ATMACA DEMİR SAC İNŞAAT TAAHHÜT SANAYİ VE TİCARET LTD. ŞTİ. (“ATMACA DEMİR”)
CLARIFICATION TEXT ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

ATMACA DEMİR places great importance on the lawful processing and protection of personal data. In this regard, it takes the necessary administrative and technical measures to ensure compliance with legal obligations and to protect personal data, while also aiming to raise awareness in this field.

In accordance with Article 10 of the Law on the Protection of Personal Data No. 6698 (“KVKK”), this clarification text has been prepared to fulfill our obligation to inform data subjects.

1. Definitions

• Explicit Consent: Consent that is freely given, based on information, and clearly expressed regarding a specific matter.

• Data Subject: The natural person whose personal data is processed.

• Personal Data: Any information relating to an identified or identifiable natural person.

• Sensitive Personal Data: Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

• Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

• Data Processor: The natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.

• Destruction: The process of deletion, destruction, or anonymization of personal data so that it can no longer be associated with an identified or identifiable person.

2. Basic Principles in Processing Personal Data

ATMACA DEMİR processes personal data in accordance with the following principles:

• Lawful and fair processing,

• Accuracy and, where necessary, keeping data up to date,

• Processing for specific, explicit, and legitimate purposes,

• Being relevant, limited, and proportionate to the purposes for which data are processed,

• Retaining data only for as long as necessary for the purposes of processing or as prescribed by law.

3. Purposes of Processing Personal Data

Personal data belonging to customers, suppliers, employees, and third parties are processed for the following purposes:

• Fulfillment of legal obligations,

• Execution and development of business processes,

• Execution and control of commercial activities,

• Ensuring the security of the workplace and the safety of operations,

• Fulfillment of financial and operational obligations,

• Management of human resources processes,

• Management of customer and supplier relations.

4. Methods and Legal Grounds for Collecting Personal Data

Personal data are collected via physical forms, verbal communications, written documents, or electronic media such as e-mail, websites, mobile applications, and social media platforms. The legal grounds for the collection of personal data include:

• Explicit consent of the data subject,

• Expressly stipulated in the laws,

• Necessity to establish or perform a contract,

• Fulfillment of the data controller’s legal obligation,

• Legitimate interest of the data controller, provided that the fundamental rights and freedoms of the data subject are not harmed.

5. Transfer of Personal Data

Personal data may be shared with:

• Public institutions and organizations authorized by law,

• Judicial authorities,

• Business partners, suppliers, and support service providers,

• Authorized employees and units of ATMACA DEMİR.

These transfers are carried out in compliance with Articles 8 and 9 of the KVKK, taking necessary security measures.

6. Rights of the Data Subject

Pursuant to Article 11 of the KVKK, data subjects have the right to:

• Learn whether personal data is being processed,

• Request information if their data has been processed,

• Learn the purpose of processing and whether it is used in accordance with this purpose,

• Know the third parties to whom personal data is transferred domestically or abroad,

• Request correction of personal data if it is incomplete or inaccurate,

• Request deletion or destruction of personal data within the scope of the relevant legislation,

• Request notification of correction, deletion, or destruction to third parties to whom personal data has been transferred,

• Object to any adverse result arising from the analysis of processed data exclusively by automated systems,

• Request compensation for damages in case of unlawful processing of personal data.

To exercise your rights mentioned above, you can submit your request to ATMACA DEMİR by filling out the Application Form in accordance with the “Communiqué on the Procedures and Principles of Application to the Data Controller” and delivering it by hand or sending it via registered mail with return receipt.