defined below).
Personal Data Processing:	means any operation performed on data, such as the collection, recording, storage, retention, alteration, reorganisation, disclosure, transfer, takeover, making available, classification or prevention of use of Personal Data, by fully or partially automated means, or by non-automated means provided that it forms part of a data recording system.
Committee:	means the committee responsible for carrying out this Policy and the PDP Procedures to be implemented in connection with the Policy.
Board:	means the Personal Data Protection Board.
Authority:	means the Personal Data Protection Authority.
PDP Regulations:	means Law No. 6698 on the Protection of Personal Data together with the other relevant legislation on the protection of Personal Data, the binding decisions, principle decisions, provisions and instructions issued by regulatory and supervisory authorities, courts and other official bodies, applicable international agreements on data protection and any other legislation.
PDP Procedures:	means the procedures setting out the obligations that the Company, the employees, [the Committee and/or the Data Controller Representative] must comply with under this Policy.
Policy:	means the Personal Data Retention, Destruction and Anonymisation Policy on which Taşkınlar İnşaat bases the determination of the maximum period necessary for the purpose for which Personal Data is processed and the Deletion, Destruction and Anonymisation process.
Registry:	means the Data Controllers’ Registry kept by the Presidency.
Special Category of Personal Data:	means data relating to persons’ race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
Deletion or Being Deleted:	means rendering Personal Data inaccessible and non-reusable in any way for Relevant Users.
Data Inventory:	means the inventory in which the Personal Data Processing activities carried out by the Company depending on its business processes are created by associating them with the purposes of Personal Data Processing, the data category, the Recipient Group to which the Personal Data is transferred and the data subject group, and detailed by explaining the maximum period necessary for the purposes for which the Personal Data is processed, the Personal Data envisaged to be transferred abroad and the measures taken regarding data security.
Data Recording System:	means the recording system in which Personal Data is structured and processed according to specific criteria.
Data Subject:	means all natural persons whose Personal Data is processed by or on behalf of the Company.
Data Controller:	means the natural or legal person who processes Personal Data by determining the purposes and means of processing and who is responsible for establishing and managing the Data Recording System.
Data Controller Representative:	means the employee selected from within the Committee who conducts the Company’s relations with the Authority and who is appointed by a resolution of the board of directors.
Regulation:	means the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
Destroying:	means the process of rendering Personal Data inaccessible, irretrievable and non-reusable in any way by anyone.

The definitions contained in the Personal Data Protection and Privacy Policy shall also apply to this Policy.

III. PURPOSE AND SCOPE

• This Policy shall apply to the natural or legal persons responsible for the Deletion, Destruction or Anonymisation of Personal Data under the Regulation issued pursuant to Article 7 of the Law, and shall set out the principles to be complied with by Taşkınlar İnşaat and by the third parties whom Taşkınlar İnşaat has made contractually responsible.
• Pursuant to the Regulation, Taşkınlar İnşaat, as a Data Controller subject to the obligation to register with the Registry, is obliged to prepare a Policy for retaining Personal Data in accordance with the Data Inventory in its possession and for Deleting, Destroying or Anonymising it where necessary, and to act in accordance with this Policy. Within this scope, Taşkınlar İnşaat has prepared this Policy in order to fulfil the said obligations.

The following principles shall apply to the retention and destruction of Personal Data:

• The general principles set out in Article 4 of the Law and the principles set out in Article 7 of the Regulation shall be complied with.
• Taşkınlar İnşaat accepts, declares and undertakes that, when retaining, Deleting, Destroying or Anonymising Personal Data, it shall act in accordance with the security measures set out in Article 12 of the Law, the PDP Regulations and the Policy.
• Taşkınlar İnşaat undertakes that, during the Deletion, Destruction or Anonymisation of the Personal Data it holds that are processed by fully or partially automated means, or by non-automated means provided that they form part of any recording system, it shall ensure compliance with this Policy and with the tools, programs and processes to be implemented in connection with the Policy.

By this Policy, Taşkınlar İnşaat agrees to include within the scope of the Policy the Personal Data contained in the media listed below that contain Personal Data, as well as in any other media that may arise in addition to them:

• Computers/servers used on behalf of Taşkınlar İnşaat,
• Network devices,
• Shared/non-shared disk drives used for storing data on the network,
• Cloud systems,
• Mobile phones and all storage areas therein,
• Paper,
• Microfiche,
• Peripheral units such as printers and fingerprint readers,
• Magnetic tapes,
• Optical discs,
• Flash memories.

