Personal Data Protection and Processing Policy : Ağırman Makina

AĞIRMAN MAKİNA OTOMOTİV YAN SANAYİ VE TİCARET ANONİM ŞİRKETİ

PERSONAL DATA PROTECTION AND PROCESSING POLICY

Contents

Purpose, Scope, Basis, Definitions, and Abbreviations
Principles Regarding the Protection of Personal Data
Ensuring the Security of Personal Data
Ensuring the Rights of Data Subjects; Creating Channels for Communication of These Rights to Our Company and Evaluating Data Subjects' Requests
Protection of Special Categories of Personal Data
Increasing Awareness and Monitoring the Units Regarding the Protection and Processing of Personal Data
Issues Related to the Processing of Personal Data
a. Processing Personal Data in Compliance with the Principles Prescribed in the Legislation
b. Processing Personal Data Based on One or More of the Personal Data Processing Conditions in Article 5 of the Personal Data Protection Law (KVK Law) and Limited to These Conditions
Classification, Purposes of Processing, and Retention Periods of Personal Data Processed by Our Company
a. Classification of Personal Data
b. Purposes of Processing Personal Data and Retention Periods
Categorization of Data Subjects Related to Processed Personal Data
Third Parties to Whom Personal Data is Transferred and Purposes of Transfer
Processing of Personal Data Based on the Processing Conditions in the Law and Limited to These Conditions
a. Processing of Personal Data
b. Processing of Special Categories of Personal Data
Personal Data Processing Activities at Building and Facility Entrances, and for Visitors of Our Website
a. Camera Surveillance Activities at Building and Facility Entrances and Inside the Facility
b. Monitoring of Visitor Entries and Exits at Building and Facility Entrances
c. Retention of Records for Internet Access Provided to Visitors at Buildings and Facilities
Conditions for the Deletion, Destruction, and Anonymization of Personal Data
Rights of Data Subjects
Relationship Between the Personal Data Protection and Processing Policy and Other Policies, and Governance Structure
Final Provisions

Article 1 – Purpose, Scope, Basis, Definitions, and Abbreviations

1.1 PURPOSE

The primary purpose of this Policy is to establish the principles regarding the methods and processes for the protection of Personal Data by the Company.

1.2 SCOPE

This Policy applies to all business activities and workplaces of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi, its employers and representatives, as well as all employees, including apprentices and interns, job applicants, Company shareholders, visitors, employees of institutions with whom we cooperate, their shareholders, officials, and all third parties whose personal data is processed either automatically or as part of a non-automatic data recording system.

The scope of this Policy may apply to all provisions of the Policy for the groups of data subjects mentioned above (e.g., job applicants who are also our visitors), or only a part of the provisions (e.g., only visitors).

1.3 DEFINITIONS AND ABBREVIATIONS

In this Policy:

Explicit Consent: Consent that is informed and given freely regarding a specific issue.
Anonymization: Data that cannot be related to any individual in any way.
Employee: A real person employed at the workplace of the employer.
Intern: A person receiving vocational training at the employer’s workplace.
Job Applicant: A person who has applied for a position or has opened their CV and related information for review by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi.
Employees, Shareholders, and Officials of Institutions We Cooperate With: Real persons working in institutions that have any form of business relationship with Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi (such as business partners, suppliers, but not limited to these).
Business Partner: Parties with whom Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi establishes a partnership to carry out various projects, provide services, etc.
Personal Data Processing: Any operation performed on personal data, including collecting, recording, storing, preserving, modifying, reorganizing, disclosing, transferring, receiving, making available, classifying, or blocking the use of data, by automated or non-automated means, as part of a data recording system.
Data Subject: A real person whose personal data is processed.
Personal Data: Any information related to an identified or identifiable real person.
Special Categories of Personal Data: Data concerning race, ethnic origin, political opinions, philosophical beliefs, religion, sect, or other beliefs, attire, membership in associations, foundations or trade unions, health, sexual life, criminal convictions, security measures, and biometric and genetic data.
Company Shareholder: A real person who is a shareholder of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi.
Company Official: A member of the board of directors or other authorized real persons of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi.
Supplier: Parties that provide services to Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi in accordance with the Company’s orders and instructions based on contracts.
Third Party: A real person whose personal data is processed under this Policy but is not defined in any other way within the Policy (e.g., family members and close relations, former employees).
Data Processor: A real or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.
Data Controller: A real or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing a data recording system.
Visitor: A real person who has entered the physical premises of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi for various purposes or visits our websites.

Abbreviations:

KVK Law: Law No. 6698 on the Protection of Personal Data
KVK Board: Personal Data Protection Board
KVK Authority: Personal Data Protection Authority
Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi / Company: Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi
Policy: Personal Data Processing and Protection Policy of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi

Article 2 - Principles Regarding the Protection of Personal Data

Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi processes personal data in compliance with the procedures and principles stipulated in the KVKK (Personal Data Protection Law) and other relevant laws. In this context, Tekfen Holding ensures full compliance with the following principles stated in the KVKK when processing personal data:

Compliance with Law and Good Faith Principles: According to this principle, the data processing processes of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi are carried out within the boundaries required by relevant legislation, primarily the Constitution and KVKK, and the principles of good faith.
Accuracy and, When Necessary, Timeliness: Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi takes necessary measures to ensure that the personal data processed is accurate and up-to-date. Additionally, in order to ensure that the data reflects the real situation, information is provided, and necessary opportunities are given to data subjects.
Processing for Specific, Explicit, and Legitimate Purposes: Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi processes personal data only for explicit and clearly defined legitimate purposes and does not engage in data processing activities outside of these purposes. In this context, personal data is processed only if necessary in relation to the business relationship established with the data subjects.
Related to the Purpose for Which They Are Processed, Limited, and Proportionate: The data processed by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi is in accordance with KVKK and other relevant legislation, and is processed in a manner that enables the fulfillment of the specified purposes, related to achieving that purpose, and in a proportionate manner. Unnecessary personal data is not processed.
Retention for the Period Required by the Relevant Legislation or for the Purpose for Which They Are Processed: Personal data processed by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi is retained only for the period required by the relevant legislation or for the purpose for which it is processed. If there is a specific retention period prescribed in the legislation, the company adheres to that period. If no such period is specified, the data is retained only for the necessary period for the purpose for which it was processed. Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi does not store data based on the possibility of future use.

