PRIVACY STATEMENT
AFACANPARK CHILDREN'S PLAYGROUND EQUIPMENT AND CENTERS LTD.
PERSONAL DATA
PROTECTION AND PROCESSING POLICY
AFACANPARK CHILDREN'S PLAYGROUND EQUIPMENT AND CENTERS LTD.
PERSONAL DATA PROTECTION AND PROCESSING POLICY
Interlocutor:
Personal Data of all natural persons other than employees of Afacanpark Children's Play Groups and Centers Ltd. Co. processed by Afacanpark Children's Play Groups and Centers Ltd. Co.
Prepared:
Afacanpark Children's Playgrounds and Centers Ltd. Co. ……………………
Approved by:
Approved by the board of directors of Afacanpark Children's Play Groups and Centers Ltd.
© Afacanpark Children's Playgrounds and Centers Ltd. Co., 2023
This document may not be reproduced or distributed without the written permission of Afacanpark Children's Play Groups and Centers Ltd.
Afacanpark Children's Playgrounds and Centers Ltd.CompanyThe Law No. 6698 on the Protection of Personal Data attaches utmost importance to protecting the fundamental rights and freedoms of individuals, primarily the right to privacy regulated in Article 20 of the Constitution, in the protection and processing of personal data. Within this framework, the Law No. 6698 on the Protection of Personal Data (“Kanun"Or"Personal Data Protection LawIn accordance with the law, the company takes care to protect and process personal data in a lawful manner and acts with this understanding in all its planning and activities.
Our company does not view the protection and processing of personal data, which is fundamental to the privacy of private life, solely as a matter of compliance with legislation; it places the value it places on people at the core of its approach. Acting with this awareness, our company takes all necessary administrative and technical measures to ensure the lawful protection and processing of personal data.
The Purpose of Policy
Personal Data Protection and Processing Policy (“PoliticsThe purpose of this Policy is to protect and process personal data, whether processed wholly or partly automatically or non-automatically as part of a data recording system, in accordance with the purpose of the Law, thereby maximally safeguarding the fundamental rights and freedoms of individuals, primarily the right to privacy regulated in Article 20 of the Constitution, and to inform personal data owners (data subjects) about the Company's obligations and the procedures and principles it will comply with in accordance with the Law. In line with the purpose of this Policy, the aim is to ensure full compliance with the legislation in the personal data protection and processing activities carried out by our Company and to protect the right to privacy and data security of personal data owners.
Scope of the Policy
This Policy applies to and will be implemented for the following individuals, provided they are natural persons: Job Applicants, Family Members of Job Applicants, Employees, Subcontractor Employees, Subcontractor Officials, Company Shareholders/Partners, Company Officials, Interns, Family Members of Employees/Officials/Shareholders/Interns, Service Provider Employees, Service Provider Officials, Scholarship Recipients, Customer Representatives, Customer Employees, Business Partners, Business Partner Representatives, Business Partner Employees, Supplier Employees, Supplier Officials, Prospective Customer Representatives, Prospective Customer Employees, Visitors, Consumers, Participants, Jury Members, Auditors, Environmental Consultants, Students, and Third Parties. The Company informs these personal data owners about the Law by publishing this Policy on its website. This Policy will not apply to legal entities, regardless of their capacity. For our company employees, the "Personal Data Processing Policy for Employees" will apply.
This Policy shall apply to the aforementioned individuals if their personal data is processed by our Company, wholly or partly through automated means or through non-automated means as part of any data recording system. This Policy shall not apply if the data does not fall within the scope of "Personal Data" as specified below, or if the personal data processing activity carried out by our Company is not through the aforementioned means.
