Penınsula Gardens

Protection of Personal Data

ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC. KAS PENINSULA GARDENS BRANCH places great importance on the protection of personal data, which is among our company’s priorities. The most important aspect of this is the protection of personal data of employees, subcontractor employees, job applicants, interns, visitors, suppliers, third parties, and customers, which is governed by this Policy.

According to Article 20 of the Turkish Constitution, everyone has the right to request the protection of their personal data. As a constitutional right, the protection of personal data is a matter of utmost importance for ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH, through this Policy, demonstrates the necessary care in protecting the personal data of employees, subcontractor employees, job applicants, interns, visitors, suppliers, third parties, and customers, and has established this as a company policy.

In this context, ATILGAN TOPTAN TEKSTİL AŞ. takes the necessary administrative and technical measures to protect personal data processed in accordance with applicable legislation.

In this Policy, ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH undertakes to comply with the following basic principles regarding the processing of personal data:

Processing personal data in accordance with the law and the rules of good faith,
Keeping personal data accurate and up-to-date when necessary,
Processing personal data for specific, explicit, and legitimate purposes,
Processing personal data in a manner that is relevant, limited, and proportionate to the purpose for which it is processed,
Retaining personal data for the period required by applicable legislation or necessary for the purpose for which it is processed,
Informing and keeping data subjects informed,
Establishing the necessary system for data subjects to exercise their rights,
Taking necessary measures to protect personal data,
Acting in accordance with applicable legislation and the regulations of the Personal Data Protection Board when transferring personal data to third parties in accordance with the purposes of processing,
Showing the necessary sensitivity in the processing and protection of special category personal data.

1.2. PURPOSE OF THE POLICY

The main purpose of this Policy is to ensure that the personal data processed by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH, and to ensure the security of the personal data of our employees, subcontractors’ employees, job applicants, interns, visitors, suppliers, third parties and customers.

1.3. SCOPE

This Policy applies to all personal data processed by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH, and applies to all personal data processed by automatic means or by non-automatic means as part of a data recording system, relating to employees, subcontractor employees, job applicants, interns, visitors, suppliers, third parties, and customers.

1.4. APPLICATION OF THE POLICY AND RELEVANT LEGISLATION

The relevant legal regulations in force regarding the processing and protection of personal data shall be applied first. In the event of any inconsistency between the applicable legislation and the Policy, ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH accepts that the applicable legislation shall prevail. This Policy has been established by concretising and regulating the rules set forth by the relevant legislation within the scope of the practices of ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH.

1.5. ENTRY INTO FORCE OF THE POLICY

This Policy, which will be implemented by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH, will enter into force on …………………

2.1. ENSURING THE SECURITY OF PERSONAL DATA

2.1.1. Technical and Administrative Measures Taken to Ensure the Lawful Processing of Personal Data

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH takes technical and administrative measures, in accordance with technological capabilities and implementation costs, to ensure the lawful processing of personal data.

(i) Technical Measures Taken to Ensure the Lawful Processing of Personal Data

The main technical measures taken by ATILGAN TOPTAN TEKSTİL to ensure the lawful processing of personal data are listed below:

The systems established within the scope of personal data processing activities carried out by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH are monitored by the Information Technology Department.
The technical measures taken are reported to the company’s General Manager on a periodic basis as required by the internal audit mechanism.

(ii) Administrative Measures Taken to Ensure the Lawful Processing of Personal Data

The main administrative measures taken by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH to ensure the lawful processing of personal data are listed below:

Employees are informed and trained on the law on the protection of personal data and the lawful processing of personal data.
All commercial activities carried out by all units within the scope of the activities conducted by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH have been analysed, personal data have been identified, data processors have been determined, job descriptions have been prepared, data processing agreements have been signed with each of them, and assignments have been made.
All personal data processing activities carried out by all units of ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH have been determined in accordance with the personal data processing conditions required by the Personal Data Protection Law No. 6698. In addition, in order to ensure compliance with the legal requirements determined on a business unit basis, the necessary administrative measures are implemented through internal policies and training to raise awareness among data processors in the relevant units and to determine the rules of application.
ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH, and the legal relationship between ATILGAN AKVARYUM İNŞ. SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH and its employees are governed by employment contracts, workplace internal regulations, and records imposing obligations not to process, disclose, or use personal data in violation of the law. Awareness of these obligations is enhanced among employees, and audits are conducted.

2.1.2. Technical and Administrative Measures Taken to Prevent Unauthorised Access to Personal Data

ATILGAN AKVARYUM CONSTRUCTION INDUSTRY AND TRADE INC.KAŞ PENİNSULA GARDENS BRANCH takes technical and administrative measures to prevent the disclosure, access, transfer, or any other unlawful access to personal data due to negligence or unauthorised access, taking into account the nature of the data to be protected, technological capabilities, and implementation costs.

(i) Technical Measures Taken to Prevent Unauthorised Access to Personal Data

The main technical measures taken by ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC. KAŞ PENİNSULA GARDENS BRANCH to prevent unauthorised access to personal data are listed below:

Technical measures are taken in line with technological developments, and the measures taken are periodically updated and renewed.
Access and authorisation technical solutions are implemented in accordance with the legal compliance requirements determined on a business unit basis.
Access authorisations are restricted, and authorisations are regularly reviewed.
The technical measures taken are reported to the relevant parties on a regular basis in accordance with the internal audit mechanism, and issues that pose a risk are reassessed and the necessary technological solutions are produced.
Software and hardware including virus protection systems and firewalls are installed.
Personnel knowledgeable in technical matters are employed.
Applications where personal data is collected are regularly scanned for security vulnerabilities. Any vulnerabilities found are closed.

(ii) Administrative Measures Taken to Prevent Illegal Access to Personal Data

The main administrative measures taken by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH to prevent unlawful access to personal data are listed below:

Employees are trained on technical measures to be taken to prevent unlawful access to personal data.
Access and authorisation processes for personal data are designed and implemented within the company in accordance with legal compliance requirements for the processing of personal data on a departmental basis.
Employees are informed that they cannot disclose personal data they have learned to others in violation of the provisions of the Personal Data Protection Law, cannot use it for purposes other than processing, and that this obligation will continue even after they leave their jobs, and the necessary commitments (data processing agreement) are obtained from them in this regard.
ATILGAN AKVARYUM İNŞ.IND. & COM. INC. KAŞ PENİNSULA GARDENS BRANCH, contracts (confidentiality agreements) entered into with individuals to whom personal data is transferred in accordance with the law include provisions stating that the recipients of personal data will take the necessary security measures to protect personal data and ensure compliance with these measures within their own organisations.