Article 3 - Ensuring the Security of Personal Data

3.1 – Technical and Administrative Measures Taken to Ensure the Lawful Processing of Personal Data

a) Technical Measures Taken to Ensure the Lawful Processing of Personal Data:

The personal data processing activities carried out within Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi are monitored through established technical systems.

The technical measures taken are reported to the relevant parties.
Personnel with expertise in technical matters are employed.

b) Administrative Measures Taken to Ensure the Lawful Processing of Personal Data:

Employees are informed and trained about personal data protection laws and the lawful processing of personal data.
All activities carried out by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi are analyzed in detail for each department, and as a result of this analysis, personal data processing activities related to commercial activities are identified.
The personal data processing activities carried out by the company's departments are determined in accordance with the requirements of the Personal Data Protection Law (KVKK). The necessary requirements are defined for each department and their specific activities to ensure compliance.
Awareness is created for each department to fulfill the legal compliance requirements and application rules are established. Administrative measures are implemented through company policies and training to ensure continuous compliance.
Contracts and documents governing the legal relationship between Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi and employees include provisions regarding the obligation to not process, disclose, or use personal data except in cases prescribed by company instructions or legal exceptions, and employees are made aware of these provisions.

3.2 – Technical and Administrative Measures Taken to Prevent Unauthorized Access to Personal Data

Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi takes technical and administrative measures based on the nature of the data to be protected, technological capabilities, and application costs to prevent unauthorized disclosure, access, transmission, or any other illegal access to personal data.

a) Technical Measures Taken to Prevent Unauthorized Access to Personal Data:

Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi employs knowledgeable and experienced individuals in order to ensure data security and provides necessary KVK (Personal Data Protection Law) training to its personnel.
Internal controls are performed within the established systems.
Risk analysis, data classification, IT risk assessment, and business impact analysis are carried out within the systems.
The technical infrastructure necessary to prevent or monitor the leakage of personal data outside the organization is secured and relevant matrices are created.
Access to personal data for staff working in information technology departments is controlled.
Technical measures are taken in line with technological developments, and these measures are periodically updated and renewed.
Access and authorization technical solutions are implemented according to the legal compliance requirements specified for each department.
Access rights are restricted, and these rights are regularly reviewed.
The technical measures taken are reported to the relevant parties, and any issues that pose risks are reassessed and necessary technological solutions are developed.
Antivirus systems and firewall software and hardware are used.
Personnel with expertise in technical matters are employed.

b) Administrative Measures Taken to Prevent Unauthorized Access to Personal Data:

Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi carries out and ensures the necessary audits to ensure the application of the law within its organization.
If personal data is obtained unlawfully by others, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi notifies the relevant parties and the Personal Data Protection Authority as soon as possible.
Regarding the sharing of personal data, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi ensures data security by signing framework agreements with or adding clauses to contracts with individuals or entities with whom data is shared.
Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi employs knowledgeable and experienced personnel on personal data processing and provides necessary KVK training to its staff.
Access and authorization processes regarding personal data within the company are designed and implemented in accordance with the legal compliance requirements for each department.
Employees are informed that they cannot disclose personal data to others in violation of the KVKK provisions and cannot use the data for purposes other than the processing purpose. They are also informed that this obligation continues even after they leave their position, and necessary commitments are obtained from them.
Contracts signed with parties to whom personal data is legally transferred by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi include clauses ensuring that these parties will take necessary security measures for the protection of personal data and ensure compliance within their organizations.

3.3 – Storing Personal Data in Secure Environments

a) Technical Measures Taken to Store Personal Data in Secure Environments:

Technological systems that are suitable for technological developments are used to store personal data in secure environments.
Personnel with expertise in technical matters are employed.
Technical security systems are established for storage areas, and the technical measures taken are reported to the relevant parties. Risk-related issues are reassessed, and necessary technological solutions are produced.
Backup programs are used in a lawful manner to ensure the secure storage of personal data.
Access to the data storage areas where personal data is kept is logged, and inappropriate access attempts or access attempts are communicated in real-time to the relevant parties.

b) Administrative Measures Taken to Store Personal Data in Secure Environments:

Employees are trained to ensure the secure storage of personal data.

3.4 – Audit of Measures Taken for the Protection of Personal Data

In accordance with Article 12 of the Personal Data Protection Law (KVKK), Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi conducts or ensures the necessary audits within its organization. The results of these audits are reported to the relevant department within the organization, and necessary actions are taken to improve the measures based on the findings.

3.5 – Measures to be Taken in Case of Unauthorized Disclosure of Personal Data

In accordance with Article 12 of the Personal Data Protection Law (KVKK), if personal data processed by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi is obtained unlawfully by others, the company will ensure that this situation is reported as soon as possible to the relevant data subject and the Personal Data Protection Authority (KVK Board). If the KVK Board deems it necessary, this situation may be announced on the KVK Board’s website or by other means.