Definitions
The terms used in the application of this Policy have the following meanings:
| Open Consent | It is consent regarding a specific subject, based on information and expressed with free will. |
| Public disclosure | The concept of "making something public," meaning "making it known to everyone," is listed in Article 5 of Law No. 6698 as one of the exceptions to the requirement of obtaining the explicit consent of the data subject for the processing of personal data. |
| Obligation to Disclose | It is the obligation of the data controller to inform the persons whose personal data he processes about who can process their data, for what purposes and on what legal grounds, and to whom and for what purposes it can be transferred. |
| Related User | Persons who process personal data within the data controller organization or in line with the authority and instructions received from the data controller, excluding the person or unit responsible for the technical storage, protection and backup of the data. |
| Destruction | It refers to the deletion, destruction or anonymization of personal data. |
| Processing of Personal Data | It is any operation performed on personal data, such as obtaining, recording, storing, preserving, changing, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, in whole or in part, by automatic means or non-automatic means provided that it is part of any data recording system. |
| KVK Board | It is the Personal Data Protection Board. |
| Data Subject / Data Owner | The categories of individuals whose Personal Data (including special categories of personal data) are processed include Job Applicants, Family Members of Job Applicants, Employees, Subcontractor Employees, Subcontractor Officials, Company Shareholders/Partners, Company Officials, Interns, Family Members of Employees/Officials/Shareholders/Interns, Service Provider Employees, Service Provider Officials, Scholarship Holders, Customer Representatives, Customer Employees, Business Partners, Business Partner Representatives, Business Partner Employees, Supplier Employees, Supplier Officials, Prospective Customer Representatives, Prospective Customer Employees, Visitors, Consumers, Participants, Jury Members, Auditors, Environmental Consultants, Students, and Third Parties. |
| Personal Data | Any information relating to an identified or identifiable natural person. |
| Institution | It is the Personal Data Protection Authority consisting of the Board and the Presidency. |
| Automatic Data Processing | It is a processing activity that is performed automatically without human intervention within the scope of algorithms prepared in advance through software or hardware features, performed by devices with processors such as computers, phones, watches, etc. |
| Special Quality Personal Data | Data related to race, ethnic origin, political opinion, philosophical belief, religion, sect or other belief, dress code, association, foundation or union membership, health, sexual life, criminal conviction and security measures, as well as biometric and genetic data are special data. |
| Record | It is the Registry of Data Controllers. |
| Company / Our Company | Afacanpark Children's Play Groups and Centers Ltd. Co. |
| Data Processor | A natural or legal person who processes Personal Data on behalf of the Data Controller based on the authority granted to him. |
| Data Recording System | It refers to the recording system in which Personal Data is structured and processed according to certain criteria. |
| Data Category | It is the personal data class belonging to the data subject group or groups in which personal data are grouped according to their common characteristics. |
| Data Subject Group | It is the group of persons whose personal data the data controller processes. |
| Data Controller | It is the natural or legal person who determines the purposes and means of processing Personal Data and is responsible for the establishment and management of the data recording system. |
Implementation of the Policy
This Policy, prepared by Afacanpark Children's Play Groups and Centers Ltd. Co. and effective from 22.22.2222, is available on the Company's website. (www.afacanpark.com.tr) It is published and made accessible to relevant individuals.
PROTECTION OF PERSONAL DATA
Security of Personal Data
In accordance with the law, our company takes all necessary administrative and technical measures to ensure an appropriate level of security for the secure storage of personal data and to prevent unlawful processing and access to personal data. The administrative and technical measures taken regarding the security of personal data are regulated in detail in our Company's Personal Data Storage and Destruction Policy.
Our company has established a "Personal Data Protection Management System" to ensure compliance with the regulations in the Law and other legislation, and has created a Personal Data Protection Committee within its structure to ensure the implementation of this Policy and other related policies.
Audit
Our company conducts and commissions necessary audits to ensure the establishment of data security measures as described above and to maintain their regularity and continuity. The Personal Data Protection Committee oversees the measures taken to protect personal data.
Privacy Policy
Our company takes all necessary administrative and technical measures, in accordance with technological capabilities and implementation costs, to ensure that relevant data controllers and data processors do not disclose personal data they possess to others in violation of the Law and Policy provisions, and do not use it for purposes other than the processing purpose. In this context, information and training programs are conducted for company employees regarding the Law and Policy, and confidentiality agreements are signed as part of the hiring process for relevant employees.
Unauthorized Disclosure of Personal Data
If personal data processed by our company is obtained by others through unlawful means, our company will take the necessary steps to notify the data subject and the Personal Data Protection Board (KVK) of this situation within the timeframes determined by the KVK. If deemed necessary by the KVK, this situation will be announced on the KVK's website or through another method deemed appropriate by the KVK.
Ensuring the Legal Rights of the Relevant Persons
Our company respects all legal rights of individuals regarding the application of the Policy and the Law and takes all necessary measures to protect these rights.
Protection of Special Categories of Personal Data
Data relating to a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data, are considered special categories of personal data. Our company is aware that special categories of personal data, if learned by others, could cause harm or discrimination to the data subject, and therefore, it takes adequate measures determined by the Board to protect such personal data processed in accordance with the law. In this context, it has a separate policy (Special Categories of Personal Data Security Policy) and procedure that is systematic, clearly defined, manageable and sustainable.
PROCESSING AND TRANSFER OF PERSONAL DATA
General Principles for the Processing and Transfer of Personal Data
Personal data is processed by our company in accordance with the procedures and principles stipulated in the Law and this Policy. Our company adheres to the following principles when processing personal data.
Compliance with the Law and Rules of Honesty
Our company processes and uses personal data in accordance with relevant legislation and the principles of good faith. In line with the principle of good faith, our company considers the interests and reasonable expectations of data subjects while pursuing its data processing objectives. It acts in a way that prevents the occurrence of unexpected and unwarranted consequences for the data subject. Furthermore, in accordance with this principle, it ensures transparency in the data processing activity for the data subject; and acts in compliance with its obligations to inform and warn.