IV. CIRCUMSTANCES REQUIRING THE RETENTION AND DESTRUCTION OF PERSONAL DATA

In the event of a breach within the scope set out below, the situation shall be deemed a potential security breach and measures shall be taken by Taşkınlar İnşaat. Taşkınlar İnşaat takes all necessary technical and administrative measures for the secure retention of Personal Data and for the prevention of its unlawful processing and access.

Circumstances Requiring the Retention of Personal Data

Taşkınlar İnşaat is obliged to retain Personal Data in accordance with the legislation where (i) this is expressly provided for by law, (ii) it is necessary for the protection of the life or bodily integrity of the person, or of another person, who is unable to express consent due to actual impossibility or whose consent is not legally valid, (iii) the processing of personal data of the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract, (iv) it is necessary for compliance with a legal obligation, (v) data processing is necessary for the establishment, exercise or protection of a right, or (vi) data processing is necessary for the legitimate interests of the Data Controller, provided that it does not harm the fundamental rights and freedoms of the Data Subject. Taşkınlar İnşaat further has the right to retain Personal Data where (i) Explicit Consent has been obtained, or (ii) the exceptions set out in Articles 5(2) and 6(3) of the Law apply.

Circumstances Requiring the Destruction of Personal Data

Contravention of the Law

Taşkınlar İnşaat undertakes not to process Personal Data in a manner contrary to that set out in the Law. Unless the exceptions to the conditions for processing Personal Data and Special Categories of Personal Data under Articles 5 and 6 of the Law apply, Taşkınlar İnşaat does not retain the Personal Data of persons from whom it has not obtained Explicit Consent, other than in the exceptional cases set out in the Law. Where Taşkınlar İnşaat retains Special Categories of Personal Data, it processes such data in compliance with the PDP Regulations and with the knowledge of [the Data Controller Representative and/or the Committee]. Within this scope, it takes the measures determined or to be determined by the Board under Article 6(4) of the Law.

Cessation of the Conditions for Data Processing

Taşkınlar İnşaat is responsible for keeping the conditions for data processing up to date and shares this responsibility with all its employees. Employees may not continue to process data where all the conditions for data processing have ceased to exist. The Information Technology Department of Taşkınlar İnşaat is obliged to Delete, Destroy or Anonymise, in accordance with this Policy, the Personal Data for which the conditions have ceased to exist. Taşkınlar İnşaat accepts that the conditions for data processing have ceased to exist in the relevant circumstances listed below, which are also set out in the Regulation:

• Amendment or repeal of the PDP Regulations forming the basis for processing Personal Data,
• The contract between the parties never having been concluded, the contract being invalid, the contract terminating automatically, the contract being terminated or rescinded,
• The purpose requiring the processing of Personal Data ceasing to exist,
• The processing of Personal Data being contrary to law or to the rule of good faith,
• Where the processing of Personal Data is carried out solely on the basis of Explicit Consent, the Data Subject withdrawing their consent,
• The Data Subject submitting a duly made application regarding the Personal Data processing activity within the framework of their rights under subparagraphs (e) and (f) of Article 11 of the Law,
• Where the Data Controller rejects an application made to it by the Data Subject requesting the Deletion or Destruction of their Personal Data, where its response is found insufficient, or where it fails to respond within the period stipulated in the Law; a complaint being filed with the Board and such request being approved by the Board,
• Although the maximum period requiring the retention of Personal Data has expired, there being no condition justifying the retention of Personal Data for a longer period.

5. MEASURES TAKEN FOR THE RETENTION, PROCESSING AND DESTRUCTION OF PERSONAL DATA

Taşkınlar İnşaat takes technical and administrative measures, according to the nature of the data to be protected, technological possibilities and implementation costs, in order to ensure that Personal Data is retained, processed and accessed lawfully.