Article 4 - Protection of the Rights of the Data Subject

Data subjects can submit requests regarding their rights listed below in writing to Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi. Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi will respond to the request, free of charge, within a maximum of thirty days, depending on the nature of the request. However, if a fee is determined by the Personal Data Protection Board (KVK Board), Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi will charge the fee determined by the KVK Board.

Data subjects have the right to:

Learn whether personal data is being processed,
Request information about personal data if it has been processed,
Learn the purpose of personal data processing and whether it is being used for its intended purpose,
Know the third parties to whom personal data is transferred, whether domestically or internationally,
Request correction of personal data if it is inaccurate or incomplete, and request that the correction be communicated to third parties to whom the data was transferred,
Request the deletion or destruction of personal data if the reasons for processing the data no longer exist, even though the data was processed in accordance with the KVK Law and other relevant laws, and request that the deletion or destruction be communicated to third parties to whom the data was transferred,
Object to the processing of personal data through automated systems that may lead to unfavorable outcomes for the individual,
Request compensation for damages if they suffer harm due to the unlawful processing of their personal data.

Article 5 - Protection of Special Categories of Personal Data

These data include information about race, ethnicity, political views, philosophical beliefs, religion, sect or other beliefs, clothing, membership in associations, foundations, or unions, health, sexual life, criminal convictions, security measures, as well as biometric and genetic data. Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi handles the protection of special categories of personal data defined as “special” by the KVK Law and processed lawfully with utmost care. In this context, the technical and administrative measures taken for the protection of personal data are carefully applied to special categories of personal data, and necessary audits are conducted within Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi.

Article 6 - Increasing Awareness and Auditing of Units Regarding the Protection and Processing of Personal Data

Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi ensures that necessary training is provided to the relevant departments to raise awareness regarding the prevention of unlawful processing of personal data, unauthorized access to data, and the protection of data. Systems have been established to raise awareness of personal data protection among current employees and new employees who have recently joined the departments. If necessary, professional experts are consulted.

The results of the training aimed at increasing awareness of personal data protection and processing within the departments of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi are evaluated. The company updates and renews its training in line with updates to the relevant legislation.

Article 7 - Processing of Personal Data

7.1 - Processing Personal Data Based on One or More Conditions Stated in Article 5 of the KVK Law and Within the Scope of These Conditions

a) Protection of Personal Data as a Constitutional Right
The protection of personal data is a constitutional right. Fundamental rights and freedoms can only be limited for the reasons specified in the relevant articles of the Constitution and only through law. According to the third paragraph of Article 20 of the Constitution, personal data can only be processed in cases prescribed by law or with the explicit consent of the individual. In line with this, and in compliance with the Constitution, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi processes personal data only in cases prescribed by law or with the explicit consent of the individual.

b) Informing and Enlightening the Data Subject
In accordance with Article 10 of the KVK Law, data subjects must be informed before or at the latest at the time of obtaining their personal data. The following information must be provided to data subjects in this context:

The identity of the data controller and, if applicable, its representative,
The purpose for which the personal data will be processed,
To whom and for what purpose the processed personal data may be transferred,
The method and legal reason for collecting personal data,
The other rights listed in Article 11 of the KVK Law.

To fulfill this obligation, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi has prepared enlightenment declarations for the data subjects, which are based on the specific processes and individuals whose data is being processed, in accordance with the above-mentioned provisions of the KVK Law.

On the other hand, under Article 28(1) of the KVK Law, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi is not required to inform the data subject in the following cases:

Personal data processed by real persons related to their own activities or those of family members living in the same household, as long as the data is not transferred to third parties and obligations regarding data security are adhered to,
Processing personal data for purposes such as research, planning, and statistics by anonymizing it or in the form of official statistics,
Processing personal data for purposes related to national defense, national security, public safety, public order, economic security, private life confidentiality, or individual rights, as long as it does not violate any of these or constitute a crime, including for artistic, historical, literary, or scientific purposes, or under freedom of expression,
Processing personal data by public institutions and organizations entrusted with duties and authority by law, for preventive, protective, and intelligence activities related to national defense, national security, public safety, or economic security,
Processing personal data by judicial authorities or enforcement agencies in relation to investigation, prosecution, trial, or enforcement processes.

Additionally, in accordance with Article 28(2) of the KVK Law, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi’s obligation to inform does not apply in the following cases:

Processing personal data necessary for the prevention of a crime or for the investigation of a crime,
Processing personal data that has been made public by the data subject themselves,
Processing personal data by authorized public institutions or professional organizations with public institution status for the performance of their monitoring or regulatory duties, or in cases where it is necessary for disciplinary investigations or prosecutions,
Processing personal data necessary for the protection of the state’s economic and financial interests related to budget, taxation, and financial matters.

c) Processing of Special Categories of Personal Data

Article 6 of the KVK Law defines certain personal data as "special categories" due to the risk of causing harm or discrimination to individuals if processed unlawfully.

These data include race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing and attire, membership in associations, foundations, or unions, health, sexual life, criminal convictions, security measures, and biometric and genetic data. Special attention is given by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi in processing these special categories of personal data, as it is considered to be of critical importance from various perspectives in terms of protection. In this context, special measures are taken to ensure that such data is processed only with the explicit consent of the data subject, provided that adequate measures are taken as prescribed by the Authority. However, personal data, excluding health and sexual life data, may be processed without the data subject's explicit consent in cases prescribed by law.