2.1.3. Storage of Personal Data in Secure Environments

We take the necessary technical and administrative measures, in accordance with technological capabilities and application costs, to ensure the secure storage of personal data and to prevent its unlawful destruction, loss, or alteration.

(i) Technical Measures Taken for the Secure Storage of Personal Data

The main technical measures taken by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH to store personal data in secure environments are listed below:

Systems compatible with technological developments are used to store personal data in secure environments.
Personnel specialised in technical matters are employed.
Technical security systems are established for storage areas, and technical measures taken are reported to the relevant parties on a regular basis as required by the internal audit mechanism. Issues posing risks are re-evaluated, and necessary technological solutions are developed.
Backup programmes are used in compliance with the law to ensure the secure storage of personal data.
Access to data storage areas containing personal data is logged, and unauthorised access or access attempts are immediately reported to the relevant persons.

(ii) Administrative Measures Taken for the Secure Storage of Personal Data

The main administrative measures taken by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH to store personal data in secure environments are listed below:

Employees are trained to ensure that personal data is stored securely.
In cases where ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH outsources services for the storage of personal data due to technical requirements, contracts (confidentiality agreements) are signed with the relevant companies to ensure that personal data is transferred in accordance with the law; The contracts include provisions stating that the persons to whom personal data is transferred will take the necessary security measures to protect personal data and ensure compliance with these measures within their own organisations.

2.1.4. Monitoring of Measures Taken for the Protection of Personal Data

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH conducts or has conducted the necessary audits within its own organisation in accordance with Article 12 of the Personal Data Protection Law No. 6698. The results of these audits are reported to the relevant department within the internal operations of ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH, and the necessary activities are carried out to improve the measures taken.

2.1.5. Measures to Be Taken in Case of Unauthorised Disclosure of Personal Data

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH operates a system that ensures that, in accordance with Article 12 of the Personal Data Protection Law No. 6698, any personal data processed in accordance with the law is obtained by others through unlawful means, this situation is reported to the relevant data subject and the Personal Data Protection Board as soon as possible.

If deemed necessary by the Personal Data Protection Board, this situation may be announced on the Board’s website or through another method.

2.2. PROTECTION OF DATA SUBJECT RIGHTS AND EVALUATION OF REQUESTS

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH evaluates the rights of personal data subjects and provides the necessary information to them in accordance with Article 13 of the Personal Data Protection Law No. 6698, by implementing the necessary channels, internal procedures, administrative and technical regulations.

Data subjects may submit their requests regarding the rights listed below in writing to ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC. KAŞ PENINSULA GARDENS BRANCH. In such cases, ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC.KAŞ PENİNSULA GARDENS BRANCH will process the request free of charge within thirty days at the latest, depending on the nature of the request. However, if the Personal Data Protection Board determines a fee, ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH will charge the fee specified by the Personal Data Protection Board. Personal data owners;

To learn whether personal data has been processed,
To request information about the processing of personal data,
To learn the purpose of the processing of personal data and whether it is used for its intended purpose,
To know the third parties to whom personal data has been transferred within or outside the country,
To request the correction of personal data if they are incomplete or incorrect, and to request that this correction be communicated to third parties to whom the personal data have been transferred,
To request the deletion or destruction of personal data, even if it has been processed in accordance with the provisions of the KVK Law and other relevant laws, if the reasons for its processing no longer exist, and to request that the third parties to whom the personal data has been transferred be informed of this action,
Object to the analysis of processed data exclusively by automated systems resulting in a decision against the individual,
Request compensation for damages incurred as a result of the unlawful processing of personal data.

2.3. PROTECTION OF SPECIAL CATEGORIES OF PERSONAL DATA

Certain personal data are of special importance under the Personal Data Protection Law No. 6698 due to the risk of causing harm or discrimination to individuals when processed unlawfully. These data include race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, attire and clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH handles personal data of a special nature, as defined by the Personal Data Protection Law No. 6698, with the utmost care and in compliance with the law. In this context, ATILGAN AKVARYUM İNŞ.IND.TR.CO. KAŞ PENINSULA GARDENS BRANCH takes technical and administrative measures to protect personal data, which are carefully applied to special category personal data, and ensures the necessary audits within ATILGAN AKVARYUM CONST.IND.TR.CO. KAŞ PENINSULA GARDENS BRANCH.

2.4. INCREASING AWARENESS AND MONITORING OF PERSONAL DATA PROTECTION AND PROCESSING BY BUSINESS UNITS

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH ensures that the necessary training is provided to business units to increase awareness regarding the prevention of unlawful processing of personal data, unlawful access to data, and the safeguarding of data.

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH establishes the necessary systems to ensure that its business units’ current employees and newly hired employees are aware of personal data protection, and collaborates with professionals as needed on this matter.

The results of the training conducted to increase awareness regarding the protection and processing of personal data within the business units of ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş. KAŞ PENİNSULA GARDENS BRANCH are reported to the Board of Directors. In this regard, our company evaluates participation in relevant training, seminars, and information sessions, conducts or arranges necessary audits, and updates and renews its training in line with updates to the relevant legislation.

2.5. INCREASING AWARENESS AND MONITORING OF THE PROTECTION AND PROCESSING OF PERSONAL DATA OF SUBCONTRACTORS, TRAINEES AND SUPPLIERS

ATILGAN AKVARYUM İNŞ.IND. & COM. INC. KAŞ PENINSULA GARDENS BRANCH To prevent the unlawful processing of personal data, unauthorised access to data, and to ensure the security of data, the company organises training sessions and seminars for subcontractor employees, interns, and customers to enhance awareness.

3– MATTERS RELATED TO THE PROCESSING OF PERSONAL DATA

3.1. PROCESSING OF PERSONAL DATA IN ACCORDANCE WITH THE PRINCIPLES SET FORTH IN THE LEGISLATION

3.1.1. Processing in Compliance with the Law and the Principle of Good Faith

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH acts in accordance with the principles established by legal regulations and the general principles of good faith and fairness in the processing of personal data. In this context, our Company takes into account the proportionality requirements in the processing of personal data and does not use personal data for purposes other than those required by the purpose.