Technical Measures

The principal technical measures taken by Taşkınlar İnşaat to prevent the unlawful retention, processing of and access to Personal Data are listed below:

• Technical measures appropriate to technological developments are taken, and the measures taken are periodically updated and renewed.
• An authorisation matrix has been established in accordance with the legal compliance requirements determined for each business unit, a personal account management system has been set up and encryption systems have been activated.
• Within this scope, software and hardware including virus protection systems and firewalls are installed, log records are kept and regular backups are made.
• The software and hardware necessary to ensure network security are installed, and authorisation checks and penetration tests are carried out at 6-month intervals. Within this scope, firewalls and intrusion detection and prevention systems are used.
• The technical measures taken are periodically reported to [the Data Controller Representative and/or the Committee] as required by the internal audit mechanism, matters posing a risk are re-evaluated and the necessary technological solutions are produced.
• Data for which Explicit Consent has not been obtained and which does not fall within the statutory exceptions is used in masked form.
• Personnel knowledgeable in technical matters are employed, and these persons are made permanent members of the Committee, if one has been established.

Administrative Measures

The principal administrative measures taken by Taşkınlar İnşaat to prevent the unlawful retention, processing of and access to Personal Data are listed below:

• Taşkınlar İnşaat has informed its employees about the Personal Data Protection legislation and has provided them with the necessary training on this subject. Within the scope of the training, employees have been informed of their roles and responsibilities and of the principle “everything is prohibited unless permitted” rather than “everything is permitted unless prohibited”.
• The necessary undertakings for the protection of Personal Data have been obtained from employees by having them sign confidentiality agreements stating that they may not disclose the Personal Data they learn to others in breach of the PDP Regulations, may not use it for purposes other than the purpose of processing, and that this obligation shall continue after they leave their positions. Within this scope, provisions in compliance with the Law have been added to employees’ employment contracts and to the disciplinary regulations.
• Within its internal organisation, it has prepared the disciplinary processes to be applied in the event of non-compliance with these undertakings and other confidentiality obligations.
• Taşkınlar İnşaat undertakes to continue informing its employees at 1-year intervals and to keep their knowledge up to date.
• It has completed the preparations necessary for making the notification to the Registry.
• Processes for access to and authorisation for Personal Data within the Company have been designed and are implemented in accordance with the legal compliance requirements of each business unit.
• Provisions are added to the contracts concluded by Taşkınlar İnşaat with the persons to whom Personal Data is lawfully transferred, stating that the persons to whom Personal Data is transferred shall take the necessary security measures for the protection of Personal Data and shall ensure that these measures are complied with within their own organisations.
• It has made the necessary arrangements under this Policy regarding access, information security, use, retention and destruction.
• The Data Inventory has been prepared, the necessary provisions have been included in the contracts relating to the processing, retention and transfer of Personal Data, and the necessary preparations have been made for Periodic and/or Random Internal Audits.
• Risk Analyses have been carried out and the necessary measures have been taken.
• Corporate communication procedures and notification processes in the event of a breach have been set out in this Policy.

Audit of the Measures Taken for the Protection of Personal Data

In accordance with Article 12 of the KVKK, Taşkınlar İnşaat carries out, or has carried out, the necessary audits through [the Data Controller Representative it has appointed and/or the Committee it has established within its organisation]. The results of these audits are reported to the relevant department within the scope of the Company’s internal operations, and the activities necessary to improve the measures taken are carried out.

6. UNAUTHORISED DISCLOSURE OF PERSONAL DATA

Taşkınlar İnşaat has set out in this Policy the procedure to be followed in the event of a breach of the Personal Data security obligations contained in the Law, the PDP Regulations and this Policy.

Breaches Occurring Within Taşkınlar İnşaat

• Where a Taşkınlar İnşaat employee detects any breach or encounters a possible breach, they shall immediately notify the relevant department director of the situation and inform the department officer of how the breach was noticed and where it originated.
• The department director shall take initial measures to stop the breach if it is ongoing and to determine its extent if it has ended, and shall notify [the Data Controller Representative and/or the Committee] of the situation.
• [The Data Controller Representative and/or the Committee] shall obtain support from the IT department in order to take measures against the breach and shall contact the legal department.
• [The Data Controller Representative and/or the Committee] shall report the extent, scope and consequences of the breach and share this with the Board of Directors and the Authority.

Breaches Occurring Within Third Parties

• Where a third party with which Taşkınlar İnşaat works detects any breach or encounters a possible breach, [the Data Controller Representative and/or the Committee] shall contact the legal department and, if necessary, the IT department within 12 hours following the notification.
• [The Data Controller Representative and/or the Committee] shall report the information obtained from the counterparty regarding the extent, scope and consequences of the breach and share this with the Board of Directors and the Authority.

