CLARIFICATION TEXT PURSUANT TO LAW NO: 6698 ON THE PROTECTION OF PERSONAL DATA

 

  1. Introduction

In accordance with Article 20 of the Constitution of the Republic of Turkey, everyone is entitled to demand the protection of personal data concerning him. This right also includes being informed about personal data for the person, accessing these data, requesting their correction or deletion, and learning whether they are used for their purposes.

With the Personal Data Protection Law No.6698 (KVK Law), the protection of the fundamental rights and freedoms of individuals in the processing of personal data and the obligations of natural and legal persons who process personal data and the procedures and principles that they will comply with have been defined

  1. Purpose

Your personal data shall be processed by Rönesans Çelik Yapı Sanayi ve Ticaret A.Ş acting as a data controller within the scope as defined below, in accordance with Personal Data Protection Law No 6698 regulating data processing so as to protect the fundamental right and freedom of persons, the obligations of persons who process personal data and principles and procedures to be observed.

  1. Scope

Data owners whose personal data are processed within the scope of this Policy are categorized as follows.

Employees: Real persons with continuing business relationship with Renaissance Steel

Employee Candidates: Real persons who make their resume and related information accessible to Rönesans Çelik by applying for a job or by any other means.

Former Employees: Real persons whose business relationship with Rönesans Çelik has ended

Visitors: Real persons who entered the physical facilities of Renaissance Steel for various purposes or visited its websites

Third Persons: Although not defined in the Policy, family members etc. whose personal data are processed within the framework of this Policy. other natural persons, including but not limited to.

  1. Definitions

In this clarification text;

Explicit Consent: Consent on a specific subject, based on information and expressed with free will

 

Anonymization: Making personal data unrelated to a certain or identifiable natural person under any circumstances, even by matching with other data.

Application Form: The form that personal data owners whose personal data are processed within Renaissance Steel, will use their applications regarding their rights described in Article 11 of the KVK Law.

Employee: Real persons who are dependent on Renaissance Steel, who work for a definite or indefinite period

Employee Candidate: Real persons who make their CV and related information accessible to Rönesans Çelik by applying for a job or by any other means.

Personal Health Data: All kinds of health information regarding an identified or identifiable natural person

Personal Data: All kinds of information regarding an identified or identifiable natural person

Processing of Personal Data: Obtaining, recording, storing, preserving, changing, reorganizing, disclosing, transferring, taking over, making available, through fully or partially automatic means of personal data or non-automatic means provided that it is part of any data recording system, any action taken on data, such as classification or prevention of use

KVK Law: Law No.6698 on Protection of Personal Data

KVK Board: Personal Data Protection Board

KVK Institution: Personal Data Protection Authority

Special Qualified Personal Data: Data on race, ethnicity, political opinion, philosophical belief, religion, sect or other beliefs, dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures and biometric and genetic data

Data Processor: Real or legal person who processes personal data on behalf of the data controller based on the authority given by him.

Personal Data Owner: A real person whose personal data is processed, who is considered to be a “contact person” in the KVK Law

Data Supervisor: Real or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

Visitor: Real persons who entered the physical facilities of Rönesans Çelik for various purposes or visited its websites.1) Data Authority and Representative

  1. General Pinciples on the Processing of Personal Data

Pursuant to Article 3 of the Law on KVK, obtaining, recording, storing, preserving, modifying, rearranging, disclosing, transferring, taking over personal data fully or partially automatically, or by non-automatic means provided that they are part of any data recording system. Any operations performed on data such as making it available, classifying or preventing its use are within the scope of the processing of personal data.

The following principles shall be followed in the processing of personal data:

Compliance with the law and good faith

Our company carries out its personal data processing activities in accordance with the law and good faith, in accordance with the Constitution, KVK Law and related legislation.

Being accurate and up-to-date when necessary

All kinds of administrative and technical measures are taken to ensure the accuracy and currency of personal data while processing personal data by our company.

