As Data Controller ALMİN ALÜMİNYUM PROFİL SANAYİ VE TİC.LTD.ŞTİ , we would like you to know that we take the necessary measures for data security within the scope of our Personal Data Policy with utmost effort to protect your personal data, taking into account the Personal Data Protection Law No. 6698 and other legislation and international agreements.
As ALMİN ALÜMİNYUM PROFİL SANAYİ VE TİC.LTD.ŞTİ , camera recording is made 24/7 and audio recording is made in some areas within our campus(es), and the warnings regarding these recordings are brought to the attention of you, the visitors and employees, with warning signs visible in the relevant area. In addition, a public network is used within our campus, and the IP of this network and information about the IP matches in question are used in LOG records as stated in our secure destruction policy. Entry and exit records, signatures, license plates, identity cards, institution information and other information and data obtained in these records are kept in computerized systems and relevant record books.
Within the scope of this clarification text, it is useful to know the meanings of the following concepts.
Explicit consent, within the scope of Directive 95/46 EC, should be understood as a statement of approval given by the data subject freely, with sufficient information on the subject, in a clear manner that leaves no room for hesitation, and limited only to that transaction, to the processing of data about him/her.
Anonymization of personal data means making personal data impossible to associate with an identified or identifiable natural person in any way, even by matching it with other data.
Data recording system refers to the recording system in which personal data is structured and processed according to certain criteria. The systems in question can be physical or digital. Data can be processed according to more than one criterion within the system in question. For example, data can be recorded and processed based on a registration system based on name and surname, Turkish Republic of Northern Cyprus or place of birth.
Data controller is the person responsible for the processing, transfer, deletion of direct data and other obligations under the law within the scope of Law No. 6698. They are those who determine the purposes and means of processing personal data and are responsible for establishing and managing the data recording system. These persons may be natural persons or legal entities such as public institutions, companies, associations or foundations. Within the scope of this information text, ALMİN ALÜMİNYUM PROFİL SANAYİ VE TİC. It refers to the company LTD.ŞTİ.
data processing,They are real and legal persons who process data on behalf of the data controller. These persons may be employees who process personal data within the framework of the instructions given to them, or they may be a separate natural or legal person determined by the data controller by purchasing services. Any natural or legal person can be both a data controller and a data processor at the same time. For example, while an accounting company is considered a data controller for the data it holds about its own personnel, it will be considered a data processor for the data it holds for its customer companies.
Relevant Person refers to the real person whose personal data is processed, that is, the VISITOR within the scope of this agreement.
Destruction refers to the deletion, destruction or anonymization of personal data.
A. PURPOSES OF PROCESSING OF PERSONAL DATA
As the relevant person, your personal data is processed for the following purposes within the scope of Articles 5 and 6 of Law No. 6698;
• Creating records,
• Providing internet service,
• Ensuring the enforcement and control of our company's quality, information security and privacy policies and standards,
• Determining entry and exit records
, • Fulfilling the requirements of confidentiality and security practices in the workplace,
• Management of internet access records,
• Resulting from legal regulations fulfillment of obligations,
• Ensuring order in workplace activities,
• Fulfilling the demands of public institutions and organizations if required by legal regulations,
• Fulfilling obligations regarding occupational health and safety,
• Ensuring the safety of the company, our employees and all third parties in the workplace,
• Possible legal To be able to be used as evidence in disputes,
• To be able to provide the information and documents requested by public institutions and organizations, especially regulatory and supervisory institutions and organizations, to the relevant institutions,
• To be able to share the requested information and documents with the judicial authorities in line with the requests of the judicial authorities,
For the above purposes and this clarification. The data obtained and processed within the scope will be kept by taking the necessary administrative and technical measures for the legal periods and will be destroyed at the end of the periods.
Personal data collected and processed from visitors are as follows; Name, Surname, Mobile phone number, Vehicle License Plate, Request and Complaint Forms, Institution and Title Information, Mobile or Portable Electronic Device Information (Laptop, tablet, phone, etc.).
B. LEGAL REASONS REQUIRING STORAGE AND PROCESSING
The data obtained by our company is obtained, processed, stored and destroyed for the specified periods, based on the following legislative provisions. The legal regulations in question are as follows;
• Personal Data Protection Law No. 6698,
• Law No. 5651 on the Regulation of Publications Made on the Internet and Combating Crimes Committed through These Publications.