On the other hand, health and sexual life data may be processed without explicit consent if sufficient measures are taken and if one of the following conditions exists:

Protection of public health,
Preventive medicine,
Medical diagnosis,
Provision of treatment and care services,
Planning and management of health services and financing.

d) Transfer of Personal Data

Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi may transfer personal data and special categories of personal data to third parties, provided that the necessary security measures are taken, in line with its lawful purposes for processing personal data. In this regard, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi acts in accordance with the provisions of Article 8 of the KVK Law.

a) Transfer of Personal Data:
Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi may transfer personal data to third parties based on one or more of the conditions specified in Article 5 of the KVK Law, within the scope of lawful and legitimate purposes for processing personal data:

If the data subject has given explicit consent,
If there is a clear legal provision regarding the transfer of personal data in the laws,
If it is necessary to protect the life or physical integrity of the data subject or another person and the data subject is unable to give consent due to practical impossibility or if the consent is not legally valid,
If the transfer is necessary for the establishment or performance of a contract directly related to the parties to the contract,
If the transfer of personal data is required for Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi to fulfill its legal obligations,
If the personal data has been made public by the data subject,
If the transfer of personal data is necessary for the establishment, use, or protection of a legal right,
If the transfer is necessary for the legitimate interests of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi, provided that it does not harm the fundamental rights and freedoms of the data subject.

b) Transfer of Special Categories of Personal Data:
Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi may transfer special categories of personal data to third parties, taking the necessary precautions and ensuring the required security measures, and in accordance with the provisions of the KVK Law, under the following conditions:

Special categories of personal data, excluding health and sexual life, may be transferred to third parties in cases prescribed by law,
Health and sexual life data may be transferred only by persons or authorized institutions and organizations bound by a confidentiality obligation, for the purposes of:
- Protecting public health,
- Preventive medicine,
- Medical diagnosis,
- Provision of treatment and care services,
- Planning and management of health services and financing.
8.1- Classification of Personal Data
a) Explanations on Personal Data Classification
a.1) Contact Information:
Personal data that is clearly related to an identified or identifiable real person, processed partially or entirely in an automatic manner or manually as part of a data recording system, including information such as phone numbers, addresses, email addresses, fax numbers, and IP addresses.
a.2) Identity Information:
Personal data that is clearly related to an identified or identifiable real person, processed partially or entirely in an automatic manner or manually as part of a data recording system, including information such as name, surname, national ID number, nationality, mother’s name, father’s name, place of birth, date of birth, gender, and documents like driver's license, national ID, passport, tax number, social security number, signature, vehicle license plate, etc.
a.3) Location Data:
Personal data that is clearly related to an identified or identifiable real person, processed partially or entirely in an automatic manner or manually as part of a data recording system, which determines the location of the personal data subject during the use of products and services by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi or when using the vehicles of cooperating institutions. This data may include GPS location, travel data, etc.
a.4) Physical Space Security Information:
Personal data that is clearly related to an identified or identifiable real person, processed partially or entirely in an automatic manner or manually as part of a data recording system, including records and documents taken during physical entry to a location or while staying in the physical space. This includes security camera footage, fingerprint records, facial recognition data, etc.
a.5) Family Members and Close Contacts Information:
Personal data that is clearly related to an identified or identifiable real person, processed partially or entirely in an automatic manner or manually as part of a data recording system, related to family members (e.g., spouse, parents, children), close contacts, and other persons to be reached in emergencies, collected by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi during the provision of products and services or for the protection of the legal and other interests of the company and the personal data subject.
a.6) Special Categories of Personal Data:
Personal data that is clearly related to an identified or identifiable real person, processed partially or entirely in an automatic manner or manually as part of a data recording system, which includes data specified under Article 6 of the KVK Law (e.g., health data including blood type, biometric data, religious affiliation, membership in associations, etc.).
a.7) Visual/Audio Information:
Personal data that is clearly related to an identified or identifiable real person, processed partially or entirely in an automatic manner or manually as part of a data recording system, including photographs, video recordings (excluding those under Physical Space Security Information), audio recordings, and copies of documents containing personal data.
a.8) Request/Complaint Management Information:
Personal data that is clearly related to an identified or identifiable real person, processed partially or entirely in an automatic manner or manually as part of a data recording system, related to the reception and evaluation of any requests or complaints directed to Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi.
a.9) Financial Information:
Personal data that is clearly related to an identified or identifiable real person, processed partially or entirely in an automatic manner or manually as part of a data recording system, related to any financial results created due to the legal relationship between the personal data subject and Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi. This includes bank account numbers, IBAN numbers, financial profiles, income information, etc.
a.10) Employment Information:
Personal data that is clearly related to an identified or identifiable real person, processed partially or entirely in an automatic manner or manually as part of a data recording system, related to the data subject’s employment relationship with Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi. This includes data used to create the data subject’s employment rights.

8.2- Purposes of Processing Personal Data

Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi processes personal data within the purposes and conditions specified in the 2nd paragraph of Article 5 and the 3rd paragraph of Article 6 of the Personal Data Protection Law (KVK Law). These purposes and conditions are as follows:

When the processing of personal data is explicitly foreseen by law for Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi to perform its relevant activities.
When the processing of personal data is directly related to the establishment or performance of a contract and necessary for the establishment or performance of the contract.
When the processing of personal data is necessary for fulfilling the legal obligations of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi.
When the personal data is made public by the data subject, and the processing by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi is limited to the purpose for which the data was made public.
When processing personal data is necessary for the establishment, exercise, or protection of the rights of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi, you, or third parties.
When processing personal data is necessary for the legitimate interests of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi, provided that the fundamental rights and freedoms of the data subject are not violated.
When processing personal data is necessary to protect the life or physical integrity of the data subject or another person, and the data subject is physically or legally incapable of giving consent.
When special categories of personal data (other than health and sexual life) are processed as foreseen by law.
When special categories of personal data related to the health and sexual life of the data subject are processed for the protection of public health, medical diagnosis, treatment, and healthcare services, including the planning and management of healthcare services and financing, by persons or authorized institutions and organizations that are under the obligation of confidentiality.