7. DESTRUCTION OF PERSONAL DATA

The Destruction of Personal Data may be achieved in three different ways: Deletion, Destroying or Anonymisation of the data. The aim of the Destruction process is that it should not be possible to reach the natural person by means of the remaining data. Taşkınlar İnşaat takes all necessary technical and administrative measures relating to the lawful Deletion, Destroying and Anonymisation of Personal Data.

Deletion of Personal Data

The deletion of Personal Data processed by fully or partially automated means is the process of rendering such Personal Data inaccessible and non-reusable in any way by Relevant Users. The Data Controller explains in its relevant policies and procedures how the conditions set out in Article 7(3) of the Regulation are met in order for Personal Data to be deemed Deleted. The deletion of Personal Data that forms part of any Data Recording System and is processed by non-automated means, being the process carried out by Anonymising unnecessary Personal Data in paper form that has been transferred to electronic media by scanning or without digitisation, is carried out where Taşkınlar İnşaat processes the data fully or by automated means, and where Taşkınlar İnşaat Deletes Personal Data, it renders the data inaccessible or non-reusable in any way. In carrying out this process, Taşkınlar İnşaat guarantees that the data is inaccessible or non-reusable by any user. This guarantee is under the responsibility of Taşkınlar İnşaat. The specified Deletion methods are subject to the Regulation, and updating them in the relevant cases is the responsibility of Taşkınlar İnşaat.

Destroying of Personal Data

The Destroying process shall be carried out where Taşkınlar İnşaat processes data on physical recording media, and Taşkınlar İnşaat is obliged to render such data inaccessible, non-reusable and irretrievable. During Destroying operations, Taşkınlar İnşaat employees and the relevant departments are obliged to notify [the Data Controller Representative and/or the Committee] of the relevant data to be destroyed, after which Taşkınlar İnşaat shall take all necessary technical and administrative measures.

Anonymisation of Personal Data

The Anonymisation process is, where Taşkınlar İnşaat processes Personal Data fully or by automated means, the rendering of such data incapable of being associated with an identified or identifiable natural person even if matched with other data. The Anonymisation of Personal Data is the duty of the data-owning business unit within Taşkınlar İnşaat. The data-owning business unit may obtain support from different departments of Taşkınlar İnşaat, provided that it carries out the supervision of the Destroying of the data itself. During the Anonymisation of Personal Data, Taşkınlar İnşaat may use the methods specified in this Policy. Where there is uncertainty as to the correctness of the method to be applied, [the Data Controller Representative and/or the Committee] should be consulted.

8. METHODS AND PROCESS FOR THE DESTRUCTION OF PERSONAL DATA

DESTRUCTION OF PERSONAL DATA

The destruction of personal data may be achieved in three different ways: deletion, destroying or anonymisation of the data. The aim of the destruction process is that it should not be possible to reach the natural person by means of the remaining data. Taşkınlar İnşaat takes all necessary technical and administrative measures relating to the lawful deletion, destroying and anonymisation of personal data.

Deletion of Personal Data

The deletion of personal data processed by fully or partially automated means is the process of rendering such personal data inaccessible and non-reusable in any way by relevant users. The data controller explains in its relevant policies and procedures how the conditions set out in the third paragraph are met in order for personal data to be deemed deleted. The deletion of personal data that forms part of any data recording system and is processed by non-automated means, being the process carried out by anonymising unnecessary personal data in paper form that has been transferred to electronic media by scanning or without digitisation, shall be carried out where Taşkınlar İnşaat processes the data fully or by automated means, and where Taşkınlar İnşaat deletes personal data, it must render the data inaccessible or non-reusable in any way. In carrying out this process, Taşkınlar İnşaat must guarantee that the data is inaccessible or non-reusable by any user. This guarantee is under the responsibility of the data controller.

Where, during deletion, personal data that should not be deleted is also affected by the deletion and becomes inaccessible and/or unusable, the combined application of the following methods, which the Taşkınlar İnşaat KVKK Working Group may decide upon and implement, shall also be deemed deletion:

• a) Archiving the personal data in such a way that it cannot be associated with the data subject;
• b) The personal data being closed to all forms of access;
• c) Taking all necessary technical and administrative measures to ensure that the personal data is accessed only by authorised persons and only when necessary;
• d) The specified methods by which data is deemed deleted are subject to the Regulation, and updating them in the relevant cases is the responsibility of the data controller.