Processing for specific, explicit and legitimate purposes

Our company clearly and precisely determines its legitimate purpose for personal data processing before starting the processing of personal data.

Being connected, limited and measured for the purpose of processing

Personal data are processed by our company as necessary to achieve the specified purposes. No data processing activity is carried out with the assumption that it can be used later.

Being kept for the period stipulated in the relevant legislation or required for the purpose for which they are processed

Our company stores personal data for a limited period of time stipulated in the KVK Law and related legislation or required by the purposes of data processing.

  1. Conditions of Processing Personal Data

Our company can process personal data and special quality personal data with the express consent of the personal data owner or without express consent in cases stipulated in Articles 5 and 6 of the KVK Law.

6.1. Processing of Personal Data

As a rule, our company processes your personal data based on your express consent. On the other hand, it carries out personal data processing activities without your explicit consent in accordance with the data processing conditions set forth in Article 5 of the KVK Law:

  1. It is clearly stipulated in the laws.
  2. It is compulsory for the protection of the life or physical integrity of the person who is unable to disclose his consent due to actual impossibility or whose consent is not legally valid.
  3. Provided that it is directly related to the establishment or performance of a contract, it is necessary to process personal data belonging to the parties of the contract.
  4. It is mandatory for our company to fulfill its legal obligation.
  5. It is made public by the personal data owner himself.
  6. Data processing is mandatory for the establishment, use or protection of a right.
  7. Provided that it does not harm the fundamental rights and freedoms of the personal data owner, it is necessary to process data for the legitimate interests of our Company.

 6.2. Processing Special Quality Personal Data:

Our company carries out the processing of personal data specified as special quality in accordance with the data processing conditions set forth in Article 6 of the KVK Law. In addition, it is also necessary to take adequate measures determined by the KVK Board in the processing of special quality data.

It is forbidden to process sensitive personal data without the express consent of the personal data owner. However, in the following cases, personal data of special nature may be processed despite the explicit consent of the personal data owner:

  1. Processing of Personal Health Data:

Personal health data; (i) To take adequate measures to be stipulated by the Ministry of Health, (ii) to act in accordance with the general principles, (iii) under the obligation of secrecy, in the presence of one of the following conditions:

– Written express consent of the personal data owner

– Protection of public health

– Preventive medicine

– Carrying out medical diagnosis, treatment and care services

– Planning and management of health services and financing

  1. Processing of Special Quality Personal Data Other Than Health and Sexual Life

The data within this scope will be possible with the explicit consent of the personal data owner or in cases stipulated by the law.

  1. Ensuring the Security and Privacy of Personal Data

In accordance with Article 12 of the KVK Law, our company takes all necessary technical and administrative measures to prevent unlawful processing and access of personal data, to ensure the protection of personal data, and to ensure the appropriate level of security.

7.1. Technical Measures Taken to Ensure The Lawful Processing Of Personal Data And To Prevent Unlawful Access

– Rönesans Çelik has taken all kinds of technical security measures to protect your personal data, and has taken your personal data under protection against possible risks.

– Technical measures are taken in line with the developments in technology, the measures taken are periodically updated and audited.

 

– There are software and hardware including virus protection systems and firewalls.

– Systems suitable for technological developments are used to keep personal data in secure environments.

– Administrative Measures Taken o Ensure The Lawful Processing Of Personal Data And To Prevent Unlawful Access

– It is ensured that the company employees are trained and informed about the KVK Law.

– Employees are informed that they cannot disclose the personal data they have learned to anyone in violation of the provisions of the Law and cannot use it for purposes other than processing and that this obligation will continue even after they leave their job and, in this direction, necessary commitments are taken from the employees.

7.2. Measures to be Taken in Case of Unlawful Disclosure of Personal Data

In the event that the processed personal data is obtained by others through illegal means despite the necessary security measures, our Company will notify the relevant data owner and the KVK Board as soon as possible.