In this context, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi processes your personal data for the following purposes:

Planning and executing corporate sustainability activities

Event management
HR operations
Intra-company operations
Legal, technical, and administrative activities
Strategy, planning, and partner/supplier management
Corporate communication activities, planning, and execution of events
Planning and execution of internal training programs
Management of relationships with business partners or suppliers
Managing recruitment processes for Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi personnel
Execution/tracking of financial reporting and risk management processes
Execution/tracking of legal affairs for Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi
Planning and execution of corporate communication activities
Execution of corporate governance activities
Execution of corporate and partnership legal operations
Management of requests and complaints
Ensuring the security of the company’s values
Providing support for compliance with relevant regulations
Planning and executing audit activities to ensure that the company’s operations, procedures, and relevant regulations are followed
Managing activities to protect the company’s reputation
Managing investor relations
Providing information to authorized institutions due to legal obligations
Creating and tracking records for visitors, suppliers, and interns

If the processing activities carried out for the above-mentioned purposes do not meet any of the conditions set out in the KVK Law, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi will obtain your explicit consent for the relevant processing activity.

The categories mentioned above are provided for informational purposes. Additional categories may be added by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi to carry out its future commercial and operational activities. In such cases, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi will continue to update these categories in the relevant documents to inform you in the fastest way possible.

8.3- Retention Periods of Personal Data

Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi retains personal data for the duration specified in the relevant laws and regulations, if required by these legal provisions.

If no retention period is specified in the relevant legislation regarding how long personal data must be retained, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi processes personal data for the period necessary based on the activities carried out during data processing, according to the company’s practices and the commercial customs of its business life. After that, the data is deleted, destroyed, or anonymized.

If the purpose of processing personal data has ended and the retention periods set by the relevant legislation have also expired, personal data can only be retained for the purpose of serving as evidence in potential legal disputes or for asserting or defending a right related to the personal data. The retention periods for such cases are determined based on the statutes of limitations for asserting the relevant right, and if the statute of limitations has passed, retention periods are determined by examples of requests previously made to Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi regarding similar issues.

In such cases, personal data is not accessed for any other purpose and can only be accessed when needed for use in the relevant legal dispute. After the expiration of the specified period, the personal data is deleted, destroyed, or anonymized.

Article 9- Classification of Personal Data Owners Processed by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi

Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi processes the personal data of the categories of personal data owners listed below. However, the scope of this policy is limited to Employees, Customers, Visitors, Third Parties, Job Candidates, Shareholders, Company Authorities, Employees, Shareholders, and Authorities of Institutions with which we collaborate.

The categories of individuals whose personal data is processed by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi are within the scope mentioned above. Individuals outside of these categories may also submit requests to Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi within the framework of the KVK Law, and their requests will also be evaluated under this Policy

9.1- Definitions of Personal Data Owner Classification

a) Customer: Individuals from whom personal data is obtained through the business operations conducted by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi’s business units, regardless of whether they have a contractual relationship with the company.

b) Employee: A real person employed at the employer's workplace.

c) Intern: A real person undergoing vocational training at the employer’s workplace, as per Law No. 3308.

d) Visitor: Real persons who enter the physical premises owned by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi for various purposes or visit the company’s websites.

e) Third Party: Other real persons not covered by this Policy (e.g., companions, family members, relatives, former employees).

f) Job Candidate: A real person who has applied for a job at Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi, or has opened their resume and related information for review by the company.

g) Company Shareholder: A real person who is a shareholder of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi.

h) Company Executive: A real person who is a member of the board of directors or holds another executive role at Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi.

i) Employees of Collaborating Institutions: Real persons who work at or are shareholders and executives of institutions with which Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi has a business relationship (such as partners, suppliers, etc.).

9.2- Personal Data Classification and Corresponding Data Owner Categories

Below is a table detailing the categories of personal data owners listed above and the types of personal data processed for each category:

Personal Data Type	Processed Data Categories
Identity Information	Employee, Intern, Customer, Job Candidate, Company Shareholder, Company Executive, Visitor, Employees, Shareholders, and Executives of collaborating institutions.
Third-Party Request/Complaint Management Information	Employee, Intern, Customer, Job Candidate, Company Shareholder, Company Executive, Visitor, Employees, Shareholders, and Executives of collaborating institutions.
Third-Party Contact Information	Employee, Intern, Customer, Job Candidate, Company Shareholder, Company Executive, Visitor, Employees, Shareholders, and Executives of collaborating institutions.
Third-Party Location Data	Employees of collaborating institutions, Company Executives
Family and Relatives Information	Employee, Intern
Physical Location Security Information	Employee, Intern, Visitor, Job Candidate, Company Shareholder, Company Executive, Employees, Shareholders, and Executives of collaborating institutions.
Third-Party Financial Information	Employee, Intern, Customer, Job Candidate, Company Shareholder, Company Executive, Employees, Shareholders, and Executives of collaborating institutions.
Third-Party Visual/Audio Information	Employee, Intern, Customer, Job Candidate, Company Shareholder, Company Executive, Visitor, Employees, Shareholders, and Executives of collaborating institutions.
Third-Party Biographical Information	Employees of collaborating institutions, Shareholders, Executives, Job Candidates
Third-Party Special Data	Employee, Intern, Customer, Job Candidate, Company Shareholder, Company Executive
Sensitive Personal Data	Visitor, Employees of collaborating institutions, Shareholders, Executives, Third Party

Article 10 - Third Parties to Whom Personal Data is Transferred by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi and the Purposes of Transfer

10.1 In accordance with Articles 8 and 9 of the Personal Data Protection Law (KVK Law), Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi may transfer personal data of data subjects, governed by this Policy, to the following categories of individuals:
a) Business partners of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi,
b) Suppliers of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi,
c) Shareholders of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi,
d) Executives of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi,
e) Legally authorized public institutions and organizations.

10.2 The scope of the above-mentioned individuals to whom data may be transferred and the purposes of such transfers are as follows:

Persons to Whom Data May Be Transferred	Definition	Purpose of Data Transfer
Business Partner	Refers to parties with whom Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi forms business partnerships for specific projects or for providing/receiving services.	To carry out business operations and fulfill the purposes of business partnerships such as providing and receiving services.
Supplier	Refers to parties who provide services to Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi based on contractual agreements, in accordance with the company's instructions.	To ensure that necessary services are provided to Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi for business activities.
Shareholders	Refers to real persons who are shareholders of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi, as per relevant legislation.	For company law, corporate governance, and communication purposes in compliance with relevant regulations.
Company Executives	Refers to members of the Board of Directors and other authorized real persons of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi.	For the design of business strategies and the upper-level management and supervision of the company’s activities.
Public Institutions and Organizations	Refers to public institutions and organizations authorized by law to request information and documents from Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi.	For the purposes of compliance with legal requirements and as per the legal authority of the requesting institutions.

Article 11 - Processing of Personal Data Based on the Conditions in the Law and Limited to These Conditions

The explicit consent of the data subject is only one of the legal bases that allows the lawful processing of personal data. Apart from explicit consent, personal data can be processed if one of the following conditions is met. The legal basis for the personal data processing activity can be based on only one of the conditions below, or more than one of these conditions may be the basis for the same personal data processing activity.

The Data Subject’s Explicit Consent:
One of the conditions for processing personal data is the explicit consent of the data subject. The explicit consent of the data subject must be given based on information and be freely expressed. For secondary processing activities (activities beyond the primary processing purpose), at least one of the conditions stated in (a), (b), (c), (d), (e), (f), and (g) below must be met; otherwise, the personal data processing activities will be carried out based on the data subject’s explicit consent for these processing activities.

The explicit consent of the data subject is obtained through relevant methods.

Explicitly Foreseen by Laws:
Personal data may be processed if explicitly foreseen in the law.
Example: According to Article 230 of the Tax Procedure Law, a person’s name must be included on an invoice.

Inability to Obtain the Data Subject's Consent Due to Physical Impossibility:
If the data subject cannot provide consent due to physical impossibility, or if the consent cannot be legally valid, the personal data can be processed when it is necessary to protect the life or physical integrity of the data subject or another person.
Example: If a shareholder loses consciousness during a general meeting, their identification information may be provided to doctors by a company employee.

Necessity for the Establishment or Performance of a Contract:
Personal data can be processed if it is necessary for the establishment or performance of a contract directly related to the parties involved.
Example: For the performance of a consultancy contract signed with a business partner, the consultant’s bank account information may be obtained for payment purposes.

Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi’s Legal Obligation:
If Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi, as the data controller, must fulfill its legal obligations, the personal data of the data subject may be processed.
Example: Information requested by a court order must be provided to the court.

Personal Data Publicly Disclosed by the Data Subject:
If the data subject has publicly disclosed their personal data, such data may be processed.
Example: A job applicant’s contact information published on websites allowing job applications.

Necessity for the Establishment, Use, or Protection of a Legal Right:
Personal data may be processed if it is necessary for the establishment, use, or protection of a legal right.
Example: Storing and using evidentiary data (such as an invoice) when necessary.

Necessity for the Legitimate Interests of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi:
Personal data may be processed for the legitimate interests of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi, provided that the fundamental rights and freedoms of the data subject are not violated.
Example: Security camera recordings made for security purposes in the buildings and facilities of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi.

Article 12 - Personal Data Processing Activities at Building and Facility Entrances and Inside the Building, and Website Visitors

The personal data processing activities carried out by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi at building and facility entrances, as well as inside the facility, are conducted in compliance with the Constitution, the Personal Data Protection Law (KVK Law), and other relevant legislation. Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi conducts personal data processing activities for the purpose of ensuring security, including surveillance via security cameras and monitoring the entry and exit of visitors at its buildings and facilities. Personal data processing is carried out through the use of security cameras and by recording visitor entry and exit activities.

12.1 - Camera Surveillance Activities at Building and Facility Entrances and Inside the Facility
For the purpose of ensuring the general and commercial security of its facilities and operations, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi collects and processes image recordings of visitors, employees, and other related individuals in accordance with the principles stipulated in the Personal Data Protection Law (KVK Law) and the principles outlined in this Policy. These recordings are securely stored in physical or electronic environments for the duration of the processing purposes.

In places where image recordings are made, there is a visible notification indicating that video recordings are being made to inform the data subjects. In these activities, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi ensures compliance with the obligations regarding the protection of personal data as stipulated in the KVK Law and all other relevant legislation. In areas where privacy is highly sensitive, no video recording is made.

The camera surveillance activities conducted by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi are carried out in accordance with the Private Security Services Law and other relevant legislation.

For the purpose of ensuring security at its buildings and facilities, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi conducts security camera surveillance activities in accordance with the purposes outlined in the applicable legislation and in compliance with the personal data processing conditions specified in the Personal Data Protection Law (KVK Law).

As part of the camera surveillance activities, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi publishes this Policy on its website and posts a notification about surveillance activities at the entrances of areas being monitored.

In compliance with Article 4 of the Personal Data Protection Law (KVK Law), Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi processes personal data in a manner that is connected, limited, and proportionate to its processing purpose.

12.2 - Ensuring the Security of the Obtained Data

In accordance with Article 12 of the Personal Data Protection Law (KVK Law), Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi takes the necessary technical and administrative measures to ensure the security of personal data obtained as a result of camera surveillance activities.