3.1.2. Ensuring that Personal Data is Accurate and Up-to-Date

ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC. KAŞ PENİNSULA GARDENS BRANCH ensures that the personal data it processes is accurate and up-to-date, taking into account the fundamental rights of personal data subjects and its own legitimate interests. It takes the necessary measures in this regard. For example, our company has established a system that allows data subjects to correct their personal data and verify its accuracy.

3.1.3. Processing for Specific, Clear and Legitimate Purposes

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH clearly and unequivocally determines the legitimate and lawful purpose of processing personal data.Our company processes personal data to the extent necessary for its commercial activities, and the purpose for which personal data will be processed is determined before the personal data processing activity begins.

3.1.4. Processing in a Manner Connected to the Purpose, Limited and Proportionate

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH processes personal data in a manner that is appropriate for achieving the specified purposes and avoids processing personal data that is not related to or necessary for achieving the purpose. For example, personal data processing activities aimed at meeting potential future needs are not carried out.

3.1.5. Retention for the Period Required by Relevant Legislation or Necessary for the Purpose of Processing

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH retains personal data only for the period specified in the relevant legislation or for the period necessary for the purpose for which they were processed. In this context, ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH first determines whether the relevant legislation specifies a retention period for personal data, acts in accordance with such period if specified, and retains personal data for the period necessary for the purpose for which they were processed if no period is specified. Upon the expiration of the retention period or the cessation of the reasons necessitating the processing of personal data, such data is deleted, destroyed, or anonymised by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH. Personal data is not retained by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH for future use.

3.2. PROCESSING OF PERSONAL DATA BASED ON ONE OR MORE OF THE CONDITIONS FOR PROCESSING PERSONAL DATA SET OUT IN ARTICLE 5 OF THE KVK LAW AND LIMITED TO THESE CONDITIONS

The protection of personal data is a constitutional right. Fundamental rights and freedoms may only be restricted for the reasons specified in the relevant articles of the Constitution and may only be limited by law. In accordance with the third paragraph of Article 20 of the Turkish Constitution, personal data may only be processed in cases provided for by law or with the explicit consent of the individual. ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH processes personal data in accordance with this principle and in compliance with the Constitution; personal data is processed only in cases provided by law or with the explicit consent of the individual.

3.3. INFORMATION AND NOTIFICATION OF THE DATA SUBJECT

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH informs Data Subjects about the processing of their personal data in accordance with Article 10 of the Personal Data Protection Law No. 6698. Within this scope, ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC. KAŞ PENINSULA GARDENS BRANCH informs data subjects about the identity of its representative (if any), the purpose for which personal data will be processed, the parties to whom and for what purposes personal data may be transferred, the method and legal basis for collecting personal data, and the rights of data subjects.

Article 20 of the Turkish Constitution states that everyone has the right to be informed about personal data concerning them. In line with this, Article 11 of the Personal Data Protection Law No. 6698 lists ‘requesting information’ among the rights of the data subject. ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH, within this scope, provides the necessary information to the Data Subject upon their request for information in accordance with Article 20 of the Turkish Constitution and Article 11 of the Personal Data Protection Law No. 6698.

3.5. PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA

ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC. KAŞ PENİNSULA GARDENS BRANCH processes personal data classified as ‘special category’ under the KVK Law No. 6698 with strict adherence to the regulations set forth in the KVK Law.

Under Article 6 of the KVK Law No. 6698, certain personal data that, when processed unlawfully, pose a risk of causing harm or discrimination to individuals are classified as ‘special category personal data.’ These data include race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, attire and clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

In accordance with the KVK Law, ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH processes special category personal data in the following circumstances, provided that sufficient measures determined by the KVK Board are taken:

If the personal data subject has given their explicit consent, or
If the data subject has not given explicit consent;
- Special category personal data other than those related to the data subject’s health and sexual life, in cases provided by law,
- Special category personal data relating to the data subject’s health and sexual life may only be processed by persons or authorised institutions and organisations subject to confidentiality obligations for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing.

3.6. TRANSFER OF PERSONAL DATA

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS ŞUBESİ may transfer the personal data and special category personal data of the data subject to third parties in accordance with the law and by taking the necessary security measures for the purposes of personal data processing. ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH acts in accordance with the provisions of Article 8 of the Personal Data Protection Law No. 6698 in this regard.

3.6.1. Transfer of Personal Data

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH may transfer personal data to third parties in accordance with the legitimate and lawful purposes of personal data processing, based on one or more of the conditions specified in Article 5 of the KVK Law, and within the scope of such conditions:

If the data subject has given explicit consent,
If there is an explicit provision in the law regarding the transfer of personal data,
If it is necessary to protect the life or physical integrity of the data subject or another person, and the data subject is unable to give consent due to actual impossibility or if consent is not legally valid;
If the transfer of personal data is necessary for the establishment or performance of a contract to which the data subject is a party,
If the transfer of personal data is necessary for ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH to fulfil its legal obligations,
If personal data has been made public by the data subject,
If the transfer of personal data is necessary for the establishment, exercise, or protection of a right,
Provided that it does not harm the fundamental rights and freedoms of the data subject,

If the transfer of personal data is necessary for the legitimate interests of ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH.

3.6.2. Transfer of Special Category Personal Data

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH, by exercising due care, taking necessary security measures, and implementing the sufficient precautions prescribed by the Personal Data Protection Board; may transfer the special category personal data of the data subject to third parties in the following cases in accordance with legitimate and lawful personal data processing purposes.

If the data subject has given explicit consent, or
If the data subject has not given explicit consent;
- If the personal data subject’s special category personal data (race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, attire and clothing, membership in associations, foundations or trade unions, criminal convictions and security measures, as well as biometric and genetic data) does not pertain to the personal data subject’s health or sexual life, in cases provided for by law,
- Special category personal data relating to the health and sex life of the data subject may only be processed by persons or authorised institutions and organisations subject to confidentiality obligations for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing.

3.7. TRANSFER OF PERSONAL DATA ABROAD

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH may transfer the personal data and special category personal data of the data subject to third parties in accordance with the law and by taking the necessary security measures for the purposes of processing personal data.

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH may transfer personal data to foreign countries deemed to have adequate protection by the Personal Data Protection Board (‘Foreign Countries with Adequate Protection’) or, in the absence of adequate protection, ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC. KAŞ PENINSULA GARDENS BRANCH may transfer personal data to foreign countries where the data controllers in Turkey and the relevant foreign country have committed in writing to provide adequate protection and obtained the approval of the Personal Data Protection Board (‘Foreign Country Where the Data Controller Committed to Adequate Protection is Located’).KAŞ PENİNSULA GARDENS BRANCH acts in accordance with the provisions of Article 9 of the KVK Law in this regard.

3.7.1. Transfer of Personal Data Abroad

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH may transfer personal data to foreign countries where the data controller has adequate protection or has committed to adequate protection, provided that the personal data subject has given explicit consent or, if the personal data subject has not given explicit consent, one of the following conditions is met:

If there is an explicit provision in the law authorising the transfer of personal data,
If it is necessary to protect the life or physical integrity of the data subject or another person, and the data subject is unable to give consent due to actual impossibility or their consent is not legally valid;
If the transfer of personal data belonging to the parties to a contract is necessary for the conclusion or performance of the contract,
If the transfer of personal data is necessary for ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH to fulfil its legal obligations,
If the personal data has been made public by the data subject,
If the transfer of personal data is necessary for the establishment, exercise, or protection of a right,
If the transfer of personal data is necessary for the legitimate interests of ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH, provided that it does not harm the fundamental rights and freedoms of the personal data owner.

3.7.2. Transfer of Special Category Personal Data Abroad

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH, by exercising due diligence, taking necessary security measures, and implementing the adequate safeguards required by the Personal Data Protection Board; may transfer the special category personal data of the data subject to foreign countries where the data controller with adequate protection or a commitment to adequate protection is located, in accordance with legitimate and lawful personal data processing purposes, under the following circumstances:

If the data subject has given explicit consent, or
If the data subject has not given explicit consent;
- Special category personal data of the data subject, excluding data related to their health and sexual life (such as race, ethnic origin, political opinions, philosophical beliefs, religion, denomination or other beliefs, attire and clothing, membership in associations, foundations or trade unions, criminal convictions and security measures, as well as biometric and genetic data), in cases specified by law,
- Special category personal data relating to the health and sex life of the data subject may only be processed by persons or authorised institutions and organisations subject to confidentiality obligations for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing.

4 – CATEGORISATION OF PERSONAL DATA PROCESSED BY OUR COMPANY, PURPOSES OF PROCESSING AND RETENTION PERIODS

4.1. CATEGORISATION OF PERSONAL DATA

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH, in accordance with the legitimate and lawful personal data processing purposes of the company, based on one or more of the personal data processing conditions specified in Article 5 of the KVK Law and limited to these conditions, primarily the principles specified in Article 4. and the general principles set forth in the KVK Law, as well as all obligations stipulated in the KVK Law, and the personal data of the subjects covered by this Policy (Employees, Subcontractor Employees, Job Applicants, Customers, Suppliers, Visitors, Interns, and Third Parties) are processed in accordance with Article 10 of the KVK Law, after informing the relevant individuals.

PERSONAL DATA CATEGORISATION

Identity Information: Data that is clearly attributable to an identified or identifiable natural person; processed partially or entirely automatically or non-automatically as part of a data recording system; data containing information about a person’s identity, such as name, surname, Turkish ID number, nationality, mother’s name, father’s name, place of birth, date of birth, gender, ID number, nationality, mother’s name, father’s name, place of birth, date of birth, gender, etc., as well as documents such as driver’s licence, identity card, and passport, and information such as SGK number, signature, vehicle registration number, etc.
Communication Information: Information that is clearly attributable to an identified or identifiable natural person; processed partially or fully automatically or non-automatically as part of a data recording system; such as telephone number, address, e-mail address, fax number, IP address
Location Data: Information that is clearly attributable to an identified or identifiable natural person; processed either partially or fully automatically or non-automatically as part of a data recording system; personal data of the data subject processed by the business units of ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH within the scope of operations carried out by the company, Information identifying the location of ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH vehicles while being used by employees of institutions with which we collaborate, or while using the company’s products and services; GPS location, travel data, etc.
Family Members and Close Relatives: Information that is clearly related to an identified or identifiable natural person; processed partially or entirely automatically or non-automatically as part of a data recording system; ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.Information about the family members (e.g., spouse, mother, father, children), close relatives, and other persons who can be contacted in emergencies of the personal data subject, processed by the business units of ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC. KAŞ PENİNSULA GARDENS BRANCH within the scope of operations conducted by the company, in relation to the products and services offered by the company, or to protect the legal and other interests of the company and the personal data subject.
Physical Location Security Information: Personal data that is clearly attributable to an identified or identifiable natural person; processed partially or entirely automatically or non-automatically as part of a data recording system; records and documents obtained upon entry to a physical location and during stay within the physical location; camera recordings and records obtained at security points, etc.
Financial Information: Personal data that is clearly attributable to an identified or identifiable natural person; processed in whole or in part by automated means or in a non-automated manner as part of a data recording system. ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH, processed in accordance with the type of legal relationship established with the data subject, including bank account numbers, IBAN numbers, credit card information, financial profile, asset data, income information, and other similar data.
Visual/Audio Information: Data that clearly belongs to an identified or identifiable real person; photographs and camera recordings (excluding recordings falling under Physical Premises Security Information), audio recordings, and data contained in documents that are copies of documents containing personal data
Personal Information: Data that is clearly attributable to an identified or identifiable natural person; processed partially or entirely automatically or non-automatically as part of a data recording system; processed for the purpose of obtaining information that will form the basis of the personal rights of natural persons who have a working relationship with ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH
Special Category Personal Data: Personal data that is clearly attributable to an identified or identifiable natural person; processed either fully or partially automatically or non-automatically as part of a data recording system; data specified in Article 6 of the KVK Law (e.g. health data including blood type, biometric data, information about membership in associations and unions, etc.)
Request/Complaint Management Information: Personal data that is clearly attributable to an identified or identifiable natural person; processed either partially or fully automatically or non-automatically as part of a data recording system; personal data related to the receipt and evaluation of any requests or complaints directed to ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH.