These articles of law are also important in terms of obtaining explicit consent. Personal Data Protection Law No. 6698 5/2.a. According to this clause, personal data may be processed without the explicit consent of the relevant person, if it is clearly provided for by law.
C. METHODS OF COLLECTION OF PERSONAL DATA
Your personal data consists of information and documents received within the scope of your dialogues and communication with our company. The suggestion/complaint form submitted to us, security cameras, device information resulting from visitor Wi-Fi use, and incident reports are the main data collection sources. These data are obtained and processed in accordance with our data policy and Board decisions, taking into account the conditions within the scope of Articles 5 and 6 of the Personal Data Protection Law (KVKK) and the principles included in Article 4. In all these processes, it is aimed to prevent unnecessary data acquisition by taking into account the principles of proportionality and proportionality.
D. TRANSFER OF PERSONAL DATA
As the Data Controller ALMİN ALÜMİNYUM PROFİL SANAYİ VE TİC.LTD.ŞTİ, taking into account the principles stated in Article 4
of Law No. 6698 ,
It is necessary to protect the life or physical integrity of oneself or another person,
• It is necessary to process personal data of the parties to the contract, provided that it is directly related to the establishment or execution of a contract,
• It is mandatory for the data controller to fulfill its legal obligation, It is done by the data subject himself. being made public,
• Data processing is mandatory for the establishment, exercise or protection of a right,
• Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person,
• Protection of public health, preventive medicine, medical diagnosis, treatment. Transfers can be made to third parties and institutions for the execution of care services, planning and management of health services and their financing, provided that the conditions stated in Articles 8 and 9 of the KVKK and the measures determined by the Board are taken.
The data in question is the relevant personnel of our company, company managers, our affiliated companies, our direct / indirect domestic subsidiaries, the organizations we receive service from, the domestic servers we use, the domestic institutions and organizations from which we receive cloud services, the communication, storage and Domestic servers and data centers used by communication programs, individuals and organizations that process data on behalf of the data controller and provide measurement, targeting and profiling support, lawyers, audit companies, business and solution partners, suppliers, judicial authorities, regulatory and supervisory institutions and organizations and official authorities. can be shared with authorities.
The data in question is not transferred abroad.
E. STORAGE AND DESTRUCTION POLICY OF PERSONAL DATA
Although it has been processed in accordance with the provisions of this Law and other relevant laws, personal data will be deleted, destroyed or anonymized by us ex officio or upon the request of the relevant person, in case the reasons requiring processing are eliminated. In accordance with paragraph 7/2 of Law No. 6698, it has been accepted that the relevant articles of law will be taken as basis in determining storage periods and destruction dates, without prejudice to the provisions written in other laws. For this reason, legal retention periods and statute of limitations must be taken into account when determining the destruction period of each data to be destroyed.
Although our KVKK destruction policy is explained in detail at https:// www.alminprofil.com.tr/ KVKK-1.html under the title KVKK Destruction Policy, your Personal Data will be kept for a maximum of 6 (six) months. During the first destruction period after the end of the storage period, the data is deleted, anonymized or destroyed by personnel dedicated exclusively to this task on behalf of the data controller, based on the Personal Data Protection Law and KVKK destruction regulations. These destruction processes are recorded and the minutes are kept for 3 years.
F. RELATED PERSON RIGHTS
Your rights as the relevant person whose data is processed are written as follows in Article 11 of Law No. 6698;
• You can find out whether we process personal data about you, and if we do or have processed personal data, you can request information about it.
• You can learn the purpose of processing your personal data and whether they are used for their intended purpose.
• You can find out whether your personal data is transferred domestically or abroad and to whom it is transferred.
• You may request that your inaccurate or incomplete personal data be corrected and that the recipients to whom this data has been or may have been transferred be informed.
• You can request that your personal data be destroyed (deleted, destroyed or anonymized) within the framework of the conditions stipulated in Article 7 of the KVKK. However, by evaluating your destruction request, we will evaluate which method is appropriate according to the circumstances of the concrete case. In this context, you can always request information from us about why we chose the destruction method we chose.
• You may request that third parties to whom your personal data has been or may be transferred be informed about your destruction request.
• You can object to the results of your personal data analysis, which were created exclusively using an automated system, if these results are contrary to your interests.
• If you suffer damage due to unlawful processing of your personal data, you can request compensation for the damage.