12.3 - Retention Period of Personal Data Obtained Through Camera Surveillance Activities

Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi securely stores personal data obtained through camera surveillance activities in physical or electronic environments for a period consistent with the purposes for which the data was processed.

12.4 - Who Has Access to the Information Obtained from Surveillance and Who the Information Is Transferred To

Access to live camera footage and digital recordings that are stored is limited to a small number of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi employees. Those with access to these recordings sign a confidentiality agreement, committing to maintain the confidentiality of the data they access.

Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi tracks visitor entry and exit at its buildings and facilities for the purpose of ensuring security and for the purposes outlined in this Policy. The personal data of individuals entering the buildings as guests, such as their names and surnames, are obtained, and the individuals are informed via text notices displayed or otherwise provided in accessible areas. The data obtained for the purpose of monitoring guest entry and exit is processed solely for this purpose and is recorded in a physical data system.

12.5 - Retention of Internet Access Logs Provided to Visitors in Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi Buildings and Facilities

For the purpose of ensuring security and for the purposes specified in this Policy, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi provides internet access to visitors during their stay in its buildings and facilities. In this case, internet access log records are captured in accordance with Law No. 5651 and the regulations derived from this law. These records are processed only when requested by authorized public institutions or for fulfilling our legal obligations during audit processes conducted within Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi. Access to these log records is limited to a small number of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi employees. Employees with access to these records use them only for requests from authorized public institutions or during audit processes, sharing them solely with legally authorized individuals. Those with access to the records sign a confidentiality agreement, committing to maintain the confidentiality of the data they access.

Article 13 - Conditions for the Deletion, Destruction, and Anonymization of Personal Data

Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi, as regulated in Article 138 of the Turkish Penal Code and Article 7 of the Personal Data Protection Law (KVK Law), in accordance with the relevant provisions of the law, despite having processed personal data, deletes, destroys, or anonymizes personal data either on its own initiative or upon the request of the data subject, if the reasons for processing no longer exist.

13.1 - Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi's Obligation to Delete, Destroy, and Anonymize Personal Data

In this context, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi fulfills its obligation as described in this article using the methods outlined.

13.2 - Techniques for Deleting, Destroying, and Anonymizing Personal Data

a) The most commonly used techniques for deleting or destroying data by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi are listed below:

a.1) Physical Destruction: Personal data, which may be processed through non-automatic means as part of a data recording system, can be physically destroyed in a way that it can no longer be used after being deleted/destroyed.

a.2) Secure Deletion via Software: Personal data processed through fully or partially automated means and stored in digital environments is deleted using methods that ensure the data cannot be recovered.

a.3) Secure Deletion by Expert: In some cases, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi may engage an expert to delete personal data on its behalf. In such cases, personal data is securely deleted by the expert in a way that it can no longer be recovered.

b) Anonymization Techniques for Personal Data: Anonymizing personal data refers to making personal data unable to be linked to an identified or identifiable individual by pairing it with other data, in such a way that the individual cannot be identified under any circumstances. Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi may anonymize personal data when the reasons for processing no longer exist, in accordance with the law. In accordance with Article 28 of the KVK Law, anonymized personal data may be processed for purposes such as research, planning, and statistics. Such processing is outside the scope of the KVK Law, and the explicit consent of the data subject will not be sought.

The most commonly used anonymization techniques by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi are as follows:

b.1) Masking: Personal data is anonymized by removing the key identifying information from the data set. Example: Removing information such as the name, Turkish ID number, etc., making it impossible to identify the data subject from the data.

b.2) Aggregation: Personal data is aggregated in such a way that it can no longer be linked to any individual. Example: Showing the number of employees aged X without revealing individual ages.

b.3) Data Derivation: Data derivation involves creating a more general content from personal data and ensuring that the data can no longer be associated with any individual. Example: Stating age instead of birth dates; indicating the region of residence instead of the exact address.

b.4) Data Shuffling: Personal data values within a data set are mixed, severing the connection between the values and the individuals. Example: Changing the nature of voice recordings so that the voices can no longer be linked to the data subject.

Article 14 - Rights of the Personal Data Subject

Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi, in accordance with Article 10 of the KVK Law, informs the personal data subject of their rights and provides guidance on how these rights can be exercised. Furthermore, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi operates the necessary channels, internal processes, and administrative and technical arrangements to evaluate the rights of personal data subjects and provide the required information in accordance with Article 13 of the KVK Law.

14.1 - Rights of the Data Subject and Exercising These Rights
Personal data subjects have the following rights:
a) To learn whether personal data is processed
b) To request information if their personal data has been processed
c) To learn the purpose of processing personal data and whether the data is used in accordance with its purpose
d) To know the third parties, whether domestic or abroad, to whom personal data is transferred
e) To request the correction of personal data if it is incomplete or incorrect, and to request that the correction be communicated to third parties to whom the personal data has been transferred
f) To request the deletion or destruction of personal data if the reasons for processing no longer exist, even if processed in compliance with the KVK Law and other relevant laws, and to request that this process be communicated to third parties to whom the personal data has been transferred
g) To object to the outcome of personal data being analyzed solely through automated systems, resulting in a decision that is against the data subject
h) To request compensation for damages arising from the unlawful processing of personal data

14.2 - Cases Where the Personal Data Subject Cannot Exercise Their Rights
Personal data subjects cannot exercise their rights in the following cases, as stipulated in Article 28 of the KVK Law, and these cases are excluded from the scope of the KVK Law:
a) The processing of personal data for research, planning, and statistical purposes, by anonymizing personal data through official statistics
b) The processing of personal data for artistic, historical, literary, or scientific purposes, or within the scope of freedom of expression, provided that it does not violate national defense, national security, public security, public order, economic security, the privacy of private life, or personal rights, or does not constitute a crime
c) The processing of personal data by public institutions and organizations authorized by law for preventive, protective, and intelligence activities to ensure national defense, national security, public security, public order, or economic security
d) The processing of personal data by judicial authorities or enforcement authorities in relation to investigations, prosecutions, trials, or execution procedures.