4.2. PURPOSES OF PROCESSING PERSONAL DATA

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH processes personal data within the scope of the purposes and conditions specified in Article 5, paragraph 2, and Article 6, paragraph 3 of the Personal Data Protection Law. These purposes and conditions are as follows:

The processing of your personal data is explicitly provided for by law in relation to the relevant activities of ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC. KAŞ PENINSULA GARDENS BRANCH.
The processing of your personal data by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH is directly related to and necessary for the establishment or performance of a contract
The processing of your personal data is necessary for ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH to fulfil its legal obligations
Processing of personal data by ATILGAN AKVARYUM İNŞ.SAN.TİC.AŞ.KAŞ PENİNSULA GARDENS BRANCH, provided that the data subject has made the personal data public and limited to the purpose of such public disclosure
Processing of personal data by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH is necessary for the establishment, exercise, or protection of the rights of ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH, the data subject, or third parties
Processing of personal data by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH is necessary for the legitimate interests of ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH, provided that such processing does not harm the fundamental rights and freedoms of the data subject
Processing of personal data by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH is necessary for the protection of the life or physical integrity of the data subject or another person, and in such cases, the data subject is unable to give consent due to actual or legal incapacity
The processing of special category personal data, excluding those related to the data subject’s health and sexual life, is required by law
For special category personal data relating to the data subject’s health and sexual life, processing is carried out by persons or authorised institutions and organisations subject to confidentiality obligations for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing.

Within this scope, ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH processes personal data for the following purposes:

Planning and implementation of corporate sustainability activities
Event management
Management of relationships with suppliers and customers
Management of relationships with subcontractors
Conducting personnel recruitment processes
Conducting/monitoring financial reporting and risk management processes
ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH execution/monitoring of legal affairs
Planning and execution of corporate communication activities
Execution of corporate management activities
Request and complaint management
Providing information to authorised institutions as required by law

If the processing activities carried out for the aforementioned purposes do not meet any of the conditions set forth in the KVK Law, ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH will obtain your explicit consent for the relevant processing process.

4.3. RETENTION PERIODS FOR PERSONAL DATA

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH retains personal data for the periods specified in the relevant laws and regulations, if such periods are stipulated therein.

If no specific retention period is stipulated in the legislation regarding how long personal data should be retained, personal data will be retained by ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC.KAŞ PENİNSULA GARDENS BRANCH will process the data for as long as necessary for the activities and practices carried out while processing the data and in accordance with the commercial practices of the company, and will then delete, destroy or anonymise the data.

If the purpose of processing personal data has ended and the retention periods specified by ATILGAN AKVARYUM İNŞ.IND. & COM. INC. KAŞ PENİNSULA GARDENS BRANCH, the personal data may be retained solely for the purpose of serving as evidence in potential legal disputes or for the assertion or defence of rights related to the personal data. In determining these periods, the statute of limitations periods for asserting the aforementioned right are taken into account, and even if such periods have expired, the retention periods are determined based on examples from previous requests made to ATILGAN AKVARYUM INŞ. SAN. TİC. A.Ş. KAŞ PENİNSULA GARDENS BRANCH regarding the same matters. In such cases, personal data stored for this purpose shall not be accessed for any other purpose and shall only be accessed when necessary for the resolution of the relevant legal dispute. After the aforementioned period expires, personal data shall be deleted, destroyed, or anonymised.

5 – CATEGORISATION OF THE OWNERS OF PERSONAL DATA PROCESSED BY ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH processes the personal data of the categories listed below; however, the scope of this Policy is limited to Employees, Subcontractor Employees, Job Applicants, Interns, Customers, Suppliers, Third Parties, and Visitors.

The terms Employees, Subcontractor Employees, Interns, Job Applicants, Visitors, Suppliers, Third Parties, and Customers used in this Policy are defined below.

The table below details the categories of personal data subjects mentioned above and the types of personal data processed within these categories.

6 THIRD PARTIES TO WHOM PERSONAL DATA IS TRANSFERRED BY ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH AND THE PURPOSES OF TRANSFER

ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC. KAŞ PENINSULA GARDENS BRANCH may transfer the personal data of data subjects managed in accordance with the Policy to the following categories of persons in compliance with Articles 8 and 9 of the KVK Law:

ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC. KAŞ PENINSULA GARDENS BRANCH senior management,
ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC. KAŞ PENINSULA GARDENS BRANCH authorised personnel,
Legally authorised public institutions and organisations
Legally authorised private legal entities

The scope of the above-mentioned persons to whom the data is transferred and the purposes of data transfer are specified below.

7. SECTION

7 – PROCESSING OF PERSONAL DATA BASED ON THE CONDITIONS SET OUT IN THE LAW AND LIMITED TO THESE CONDITIONS

7.1. PROCESSING OF PERSONAL DATA AND SPECIAL CATEGORIES OF PERSONAL DATA

7.1.1. Processing of Personal Data

The explicit consent of the data subject is only one of the legal bases that enables the lawful processing of personal data. In addition to explicit consent, personal data may also be processed if any of the other conditions listed below are met. The legal basis for personal data processing activities may be any one of the conditions listed below, or more than one condition may serve as the legal basis for the same personal data processing activity.

Although the legal bases for the processing of personal data by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH may differ, all personal data processing activities are carried out in accordance with the general principles set out in Article 4 of the Personal Data Protection Law.

(i) Existence of the Data Subject’s Explicit Consent

One of the conditions for the processing of personal data is the explicit consent of the data subject. The data subject’s explicit consent must be specific to a particular matter, based on information provided, and freely given.

For personal data processing activities beyond the purpose of processing (primary processing) related to the reasons for obtaining personal data (secondary processing), at least one of the conditions set forth in subheadings (ii), (iii), (iv), (v), (vi), (vii) and (viii) of this section must be met; if any of these conditions are not met, ATILGAN AKVARYUM INŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH carries out these personal data processing activities based on the explicit consent of the personal data owner for these processing activities.

For the processing of personal data based on the explicit consent of the personal data owner, the explicit consent of the personal data owners is obtained through the relevant methods.

(ii) Explicit Provision in the Law

The personal data of the data subject may be processed in accordance with the law if explicitly provided for by law.

(iii) Impossibility of Obtaining the Data Subject’s Explicit Consent Due to Practical Impossibility

If it is necessary to process personal data in order to protect the life or physical integrity of the data subject or another person, and the data subject is unable to express their consent due to actual impossibility or their consent cannot be recognised as valid, the personal data may be processed.

(iv) Direct Relevance to the Establishment or Performance of a Contract

Personal data may be processed if it is necessary for the establishment or performance of a contract, provided that the processing is directly related to the contract and the personal data belongs to the parties to the contract.

(v) Compliance with Legal Obligations by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH may process the personal data of the data subject if such processing is necessary for the data controller to fulfil its legal obligations.

(vi) Disclosure of Personal Data by the Data Subject

If the data subject has disclosed their personal data publicly, the relevant personal data may be processed.

(vii) Necessity of Data Processing for the Establishment or Protection of a Right

If data processing is necessary for the establishment, exercise, or protection of a right, the personal data of the data subject may be processed.

(viii) Necessity of Data Processing for the Legitimate Interest of ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH

Personal data may be processed if it is necessary for the legitimate interests of ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH, provided that such processing does not infringe upon the fundamental rights and freedoms of the data subject.

7.1.2. Processing of Special Category Personal Data

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH processes special category personal data without the explicit consent of the data subject, provided that the necessary safeguards determined by the Personal Data Protection Board are in place, in the following cases:

Special category personal data other than those related to the data subject’s health and sexual life may be processed in cases provided by law,
Special category personal data relating to the data subject’s health and sexual life may only be processed by persons or authorised institutions and organisations subject to a duty of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing.

8– BUILDING AND FACILITY ENTRANCES AND PERSONAL DATA PROCESSING ACTIVITIES WITHIN BUILDINGS AND FACILITIES

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH, for the purpose of ensuring security, conducts personal data processing activities involving surveillance camera monitoring and tracking of guest entries and exits at the buildings and facilities of ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH.

The use of security cameras and the recording of guest entries and exits constitute personal data processing activities carried out by ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC. KAŞ PENINSULA GARDENS BRANCH.

8.1. CAMERA MONITORING ACTIVITIES CONDUCTED BY ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH AT THE ENTRANCES AND INSIDE ITS BUILDINGS AND FACILITIES

This section provides information about the camera surveillance system of ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH and explains how personal data, privacy, and fundamental rights are protected.

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH conducts camera surveillance activities for purposes such as protecting the security of the company and other individuals.

8.1.1. Legal Basis for Camera Surveillance Activities

The camera surveillance activities conducted by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH are carried out in accordance with the Law on Private Security Services and relevant legislation.

8.1.2. Conducting Camera Surveillance Activities in Compliance with the KVK Law

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH conducts camera surveillance activities for security purposes in accordance with the provisions of the KVK Law. ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH conducts security camera monitoring activities in its buildings and facilities for the purpose of ensuring security, in accordance with the relevant legislation in force and the conditions for processing personal data set forth in the KVK Law.

8.1.3. Notification of Camera Surveillance Activities

In accordance with Article 10 of the KVK Law, ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH informs the data subject of the following:

, the data subject is informed. ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH provides notification regarding camera surveillance activities through multiple methods as part of its general information disclosure. This is done to prevent harm to the fundamental rights and freedoms of the personal data owner, to ensure transparency and to provide information to the personal data owner.

8.1.4. Purpose of Camera Surveillance Activities and Limitation to Purpose

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH processes personal data in a manner that is connected to the purpose for which they are processed, limited, and proportionate, in accordance with Article 4 of the Personal Data Protection Law.

The purpose of the video surveillance activities conducted by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH is limited to the purposes stated in this Policy. In this regard, the surveillance areas, number of cameras, and timing of surveillance are implemented in a manner that is sufficient to achieve the security purpose and limited to that purpose. Areas where surveillance could result in interference with a person’s privacy beyond security purposes (e.g., changing rooms, showers, and toilets) are not subject to surveillance.

8.1.5. Ensuring the Security of the Data Obtained

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH takes the necessary technical and administrative measures to ensure the security of personal data obtained through camera surveillance activities in accordance with Article 12 of the KVK Law.

8.1.6. Retention Period for Personal Data Obtained Through Camera Surveillance

The retention period for personal data obtained through camera surveillance by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH is limited to 30 days.

8.1.7. Who Has Access to Information Obtained Through Surveillance and to Whom This Information Is Disclosed

Access to live camera footage and digitally recorded and stored footage is restricted to a limited number of employees of ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH. The limited number of individuals with access to the recordings have signed a confidentiality agreement pledging to protect the confidentiality of the data they access.

8.2. MONITORING OF GUEST ENTRY AND EXIT AT THE BUILDING AND FACILITIES OF ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH

ATILGAN AKVARYUM İNŞ.IND. & TR. INC. KAŞ PENINSULA GARDENS BRANCH; personal data processing activities are carried out for the purpose of ensuring security and for the purposes specified in this Policy, regarding the tracking of customer, supplier, etc. entry and exit at the buildings of ATILGAN AKVARYUM CONSTRUCTION IND. & TR. INC. KAŞ PENINSULA GARDENS BRANCH.

When the names and surnames of individuals entering the premises of ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC. KAŞ PENINSULA GARDENS BRANCH are obtained, or when ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC.IND.TR.CO. KAŞ PENİNSULA GARDENS BRANCH, the relevant personal data subjects are informed about this scope through texts displayed at the premises or made available to guests in other ways. The data obtained for the purpose of tracking guest entry and exit are processed solely for this purpose, and the relevant personal data are recorded in a physical data recording system.

8.3. ATILGAN AKVARYUM CONSTRUCTION INDUSTRY AND TRADE INC. KAŞ PENINSULA GARDENS BRANCH RECORDS RELATED TO INTERNET ACCESS PROVIDED TO VISITORS IN THE BUILDINGS AND FACILITIES

ATILGAN AKVARYUM CONSTRUCTIONIND. & TR. INC. KAŞ PENINSULA GARDENS BRANCH for the purposes of ensuring security and as specified in this Policy; ATILGAN AKVARYUM CONSTRUCTION IND. & TR. INC. KAŞ PENINSULA GARDENS BRANCH may provide internet access to visitors who request it during their stay at our premises. In such cases, log records related to your internet access are recorded in accordance with the provisions of Law No. 5651 and the regulations issued pursuant to this Law; these records are only accessible to authorized public institutions and organizations upon request or … ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC.KAŞ PENİNSULA GARDENS BRANCH in order to fulfil our legal obligations during the inspection processes to be carried out within the scope of the Law on the Protection of Personal Data.

Within this framework, only a limited number of ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH employees have access to the log records obtained. ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş. KAŞ PENİNSULA GARDENS BRANCH employees who have access to the aforementioned records may only access them for the purpose of responding to requests from authorised public institutions and organisations or during audit processes, and may only share them with legally authorised individuals. A limited number of individuals with access to the records have declared that they will protect the confidentiality of the data they access under a confidentiality agreement.

9 – CONDITIONS FOR THE DELETION, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA

9.1. ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH’S OBLIGATION TO DELETE, DESTROY, AND ANONYMIZE PERSONAL DATA

Article 138 of the Turkish Penal Code No. 5237 and Articles 5 and 6 of the Personal Data Protection Law, as well as the Regulation on the Deletion, Destruction, or Anonymisation of Personal Data, personal data must be deleted, destroyed, or anonymised by the data controller either on its own initiative or upon the request of the relevant individual, provided that all conditions for the processing of personal data have ceased to exist.

In the deletion, destruction or anonymisation of personal data, it is mandatory to act in accordance with the general principles set out in Article 4 of the KVK Law, the technical and administrative measures to be taken under Article 12, the relevant legislation, the decisions of the Board and the personal data retention and destruction policy.

All operations related to the deletion, destruction, and anonymisation of personal data are recorded, and such records are retained for at least three years, except for other legal obligations.

The data controller is required to explain the methods applied in the process of deleting, destroying, or anonymising personal data in the relevant policies and procedures.

Unless otherwise decided by the Board, the data controller selects the appropriate method of deletion, destruction, or anonymisation of personal data. Upon the request of the relevant individual, the data controller selects the appropriate method and explains the reasons for the selection.

9.2. TECHNIQUES FOR DELETING, DESTROYING, AND ANONYMIZING PERSONAL DATA

9.2.1. Techniques for Deleting and Destroying Personal Data

The deletion of personal data is the process of rendering personal data inaccessible and unusable by relevant users in any manner. The data controller is obligated to take all necessary technical and administrative measures to ensure that deleted personal data is inaccessible and unusable by relevant users.

The destruction of personal data is the process of rendering personal data inaccessible, irrecoverable, and unusable by anyone. The data controller is obligated to take all necessary technical and administrative measures to ensure the destruction of personal data.

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH may delete or destroy personal data on its own initiative or at the request of the relevant person if all the conditions for the processing of personal data have ceased to exist, even if the personal data has been processed in accordance with the provisions of the relevant law. The most commonly used deletion or destruction techniques by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH are listed below:

(i) Physical Destruction

Personal data may also be processed by non-automated means, provided that it is part of a data recording system. When such data is deleted/destroyed, the system ensures that the personal data is physically destroyed in such a way that it cannot be used again.

(ii) Secure Deletion from Software

When data processed by fully or partially automated means and stored in digital environments is deleted/destroyed, methods are used to ensure that the data is deleted from the relevant software in such a way that it cannot be recovered.

(iii) Secure Deletion by an Expert

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH may, in certain cases, enter into an agreement with an expert to delete personal data on its behalf. In such cases, personal data is securely deleted/destroyed by the expert in a manner that prevents its recovery.

9.2.2. Techniques for Anonymising Personal Data

Anonymising personal data means rendering personal data incapable of being associated with any identifiable or identifiable natural person, even when combined with other data.

For personal data to be considered anonymised, it must be rendered incapable of being associated with an identified or identifiable natural person, even through the use of appropriate technical measures by the data controller, recipient, or recipient groups, such as reversal or matching with other data, taking into account the context in which the data is processed. The data controller is responsible for taking all necessary technical and administrative measures to ensure that personal data is anonymised. ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH may anonymise personal data when the reasons for processing such data in accordance with the law no longer exist.

In accordance with Article 28 of the KVK Law, personal data that has been anonymised may be processed for purposes such as research, planning, and statistics. Such processing is outside the scope of the KVK Law, and the explicit consent of the data subject will not be required. Since personal data processed by anonymisation falls outside the scope of the KVK Law, the rights set forth in Section 10 of the Policy shall not apply to such data. The anonymisation techniques most commonly used by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH are listed below.

(i) Masking

Data masking is the method of anonymising personal data by removing its fundamental identifying information from the data set.

(ii) Aggregation

The data aggregation method involves combining multiple data points to create aggregated data, rendering personal data unlinkable to any individual.

(iii) Data Derivation

Data derivation is a method that creates a more general content from the content of personal data and ensures that personal data cannot be linked to any individual.

(iv) Data Mixing

The data mixing method involves scrambling the values within a personal data set to sever the link between the values and the individuals.

9.2.3. Time limits for the deletion, destruction, and anonymisation of personal data

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH has established a ‘Personal Data Retention and Destruction Policy,’ and within the scope of the obligation to delete, destroy, or anonymise personal data, personal data will be deleted, destroyed, or anonymised during the first periodic destruction process.
The time frame for periodic destruction, the nature of the documents to be destroyed, and the destruction and disposal techniques are specified in the personal data retention and destruction policy established by ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC. KAŞ PENINSULA GARDENS BRANCH.
ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH will destroy, erase, or anonymise personal data recorded in manual or electronic formats when the purposes for which such data was collected have been fulfilled and the retention periods specified by law have expired, in accordance with the policy it has established.

9.2.4. Deletion and destruction periods upon the request of the data subject

When the data subject requests the deletion or destruction of their personal data by applying to the data controller in accordance with Article 13 of the KVK Law;
a) If all the conditions for processing personal data have ceased to exist, the data controller shall delete, destroy, or anonymise the personal data subject to the request. The data controller shall finalise the data subject’s request within thirty days at the latest and inform the data subject.
b) If all the conditions for processing personal data have ceased to exist and the personal data subject to the request have been transferred to third parties, the data controller shall notify the third party of this situation; and ensure that the necessary procedures are carried out in accordance with this Regulation at the third party’s end.
c) If all the conditions for processing personal data have not ceased to exist, this request may be rejected by the data controller in accordance with the third paragraph of Article 13 of the KVK Law, with the reasons explained, and the rejection response shall be notified to the relevant individual in writing or electronically within thirty days at the latest.

10 – RIGHTS OF DATA SUBJECTS; PROCEDURES FOR EXERCISING AND EVALUATING THESE RIGHTS

10.1 RIGHTS OF THE DATA SUBJECT AND EXERCISING THESE RIGHTS

10.1.1. Rights of the Data Subject

Personal data subjects have the following rights:

To learn whether personal data has been processed,
To request information about the processing of personal data,
To learn the purpose of the processing of personal data and whether it is used for its intended purpose,
To know the third parties to whom personal data has been transferred within or outside the country,
To request the correction of personal data that has been processed inaccurately or incompletely, and to request that this correction be communicated to third parties to whom the personal data has been transferred,
Requesting the deletion or destruction of personal data, even if processed in accordance with the provisions of the KVK Law and other relevant laws, if the reasons for processing no longer exist, and requesting that the third parties to whom the personal data has been transferred be informed of this action,
Object to the analysis of processed data exclusively by automated systems resulting in a decision against the individual,
Request compensation for damages incurred due to the unlawful processing of personal data.