  1. Processing Purposes of Personal Data and Storage Period

 

8.1. Purposes of Processing Personal Data

Personal data are processed by our company for the following purposes:

– Planning and execution of commercial activities,

– Planning, control and execution of occupational health and safety processes,

– Providing information to authorized institutions and organizations regarding the legislation,

– Managing the recruitment processes of employee candidates,

– Fulfilling the obligations arising from the employment contract and legislation for the company employees,

– Execution / follow-up of financial reporting and risk management processes,

Execution / follow-up of legal affairs and transactions,

– Planning and execution of the necessary audit activities to ensure that the activities are carried out in accordance with our Company’s procedures and relevant legislation,

– Planning and execution of corporate sustainability activities,

– Carrying out efforts to protect the reputation of our company,

– Planning and execution of corporate management and communication activities,

– Creating and tracking visitor records.

 

8.2. Storage Periods of Personal Data

Our company determines whether a period of time is stipulated in the relevant legislation for the storage of personal data. If a period is stipulated in the relevant legislation, it abides by this period; If a period is not stipulated, it keeps the personal data for the period required for the purpose for which they were processed. If the purpose of processing has expired and the retention periods determined by the relevant legislation and / or our Company have expired, personal data can only be stored for the purpose of providing evidence in possible legal disputes, asserting the right related to personal data or establishing a defense. Personal data are not stored by our Company based on the possibility of future use.

  1. Deleting, Destroying and Anonymization Personal Data

Pursuant to Article 7 of the KVK Law, although the personal data has been processed in accordance with the relevant legislation, if the reasons for its processing disappear, the personal data will be deleted, destroyed or anonymized by our Company, either ex officio or upon the request of the personal data owner.

The procedures and principles regarding this matter will be fulfilled in accordance with the KVK Law and the Regulation on the Deletion, Destruction or Anonymization of Personal Data published in the Official Gazette dated 28.10.2017 and numbered 30224.

When you apply to our company and request the deletion or destruction of your personal data; If all the conditions for processing personal data have disappeared; Your personal data subject to the request are deleted, destroyed or anonymized. Your request will be finalized within thirty days at the latest and you will be informed.

If all the conditions for processing personal data are not eliminated, your request may be rejected by explaining the reason in accordance with paragraph 3 of Article 13 of the KVK Law, and the rejection response will be notified to you in writing or electronically within 30 days at the latest.

9.1. Personal Data Deletion and Destruction Techniques

Deletion of personal data is the process of making personal data inaccessible and unavailable in any way for the relevant users. Destruction of personal data, personal data no one

9.2. Anonymization Techniques of Personal Data

It refers to making personal data unrelated to an identified or identifiable real person under any circumstances, even by matching other data.

  1. Third Parties to which Personal Data is Transferred and Transfer Purposes

The procedures and principles to be applied in personal data transfer are regulated in Articles 8 and 9 of the KVK Law, and the personal data and special quality personal data of the personal data owner can be transferred to third parties in Turkey and abroad. Your personal data can be processed by Rönesans Çelik in accordance with the Law and other legislation in order to ensure legal, technical and commercial occupational safety and to maintain activities, and not limited to those listed; Legally authorized public institutions and organizations can be shared with legally authorized private law persons.

10.1 Transfer of Personal Data Within the Country

In accordance with Article 8 of the KVK Law, the transfer of personal data within the country will be possible provided that one of the conditions specified in the 6th section titled “Processing of Personal Data” of this Policy is met.

10.2. Transfer of Personal Data Abroad

In accordance with Article 9 of the KVK Law, in the event that personal data is transferred abroad, in addition to meeting the conditions for domestic transfers, the existence of one of the following issues is sought:

– The country to be transferred is considered among the countries with sufficient protection declared by the KVK Board

– In the absence of adequate protection in the country will be transport, responsible for an adequate protection of data in Turkey and in the foreign countries to commit themselves in writing and the presence of CTL Board’s permission

10.3. Groups of Persons Transferring Personal Data by Our Company

Our company may transfer the personal data of personal data owners within the scope of this Policy in accordance with Articles 8 and 9 of the KVK Law and within the framework of the purposes specified below: