Privacy and Protection of Personal Data Principles
ÇUMİTAŞ
PRIVACY AND PROTECTION OF PERSONAL DATA PRINCIPLES
1. PURPOSE AND SCOPE
This Privacy and Protection of Personal Data Principles (“Principles”) regulates principles accepted regarding protection of personal data by ÇUKUROVA MAKİNA İMALAT VE TİC.A.Ş.� (shall referred as “Company” or “Data Controller” hereinafter) and determines the personal data processing principles regarding the processing of personal data of Visitors, Customers, Prospective Customers, Suppliers, Online Visitors (“Contact Groups”) and aims to enlighten the groups of people in question.
2. PRINCIPLES ON PROCESSING OF PERSONAL DATA
As a company, we process your personal data in the capacity of Data Supervisor within the framework of the following principles.
2.1 Processing in accordance with the Law and the Rules of Honesty
In the processing of your personal data, the principles of legal regulations and the general trust and honesty rule are followed.
2.2 Ensuring that Personal Data is Accurate and Updated when Required
Taking into account your legitimate interests, periodic checks and updates are made to ensure that the processed data is accurate and up-to-date, and necessary measures are taken in this direction. In this context, systems for checking the accuracy of personal data and making the necessary corrections are established within the Company.
�2.3 Processing for Specific, Clear and Legitimate Purposes
Your personal data are processed based on clear, specific and legitimate data processing purposes.
�2.4 Being Related, Limited and Measured for the Purpose of Processing
Your personal data are processed in a measured, relevant and limited manner in order to achieve the anticipated purpose / purposes, and the processing of personal data that is not related to the realization of the purpose or is not needed is avoided.
2.5 Retaining for the Period Stipulated in the Relevant Legislation or Required for the Purpose for which they are processed
Your personal data are kept only for the period stipulated in the relevant legislation or required for the purpose for which they are processed. In this context, first of all, it is determined whether a period is stipulated in the relevant legislation for the storage of personal data, if a period is determined, this period is followed, and if a period is not determined, personal data are stored for the period required for the purpose for which they are processed. If there is no legal reason to allow them to be processed for a longer period of time, in case the reasons requiring the expiry of the period or the processing are eliminated, your personal data are deleted, destroyed or anonymized in accordance with the Company’s Personal Data Storage and Destruction Policy.
3. CONDITIONS OF PROCESSING PERSONAL DATA
Your personal data is processed by the Company within the framework of the conditions below.
3.1 Clearly Stipulated in Laws
In cases where processing of personal data is explicitly stipulated by laws, your personal data may be processed.
3.2 Failure to Obtain Explicit Consent of the Relevant Person Due to Actual Impossibility
Your personal data may be processed if it is compulsory to process the personal data of the person concerned or another person who is unable to disclose his consent due to the actual impossibility or whose consent is not valid, or to protect the life or body integrity of another person.
3.3 Directly Related to the Establishment or Execution of the Contract
Provided that it is directly related to the establishment or execution of the contract, your personal data may be processed if it is necessary to process the personal data of the parties to the contract.
3.4 Fulfilling the Legal Obligation of the Company
Your personal data may be processed if processing is mandatory to fulfill legal obligations as a data controller.
3.5 Making Personal Data Public
If your personal data is made public by you, it can be processed.
3.6 When Data Processing is Mandatory for the Establishment or Protection of a Right
If data processing is mandatory for the establishment, use or protection of a right, your personal data may be processed.
�3.7 Processing of Data Based on Legitimate Interest
If data processing is required for the legitimate interests of the Company, your personal data may be processed.
3.8 Processing Based on Explicit Consent
In cases where your personal data cannot be processed based on any of the conditions specified in these Principles, it is processed based on express consent.
4. CATEGORIZATION OF PERSONAL DATA
PRIVACY AND PROTECTION OF PERSONAL DATA PRINCIPLES
1. PURPOSE AND SCOPE
This Privacy and Protection of Personal Data Principles (“Principles”) regulates principles accepted regarding protection of personal data by ÇUKUROVA MAKİNA İMALAT VE TİC.A.Ş.� (shall referred as “Company” or “Data Controller” hereinafter) and determines the personal data processing principles regarding the processing of personal data of Visitors, Customers, Prospective Customers, Suppliers, Online Visitors (“Contact Groups”) and aims to enlighten the groups of people in question.
2. PRINCIPLES ON PROCESSING OF PERSONAL DATA
As a company, we process your personal data in the capacity of Data Supervisor within the framework of the following principles.
2.1 Processing in accordance with the Law and the Rules of Honesty
In the processing of your personal data, the principles of legal regulations and the general trust and honesty rule are followed.
2.2 Ensuring that Personal Data is Accurate and Updated when Required
Taking into account your legitimate interests, periodic checks and updates are made to ensure that the processed data is accurate and up-to-date, and necessary measures are taken in this direction. In this context, systems for checking the accuracy of personal data and making the necessary corrections are established within the Company.
�2.3 Processing for Specific, Clear and Legitimate Purposes
Your personal data are processed based on clear, specific and legitimate data processing purposes.
�2.4 Being Related, Limited and Measured for the Purpose of Processing
Your personal data are processed in a measured, relevant and limited manner in order to achieve the anticipated purpose / purposes, and the processing of personal data that is not related to the realization of the purpose or is not needed is avoided.
2.5 Retaining for the Period Stipulated in the Relevant Legislation or Required for the Purpose for which they are processed
Your personal data are kept only for the period stipulated in the relevant legislation or required for the purpose for which they are processed. In this context, first of all, it is determined whether a period is stipulated in the relevant legislation for the storage of personal data, if a period is determined, this period is followed, and if a period is not determined, personal data are stored for the period required for the purpose for which they are processed. If there is no legal reason to allow them to be processed for a longer period of time, in case the reasons requiring the expiry of the period or the processing are eliminated, your personal data are deleted, destroyed or anonymized in accordance with the Company’s Personal Data Storage and Destruction Policy.
3. CONDITIONS OF PROCESSING PERSONAL DATA
Your personal data is processed by the Company within the framework of the conditions below.
3.1 Clearly Stipulated in Laws
In cases where processing of personal data is explicitly stipulated by laws, your personal data may be processed.
3.2 Failure to Obtain Explicit Consent of the Relevant Person Due to Actual Impossibility
Your personal data may be processed if it is compulsory to process the personal data of the person concerned or another person who is unable to disclose his consent due to the actual impossibility or whose consent is not valid, or to protect the life or body integrity of another person.
3.3 Directly Related to the Establishment or Execution of the Contract
Provided that it is directly related to the establishment or execution of the contract, your personal data may be processed if it is necessary to process the personal data of the parties to the contract.
3.4 Fulfilling the Legal Obligation of the Company
Your personal data may be processed if processing is mandatory to fulfill legal obligations as a data controller.
3.5 Making Personal Data Public
If your personal data is made public by you, it can be processed.
3.6 When Data Processing is Mandatory for the Establishment or Protection of a Right
If data processing is mandatory for the establishment, use or protection of a right, your personal data may be processed.
�3.7 Processing of Data Based on Legitimate Interest
If data processing is required for the legitimate interests of the Company, your personal data may be processed.
3.8 Processing Based on Explicit Consent
In cases where your personal data cannot be processed based on any of the conditions specified in these Principles, it is processed based on express consent.
4. CATEGORIZATION OF PERSONAL DATA
5��� PURPOSE OF PROCESSING PERSONAL DATA
In the Company, personal data can be processed for the following purposes according to the relevant person group within the personal data processing conditions specified in Articles 5 and 6 of the Law No. 6698.
5.1 CUSTOMER
Customer’s personal data may be processed under personal data processing conditions given in 5th and 6th clauses of 6698 numbered Law for conducting the necessary business and operational processes in order to benefit from the products and services offered by the company, the execution of the contract, the follow-up of the financial and accounting affairs, the planning and execution of the processes of customer relations management and customer satisfaction activities, the follow-up of the contract processes and customer requests and complaints, the planning of information security processes, It can be processed for the purposes of creating and managing the infrastructure and its supervision and execution.
5.2 CANDIDATE CUSTOMER
The personal data of the Candidate Customer, within the scope of the personal data processing conditions specified in Articles 5 and 6 of the Law No.6698, can be processed for the purposes of the products and services offered by the company, according to the likes, usage habits and needs of the relevant persons, and planning and performing the activities required for the promotion and promotion of the relevant persons, Carrying out the necessary work for the realization of the commercial activities carried out by the company and carrying out the related business processes, carrying out the necessary works and related business processes to benefit from the products and services offered by the company, planning and performing the activities required for the privatization and promotion of the products and services offered by the company, the planning and execution of customer relationship management processes.
5.3 VISITOR
Personal data of visitors, within the scope of the personal data processing conditions specified in Articles 5 and 6 of the Law No.6698, may be processed for ensuring the security of building and facility premises and / or facilities, creating and tracking visitor records, ensuring the security of fixtures and / or resources, ensuring technical and commercial occupational safety, ensuring the safety of corporate operations, providing information to authorized institutions and organizations based on the legislation.
5.4 SUPPLIER / BUSINESS PARTNER REPRESENTATIVE
Personal data of the Supplier / Business Partner representative, within the scope of the personal data processing conditions specified in Articles 5 and 6 of the Law No.6698, may be processed for carrying out the necessary business and operational processes in order to benefit from the products and services offered by the company, carrying out the necessary work for the realization of the commercial activities carried out by the company and carrying out the related business processes, carrying out the necessary studies and related business processes to benefit from the products and services offered by the company.
�
5.5 ONLINE VISITOR
Personal data of online visitors, within the scope of the personal data processing conditions specified in Articles 5 and 6 of the Law No.6698, may be processed for conducting marketing analysis studies, conducting advertising / campaign / promotion processes, conducting communication activities, carrying out studies for developing products and services, and fulfilling legal obligations.
6��� TRANSFER OF PERSONAL DATA
Your personal data will be used by our business partners, suppliers, legally authorized public institutions and private persons in Turkey and abroad, within the framework of the specified personal data processing conditions and purposes, the principles and purposes set out in Articles 3 and 5 of this Privacy and Protection of Personal Data Principles and in Articles 8 and 9 of Law No.6698.
7��� METHOD OF COLLECTING PERSONAL DATA AND ITS LEGAL REASON
Your personal data transmitted to the Company electronically are processed as follows according to the relevant person groups.
7.1 CUSTOMER
Customer personal data are included in Article 5 of Law No.6698, “the necessity of processing personal data belonging to the parties of the contract provided that it is directly related to the establishment or execution of a contract”, “the requirement for the data controller to fulfill its legal obligation”, Provided that it does not harm the rights and freedoms, it is necessary to process data for the legitimate interests of the data controller, based on the legal grounds, in physical and electronic media, written or verbal data transfer tools and as part of the data recording system are processed automatically by being taken from the person or third party.
7.2 CANDIDATE CUSTOMER
Personal data of Candidate Customers, within the Article 5 of the Law No.6698, “it is necessary to process personal data belonging to the parties of the contract provided that it is directly related to the establishment or execution of a contract”, “to be made public by the person concerned”, “to establish, exercise or protect a right. Based on the legal grounds of “it is compulsory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”, are processed automatically by getting from third person or directly from the person as a part of the data recording system via written or verbal data transfer tools in physical and electronic media.
7.3 VISITOR
Personal Data of Visitors, based on the legal reason “it is compulsory for the data controller to fulfill his legal obligation” and “data processing is mandatory for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed” in Article 5 of the Law No.6698, are processed at images of the entrance doors, exterior of the building, meeting rooms and activity areas, dining areas, cafeteria, entrance waiting area, parking lot, elevators and floor corridors in our service building are recorded and processed automatically by security cameras in the service area.
7.4 SUPPLIER / BUSINESS PARTNER REPRESENTATIVE
Personal data of the Supplier / Business Partner representative, within the Article 5 of the Law No.6698, “it is necessary to process personal data belonging to the parties of the contract provided that it is directly related to the establishment or execution of a contract”, “to be made public by the person concerned”, “to establish, exercise or protect a right. Based on the legal grounds of “it is compulsory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”, are processed automatically by getting from third person or directly from the person as a part of the data recording system via written or verbal data transfer tools in physical and electronic media.
7.5 ONLINE VISITOR
Personal data of the online visitor, based on the legal reasons under Law No. 5651 on the Regulation of Broadcasts Made on the Internet and the Fight Against Crimes Committed Through These Broadcasts and Article 5 of the Law No. 6698, “it is obligatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned” and ” being compulsory for the data controller to fulfill his legal obligation” are processed automatically.
8��� SECURITY OF PERSONAL DATA
The company takes reasonable measures to prevent unauthorized access risks, accidental data loss, deliberate deletion of data or damage to the data in order to ensure the security of personal data and to prevent unlawful processing.
All necessary technical and physical measures are taken in order to prevent access to personal data by other persons than authorized persons. In this context, the authorization system is designed in such a way that it will not be possible for individuals and systems to access more personal data than necessary.
The company carries out the necessary audits in its own institution or organization in order to ensure the implementation of the provisions of Law No. 6698.
9��� UNDERTAKINGS FOR PERSONAL DATA OF THIRD PARTIES
Personal information about third parties transmitted by Person Groups are accepted and consented by the Group of Persons, where they can be processed by the Company. The Related Person Group also undertakes to provide the necessary information and obtain the permissions in accordance with the Personal Data Protection Law No. 6698 for the persons and their information. Otherwise, the damages that will occur will remain with the relevant Person Group.