14.3 - According to Article 28/2 of the KVK Law; in the following cases, personal data subjects may not exercise the other rights listed in Article 37, except for the right to request compensation for damages:

a) When the processing of personal data is necessary for the prevention of a crime or for a criminal investigation
b) When personal data has been made public by the data subject themselves
c) When the processing of personal data is necessary based on the authorization given by law for the competent and authorized public institutions and organizations or professional organizations with public institution status, for the execution of supervision or regulation tasks or for disciplinary investigations or prosecutions
d) When the processing of personal data is necessary for protecting the economic and financial interests of the State in matters related to budget, taxes, and financial issues

14.5 - Right of the Personal Data Subject to File a Complaint with the KVK Board

In accordance with Article 14 of the KVK Law, if the application is rejected, if the response given is deemed insufficient, or if no response is provided within the required period, the personal data subject may file a complaint with the KVK Board within thirty days from the date they learn of the response from Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi, and in any case, within sixty days from the application date.

14.6 - Procedure and Timeframe for Responding to Applications by Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi

Applications must be made to Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi only in situations where Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi is considered the data controller under the KVK Law. This situation may occur when Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi directly collects personal data from the relevant individual, or when the transfer of data from one data controller to another is considered under the KVK Law.

If the personal data subject submits their request to Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi in accordance with the procedure, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi will respond to the request free of charge within a maximum of thirty days, depending on the nature of the request. However, if a fee is determined by the KVK Board, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi will charge the applicant the fee specified in the tariff set by the KVK Board.

14.7 - Information that Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi May Request from the Personal Data Subject Making the Application

Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi may request information from the individual making the application in order to determine whether the individual is a personal data subject. Additionally, Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi may ask the personal data subject questions related to their application in order to clarify the matters raised in the request.

14.8 - Right of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi to Reject the Application of the Personal Data Subject

Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi may reject the application of the individual applying in the cases listed below, by explaining the reason for the rejection:

a) Processing personal data for purposes such as research, planning, and statistics by anonymizing personal data with official statistics.
b) Processing personal data for purposes related to art, history, literature, or scientific purposes, or within the scope of freedom of expression, provided that it does not violate national defense, national security, public safety, public order, economic security, privacy, or personal rights, or does not constitute a crime.
c) Processing personal data by public institutions and organizations authorized and empowered by law, within the scope of preventive, protective, and intelligence activities aimed at ensuring national defense, national security, public safety, public order, or economic security.
d) Processing personal data by judicial authorities or enforcement agencies in relation to investigation, prosecution, trial, or enforcement procedures.
e) Processing personal data when necessary to prevent a crime or for criminal investigations.
f) Processing personal data that has been disclosed by the data subject themselves.
g) Processing personal data by public institutions and organizations authorized by law, or by professional organizations with public law status, for performing auditing or regulatory duties, or for disciplinary investigations or prosecutions.
h) Processing personal data for the protection of the economic and financial interests of the state in relation to budget, tax, and financial matters.
i) When the request of the personal data subject has the potential to hinder the rights and freedoms of other individuals.
j) When the request requires disproportionate effort.
k) When the requested information is public information.

Article 15 - Relationship of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi’s Personal Data Protection and Processing Policy with Other Policies and Its Management Structure

15.1 - Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi ensures the implementation of the principles set out in this Policy within the company through policies, procedures, and implementation guides related to the enforcement of these principles. The policy, procedures, and implementation guides established for the protection of personal data are also aligned with the company’s other core policies, procedures, and implementation guides. This alignment ensures compatibility between the processes managed by the company for similar purposes and governed by different policy principles.

15.2 - Management Structure of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi’s Personal Data Protection and Processing Policy
To manage this Policy and other related policies, procedures, and implementation guides, the Human Resources Manager has been appointed as the Data Protection Officer (DPO) by the company’s senior management. The duties of the Data Protection Officers are listed as follows:

Prepare the main policies related to Personal Data Protection and Processing and, if necessary, any amendments, and submit them to senior management for approval.
Decide how the implementation and monitoring of policies related to Personal Data Protection and Processing will be carried out, and submit the assignment of responsibilities and coordination within Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi for approval by senior management.
Identify the necessary steps to ensure compliance with the Personal Data Protection Law and relevant regulations, and submit these steps to senior management for approval; oversee the implementation and ensure coordination.
Raise awareness about Personal Data Protection and Processing within Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi and its business partners.
Identify risks that may arise in the company’s personal data processing activities and ensure the necessary measures are taken; submit proposals for improvements to senior management.
Design and ensure the execution of training related to the protection of personal data and the application of policies.
Make decisions regarding applications from personal data subjects.
Coordinate the information and training activities to ensure that personal data subjects are informed about personal data processing activities and their legal rights.
Follow developments and regulations in the field of Personal Data Protection and propose necessary actions to senior management based on these developments and regulations.
Coordinate relationships with the Personal Data Protection Authority and the institution.
Execute other tasks assigned by the senior management of Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi related to personal data protection.

Article 16 - Final Provisions

In cases where there is no provision in this Policy, the amendments made to the Law and related regulations shall apply.
This Policy and related policies are announced to third parties and company employees by being published on the Ağırman Makina Otomotiv Yan Sanayi ve Ticaret Anonim Şirketi website.
This Policy entered into force on 01.01.2020.

Personal Data Protection and Processing Policy

Your browser is out of date!