As the data controller, we are obliged to process and evaluate the applications made by the relevant person in accordance with Law No. 6698. Your requests in your Personal Data Breach Application will be finalized free of charge within thirty days at the latest, depending on the nature of the request. However, if the transaction requires an additional cost for the Company, the fee specified in the Communiqué on the Procedures and Principles of Application to the Data Controller may be charged by the Personal Data Protection Board.
If an application is made and the application is rejected by the company, you have the right to apply to the Personal Data Protection Board within thirty days from the date you receive the rejection decision. If no notification is made to you, as the Data Controller, within 30 days, an application can be made to the Board within 30 days from the date of thirty days. In order to avoid confusion regarding application periods, it is useful to look at the Decision of the Personal Data Protection Board dated 24.01.2019 and numbered 2019/9 on the Calculation of the Application to the Data Controller and Complaint Periods to the Board, the decision in question is as follows;
• If the data controller responds to the application made by the relevant person within 30 days, the relevant person can file a complaint within 30 days following the response of the data controller, and in this respect, in such cases, the relevant person does not have 60 days from the date of application to the data controller,
• The application made by the relevant person If no response is given by the data controller, the relevant person may file a complaint with the Board within 60 days from the date of application to the data controller,
• Considering that if the data controller responds to the application made by the relevant person after the 30-day period granted to the data controller in the Law, the relevant person is not obliged to wait for the response to be given after the 30-day period granted to the data controller in the Law and can file a complaint with the Board upon the expiration of the period granted to the data controller. The person can complain to the Board within 60 days from the date of application to the data controller, not 30 days from the date the data controller responds to him/her. You can submit
your application regarding the processing of your personal data by filling out the application form available on the Company's website or by following Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller. You can do so by the following methods, provided that you comply with the procedures and principles specified in the article:
• In writing and signed by a notary or registered
mail • By e-mail sent from your registered e-mail (KEP) address
• By secure electronic signature or mobile signature
• By notification to your e-mail address.
• By making a notification on 0312 267 58 80
, it will be beneficial not to lose the registration numbers given to you for the above notifications in terms of file and transaction tracking, and you will be able to give feedback to the notifications made to us using the same method or registered mail.
In order to make an application, the information of the Data Responsible is as follows:
Title: ALMİN ALÜMİNYUM PROFİL SANAYİ VE TİC. LTD. ŞTİ.
Mersisno: 0-0550-4031-2600017
E-mail address: bilgiislem@alminprofil.com.tr
Postal Address: ASO 1. Org. Singing. Region. Dagestan Cad. No:9 Sincan/ANKARA
Tel: 0312 267 58 80
Fax: 0312 267 58 85
The number and telephone line code in the above information has been created exclusively for KVKK transactions.
If the data in question is obtained contrary to procedures and laws, it will be reported to the board as soon as possible in accordance with Article 12 of the KVKK. The shortest time to understand is 2 72 hours.
G. UPDATE AND COMPLIANCE
The Company reserves the right to make changes to this Policy and other policies related to this Policy due to changes made in the Law, in accordance with the decisions of the KVK Board or in line with developments in the sector or the field of informatics.
Changes made to this Policy are immediately incorporated into the text and explanations regarding the changes are explained at the end of the Policy.
The complaint form you can make to our company, the complaint form you can make to the KVK Institution, this clarification text and the KVKK Policies can be found at the following link(s);You can reach https:// www.alminprofil.com.tr/ KVKK-1.html .
------------------------Footnotes------------------
1-a) Compliance with law and honesty comply with the rules.
b) Being accurate and up to date when necessary.
c) Processing for specific, clear and legitimate purposes.
ç) Being related to the purpose for which they are processed, limited and proportionate.
d) To be kept for the period stipulated in the relevant legislation or necessary for the purpose for which they are processed.
2- With the decision of the Personal Data Protection Board dated 24.01.2019 and numbered 2019/10;
Paragraph (5) of Article 12 of the Law states: "In case the processed personal data is obtained by others through illegal means, the data controller shall notify this situation to the person concerned and the Board as soon as possible..." The expression "as soon as possible" in the provision should be interpreted as 72 hours, and in this context, the data controller should notify the Board without delay and within 72 hours at the latest from the date of learning of this situation, and following the determination of the persons affected by the data breach by the data controller, the relevant persons should be notified as soon as possible. Within the period, if the contact address of the relevant person can be reached, notification will be made directly, or if not, notification will be made by appropriate methods such as publishing it on the data controller's own website,
Address
ASO 1.Organized Industrial Zone Dagestan Cd. No:9 Sincan / ANKARA / TURKEY