10��� PROCEDURES AND PRINCIPLES OF APPLICATION
As a related person, you can send your requests regarding your rights stipulated in Article 11 of Law No 6698, in line with the procedures and principles in the Application Form on the Protection of Personal Data, by filling out the relevant form to
KEP, to 
e-mail address; With the message you send with mobile signature or e-signature, or with the relevant form, Şahin Mah. Sait Polat Blv. No: 322 / Tarsus – Mersin / Turkey, originally signed in person to the address you can perform your request with a written application or applications for notary channel. The Company will finalize your application free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, the company may demand a fee in the tariff determined by the Personal Data Protection Board.
In this context, you have the following rights as a related person;
•��� Learning whether personal data is processed,
•��� Requesting information if personal data has been processed,
•��� Learning the purpose of processing personal data and whether they are used appropriately for their purpose,
•��� To know the third parties to whom personal data are transferred domestically or abroad,
•��� To request correction of personal data in case of incomplete or incorrect processing,
•��� Requesting the deletion or destruction of personal data within the framework of the conditions stipulated in the relevant legislation,
•��� Request notification of third parties to whom personal data are transferred,
•��� Object to the occurrence of a result against the person himself by analyzing the processed data exclusively through automated systems,
•��� To request the compensation of the damage in case of damage due to the processing of personal data illegally.
In the Company, personal data can be processed for the following purposes according to the relevant person group within the personal data processing conditions specified in Articles 5 and 6 of the Law No. 6698.
5.1 CUSTOMER
Customer’s personal data may be processed under personal data processing conditions given in 5th and 6th clauses of 6698 numbered Law for conducting the necessary business and operational processes in order to benefit from the products and services offered by the company, the execution of the contract, the follow-up of the financial and accounting affairs, the planning and execution of the processes of customer relations management and customer satisfaction activities, the follow-up of the contract processes and customer requests and complaints, the planning of information security processes, It can be processed for the purposes of creating and managing the infrastructure and its supervision and execution.
5.2 CANDIDATE CUSTOMER
The personal data of the Candidate Customer, within the scope of the personal data processing conditions specified in Articles 5 and 6 of the Law No.6698, can be processed for the purposes of the products and services offered by the company, according to the likes, usage habits and needs of the relevant persons, and planning and performing the activities required for the promotion and promotion of the relevant persons, Carrying out the necessary work for the realization of the commercial activities carried out by the company and carrying out the related business processes, carrying out the necessary works and related business processes to benefit from the products and services offered by the company, planning and performing the activities required for the privatization and promotion of the products and services offered by the company, the planning and execution of customer relationship management processes.
5.3 VISITOR
Personal data of visitors, within the scope of the personal data processing conditions specified in Articles 5 and 6 of the Law No.6698, may be processed for ensuring the security of building and facility premises and / or facilities, creating and tracking visitor records, ensuring the security of fixtures and / or resources, ensuring technical and commercial occupational safety, ensuring the safety of corporate operations, providing information to authorized institutions and organizations based on the legislation.
5.4 SUPPLIER / BUSINESS PARTNER REPRESENTATIVE
Personal data of the Supplier / Business Partner representative, within the scope of the personal data processing conditions specified in Articles 5 and 6 of the Law No.6698, may be processed for carrying out the necessary business and operational processes in order to benefit from the products and services offered by the company, carrying out the necessary work for the realization of the commercial activities carried out by the company and carrying out the related business processes, carrying out the necessary studies and related business processes to benefit from the products and services offered by the company.
�
5.5 ONLINE VISITOR
Personal data of online visitors, within the scope of the personal data processing conditions specified in Articles 5 and 6 of the Law No.6698, may be processed for conducting marketing analysis studies, conducting advertising / campaign / promotion processes, conducting communication activities, carrying out studies for developing products and services, and fulfilling legal obligations.
6��� TRANSFER OF PERSONAL DATA
Your personal data will be used by our business partners, suppliers, legally authorized public institutions and private persons in Turkey and abroad, within the framework of the specified personal data processing conditions and purposes, the principles and purposes set out in Articles 3 and 5 of this Privacy and Protection of Personal Data Principles and in Articles 8 and 9 of Law No.6698.
7��� METHOD OF COLLECTING PERSONAL DATA AND ITS LEGAL REASON
Your personal data transmitted to the Company electronically are processed as follows according to the relevant person groups.