10.1.2. Cases in Which the Personal Data Owner Cannot Exercise Their Rights

Pursuant to Article 28 of the Personal Data Protection Law, personal data subjects cannot exercise the rights listed in 10.1.1 in the following cases, as these cases are excluded from the scope of the Personal Data Protection Law:

Processing of personal data for purposes such as research, planning and statistics by rendering them anonymous through official statistics.
Processing of personal data for artistic, historical, literary or scientific purposes or within the scope of freedom of expression, provided that such processing does not violate national defence, national security, public safety, public order, economic security, privacy of private life or personality rights, or constitute a criminal offence.
Processing of personal data by public institutions and organisations authorised by law to carry out preventive, protective and intelligence activities aimed at ensuring national defence, national security, public safety, public order or economic security.
Processing of personal data by judicial authorities or enforcement authorities in connection with investigation, prosecution, trial or enforcement proceedings.

Pursuant to Article 28/2 of the KVK Law, in the cases listed below, personal data subjects may not exercise the other rights listed in 10.1.1, except for the right to request compensation for damage:

The processing of personal data is necessary for the prevention of a crime or for a criminal investigation.
The processing of personal data that has been made public by the data subject themselves.
Processing of personal data by public institutions and organisations authorised by law, or by professional organisations with public institution status, for the performance of their supervisory or regulatory duties, or for disciplinary investigations or prosecutions.
The processing of personal data is necessary for the protection of the economic and financial interests of the State in relation to budget, tax and financial matters.

10.1.3. Exercising the Rights of the Personal Data Owner

Personal Data Owners may exercise the rights listed under the heading 10.1.1. The data subjects may submit their requests regarding the rights listed under the heading of this section, along with the information and documents necessary to identify themselves, using the methods specified below or other methods determined by the Personal Data Protection Board, by filling out and signing the Application Form and submitting it free of charge to ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH: www…………………..com. After filling out the form, a copy with a wet signature must be delivered in person or through a notary public to the following address:

In order for third parties to submit a request on behalf of personal data owners, a special power of attorney issued by a notary public on behalf of the data owner must be provided.

10.1.4. Right of the Personal Data Owner to File a Complaint with the KVK Board

In accordance with Article 14 of the KVK Law, if the application is rejected, the response is found to be insufficient, or no response is provided within the specified time frame, the personal data owner may file a complaint with the KVK Board within thirty days of receiving the response from ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH may file a complaint with the Personal Data Protection Board within thirty days from the date they receive the response and, in any case, within sixty days from the date of the application.

10.2. ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH’S RESPONSE TO APPLICATIONS

ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC. KAŞ PENINSULA GARDENS BRANCH may respond to applicants regarding personal data collected directly or indirectly from data subjects in accordance with the KVK Law.

10.2.1. ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC. KAŞ PENINSULA GARDENS BRANCH’S PROCEDURE AND TIMEFRAME FOR RESPONDING TO APPLICATIONS

If the data subject submits their request to ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC. KAŞ PENINSULA GARDENS BRANCH in accordance with the procedure set out in Section 10.1.3 of this section, ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC.IND.TR.CO.LTD.KAŞ PENİNSULA GARDENS BRANCH will process the request free of charge within thirty days at the latest, depending on the nature of the request. However, if the KVK Board determines a fee, ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH will collect the fee specified by the KVK Board from the applicant.

10.2.2. Information that ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH may request from the data subject who submitted the request

ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC. KAŞ PENINSULA GARDENS BRANCH may request information from the relevant individual to determine whether the applicant is the data subject. ATILGAN AKVARYUM CONSTRUCTION INDUSTRY TRADE INC. KAŞ PENINSULA GARDENS BRANCH may ask the data subject questions related to their application to clarify the matters stated in the application.

10.2.3. ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş. KAŞ PENİNSULA GARDENS BRANCH’S RIGHT TO REJECT THE APPLICATION OF THE DATA SUBJECT

ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH may reject the application of the applicant in the following cases, explaining the reasons:

Processing of personal data for purposes such as research, planning and statistics by rendering them anonymous through official statistics.
Processing of personal data for artistic, historical, literary, or scientific purposes, or within the scope of freedom of expression, provided that such processing does not violate national defence, national security, public safety, public order, economic security, privacy of private life, or personality rights, or constitute a criminal offence.
Processing of personal data by public institutions and organisations authorised by law to carry out preventive, protective and intelligence activities aimed at ensuring national defence, national security, public safety, public order or economic security.
Processing of personal data by judicial authorities or enforcement authorities in connection with investigation, prosecution, trial or enforcement proceedings.
Processing of personal data necessary for the prevention of crime or criminal investigation.
Processing of personal data made public by the data subject.
Processing of personal data by public institutions and organisations authorised by law, and professional organisations with public institution status, for the performance of their supervisory or regulatory duties, or for disciplinary investigations or prosecutions.
Processing of personal data necessary for the protection of the economic and financial interests of the State in relation to budget, tax and financial matters.
The possibility that the request of the personal data owner may prevent the rights and freedoms of other persons.
Requests that require disproportionate effort.
The information requested is publicly available.

K-4 PROCESSING OF PERSONAL DATA OF JOB APPLICANTS

Personal data collected from job applicants during the recruitment process, as well as special category personal data collected in accordance with the nature of the job, are processed by ATILGAN AKVARYUM INŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH for the purposes specified in Section 4.2 and Section 7 of this Policy and listed below:

To assess the qualifications, experience, and suitability of Job Applicants for the open position,
To verify the accuracy of the information provided by Job Applicants or to contact third parties to conduct research about the Job Applicant, if necessary,
To communicate with the Job Applicant about the application and recruitment process or, if appropriate, to contact the candidate for any position opened domestically or internationally at a later date,
To comply with the requirements of relevant legislation or the requests of authorised institutions or organisations,
To develop and improve the recruitment principles applied by ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH.

The personal data of Job Applicants may be collected through the following methods and means:

Digital application forms published in written or electronic format;
Resumes submitted to ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH via email, courier, reference, or similar methods;
Employment or consulting companies;

Job applicants may exercise their rights arising from their status as data subjects by submitting their requests to ATILGAN AKVARYUM İNŞ.SAN.TİC.A.Ş.KAŞ PENİNSULA GARDENS BRANCH using the method outlined in Section 10 of this Policy.