Destroying of Personal Data

The destroying process shall be carried out where Taşkınlar İnşaat processes data on physical recording media, and Taşkınlar İnşaat is obliged to render such data irretrievable. During these operations, Taşkınlar İnşaat employees and the relevant departments are obliged to notify the KVKK Working Group of the relevant data to be destroyed, after which Taşkınlar İnşaat shall take all necessary technical and administrative measures.

Anonymisation of Personal Data

The anonymisation process is, where Taşkınlar İnşaat processes personal data fully or by automated means, the rendering of such data incapable of being associated with an identified or identifiable natural person even if matched with other data. The anonymisation of personal data is the duty of the data-owning business unit within Taşkınlar İnşaat. The data-owning business unit may obtain support from different departments of Taşkınlar İnşaat, provided that it carries out the supervision of the destroying of the data itself. During the anonymisation of data, Taşkınlar İnşaat may use methods such as one-way functions and encryption. Where there is uncertainty as to the correctness of the method to be applied, the KVKK Working Group should be consulted.

METHODS AND PROCESS FOR THE DESTRUCTION OF PERSONAL DATA

For the destruction of personal data, Taşkınlar İnşaat defines in this Policy all methods that may be used during destruction. The data-owning business unit is obliged to determine and apply the appropriate method within this Policy according to the relevant circumstances. During the destruction of personal data, Taşkınlar İnşaat employees carry out the destruction by selecting the appropriate method from among the following:

• Overwriting: The process of rendering the old data unreadable by writing random data consisting of 0s and 1s at least 8 times onto magnetic media and rewritable optical media by means of software.
• Degaussing: The process of rendering the data on magnetic media unreadable by subjecting the media to physical change in a high-intensity magnetic field.
• Physical Destruction: The process of physically destroying optical or magnetic media by melting, pulverising, grinding and similar processes. It may be applied where the degaussing or overwriting methods fail.
• Cloud Destruction: The process of destroying all copies of the encryption keys of personal data held on cloud systems, following the notification of destruction to the contracted service provider.
• Destruction of Personal Data in Peripheral Systems: The destruction process to be carried out by applying overwriting, degaussing or physical destruction to the internal unit containing personal data, if any, or otherwise to the entire device, in systems such as printers, fingerprint units and door entry turnstiles. Such destruction must be applied before the devices are subjected to backup, maintenance and similar operations.

8.3. RETENTION AND DESTRUCTION PERIODS

8.3.1. Periodic Destruction and Statutory Retention Periods

Physical and digital data that have reached the end of their statutory retention and destruction periods are destroyed periodically. Taşkınlar İnşaat deletes, destroys or anonymises personal data in the first Periodic Destruction following the date on which the obligation to delete, destroy or anonymise the personal data arises. Periodic Destruction is carried out at 6-month intervals for all personal data. Records of the operations relating to data that has been deleted, destroyed and anonymised are retained for at least 3 years, independently of other legal obligations.

8.3.2. Deletion and Destroying Process Upon Request of Data Subjects

Where data subjects apply to Taşkınlar İnşaat and request the deletion or destroying of their personal data, Taşkınlar İnşaat checks the current status of the conditions for processing personal data and takes the related actions accordingly. If all the conditions for processing personal data have ceased to exist, it deletes, destroys or anonymises the personal data subject to the request. Taşkınlar İnşaat finalises the data subject’s request within thirty days at the latest and informs the data subject. If all the conditions for processing personal data have ceased to exist and the personal data subject to the request has been transferred to third parties, the data controller notifies the third party of this situation and ensures that the necessary operations under the Regulation are carried out by the third party. If not all of the conditions for processing personal data have ceased to exist, Taşkınlar İnşaat may reject the request by explaining its reasons to the relevant data subject and shall notify the data subject of the rejection in writing or electronically within thirty days at the latest.

AMENDMENTS TO THE POLICY

9.1. Following any official amendment to the relevant legislation, this Policy may be amended by Taşkınlar İnşaat so as to be consistent with such amendments.

9.2. Taşkınlar İnşaat shall share the updated Policy with its employees by e-mail in such a way that the amendments made to the Policy can be reviewed, and shall make it available to its employees via the corporate intranet.

EFFECTIVE DATE OF THE POLICY

This Policy has entered into force with effect from 01.03.2021.

Data Subject Application Form

• Download the Data Subject Application Form