7.1 CUSTOMER
Customer personal data are included in Article 5 of Law No.6698, “the necessity of processing personal data belonging to the parties of the contract provided that it is directly related to the establishment or execution of a contract”, “the requirement for the data controller to fulfill its legal obligation”, Provided that it does not harm the rights and freedoms, it is necessary to process data for the legitimate interests of the data controller, based on the legal grounds, in physical and electronic media, written or verbal data transfer tools and as part of the data recording system are processed automatically by being taken from the person or third party.
7.2 CANDIDATE CUSTOMER
Personal data of Candidate Customers, within the Article 5 of the Law No.6698, “it is necessary to process personal data belonging to the parties of the contract provided that it is directly related to the establishment or execution of a contract”, “to be made public by the person concerned”, “to establish, exercise or protect a right. Based on the legal grounds of “it is compulsory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”, are processed automatically by getting from third person or directly from the person as a part of the data recording system via written or verbal data transfer tools in physical and electronic media.
7.3 VISITOR
Personal Data of Visitors, based on the legal reason “it is compulsory for the data controller to fulfill his legal obligation” and “data processing is mandatory for the legitimate interests of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed” in Article 5 of the Law No.6698, are processed at images of the entrance doors, exterior of the building, meeting rooms and activity areas, dining areas, cafeteria, entrance waiting area, parking lot, elevators and floor corridors in our service building are recorded and processed automatically by security cameras in the service area.
7.4 SUPPLIER / BUSINESS PARTNER REPRESENTATIVE
Personal data of the Supplier / Business Partner representative, within the Article 5 of the Law No.6698, “it is necessary to process personal data belonging to the parties of the contract provided that it is directly related to the establishment or execution of a contract”, “to be made public by the person concerned”, “to establish, exercise or protect a right. Based on the legal grounds of “it is compulsory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject”, are processed automatically by getting from third person or directly from the person as a part of the data recording system via written or verbal data transfer tools in physical and electronic media.
7.5 ONLINE VISITOR
Personal data of the online visitor, based on the legal reasons under Law No. 5651 on the Regulation of Broadcasts Made on the Internet and the Fight Against Crimes Committed Through These Broadcasts and Article 5 of the Law No. 6698, “it is obligatory to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned” and ” being compulsory for the data controller to fulfill his legal obligation” are processed automatically.
8��� SECURITY OF PERSONAL DATA
The company takes reasonable measures to prevent unauthorized access risks, accidental data loss, deliberate deletion of data or damage to the data in order to ensure the security of personal data and to prevent unlawful processing.
All necessary technical and physical measures are taken in order to prevent access to personal data by other persons than authorized persons. In this context, the authorization system is designed in such a way that it will not be possible for individuals and systems to access more personal data than necessary.
The company carries out the necessary audits in its own institution or organization in order to ensure the implementation of the provisions of Law No. 6698.
9��� UNDERTAKINGS FOR PERSONAL DATA OF THIRD PARTIES
Personal information about third parties transmitted by Person Groups are accepted and consented by the Group of Persons, where they can be processed by the Company. The Related Person Group also undertakes to provide the necessary information and obtain the permissions in accordance with the Personal Data Protection Law No. 6698 for the persons and their information. Otherwise, the damages that will occur will remain with the relevant Person Group.
10��� PROCEDURES AND PRINCIPLES OF APPLICATION
As a related person, you can send your requests regarding your rights stipulated in Article 11 of Law No 6698, in line with the procedures and principles in the Application Form on the Protection of Personal Data, by filling out the relevant form to
KEP, to e-mail address; With the message you send with mobile signature or e-signature, or with the relevant form, Şahin Mah. Sait Polat Blv. No: 322 / Tarsus – Mersin / Turkey, originally signed in person to the address you can perform your request with a written application or applications for notary channel. The Company will finalize your application free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost, the company may demand a fee in the tariff determined by the Personal Data Protection Board.In this context, you have the following rights as a related person;
•��� Learning whether personal data is processed,
•��� Requesting information if personal data has been processed,
•��� Learning the purpose of processing personal data and whether they are used appropriately for their purpose,
•��� To know the third parties to whom personal data are transferred domestically or abroad,
•��� To request correction of personal data in case of incomplete or incorrect processing,
•��� Requesting the deletion or destruction of personal data within the framework of the conditions stipulated in the relevant legislation,
•��� Request notification of third parties to whom personal data are transferred,
•��� Object to the occurrence of a result against the person himself by analyzing the processed data exclusively through automated systems,
•��� To request the compensation of the damage in case of damage due to the processing of personal data illegally.