Being accurate and up-to-date when necessary.
Our company ensures that the personal data it processes is accurate and up-to-date, taking into account the fundamental rights and legitimate interests of the data subjects. In this context, we carefully consider issues such as identifying the sources from which the data is obtained, verifying its accuracy, and evaluating whether it needs to be updated. In accordance with our active duty of care, our company always keeps channels open to ensure that the personal data subject's information is accurate and up-to-date. Maintaining the accuracy and currency of personal data is necessary not only to protect our company's interests but also to protect the fundamental rights and freedoms of the data subject.
Processing for Specific, Explicit and Legitimate Purposes
Our company clearly and precisely defines the purpose of data processing and ensures that this purpose is legitimate. Legitimacy means that the personal data processed by our company is related to and necessary for the business it conducts or the services it provides. Our company does not process data for purposes other than those stated above. Therefore, we are sensitive to the principles of clarity and specificity in legal transactions and texts that explain the purposes of personal data processing.
Being relevant, limited, and proportionate to the purpose for which they are committed.
Our company ensures that the personal data it processes is suitable for achieving the stated purposes and avoids processing data that is not related to or needed for achieving the purpose. Our company does not collect or process personal data for purposes that do not currently exist and are only anticipated in the future. When processing data to meet potential future needs, we comply with the processing conditions stipulated in the Law as if we were starting processing for the first time. Furthermore, we limit the processing of data only to what is necessary for achieving the purpose. In accordance with the principle of proportionality, we establish a reasonable balance between the data processing and the intended purpose.
Retention for the period stipulated in the relevant legislation or for the period necessary for the purpose for which they were processed.
Our company complies with any retention periods stipulated in the relevant legislation for data; otherwise, personal data is retained only for as long as necessary for the purpose for which it was processed. If there is no valid reason for our company to retain personal data further, that data will be deleted, destroyed, or anonymized. The procedures regarding the storage and destruction of personal data are regulated in detail in our Company's Personal Data Storage and Destruction Policy.
Conditions for Processing Personal Data
Our company does not process personal data without the explicit consent of the data subject. Personal data may only be processed without the explicit consent of the data subject if one of the following conditions exists:
Explicitly Provided for in the Laws
Our company may process personal data without seeking the explicit consent of the data subject in cases explicitly permitted by law.
Consent must be granted in cases where the person is unable to express their consent due to factual impossibility or where their consent is not legally valid, and this is necessary for the protection of their own life or the life or physical integrity of another person.
In cases where consent cannot be expressed or is not valid, our company may process personal data without seeking explicit consent in order to protect the life or physical integrity of individuals.
Processing the personal data of the parties to a contract is necessary provided that it is directly related to the establishment or performance of the contract.
Our company may process the personal data of individuals without seeking their explicit consent, in cases where the processing of such data is necessary for the establishment or performance of a contract, and only for this purpose as required by the ordinary course of life.
It is necessary for our company to fulfill its legal obligations.
Our company, as the data controller, may process the personal data of the data subject without seeking explicit consent when it is necessary to fulfill its legal obligations.
The person concerned must have made it public themselves.
Our company may process personal data that has been made public by the data subjects themselves, in other words, data that has been disclosed to the public in any way, only for the purpose of making such data public, as it is considered that the legal interest that should be protected in processing such data ceases to exist when the data is made public and thus becomes known to everyone.
Data processing is necessary for the establishment, exercise, or protection of a right.
Our company may process personal data without seeking explicit consent in cases where data processing is necessary for the exercise or protection of a legally legitimate right.
Data processing by our company is necessary for its legitimate interests, provided that it does not harm the fundamental rights and freedoms of the data subjects.
Our company may process the personal data of data subjects in cases where it is necessary to secure our legitimate interests, provided that this does not harm the fundamental rights and freedoms of the data subjects protected under the Law and Policy. Our company demonstrates the necessary sensitivity in complying with the fundamental principles of personal data protection and in maintaining a balance of interests between our company and the data subjects. Legitimate interest refers to a legitimate, effective, specific, and currently existing interest that can compete with the fundamental rights and freedoms of the data subject. Our company takes additional protective measures to prevent harm to the rights of the data subject. A reasonable balance is maintained between the interests of our company and the fundamental rights and freedoms of the data subject.
Conditions for Processing Special Categories of Personal Data
Our company does not process special categories of personal data without the explicit consent of the data subject. Special categories of personal data may only be processed without the explicit consent of the data subject if one of the following conditions exists:
Explicitly Provided for in the Laws
Special categories of personal data, other than those related to a person's health and sexual life, may be processed without the explicit consent of the data subject in cases explicitly provided for by law.
For the purpose of protecting public health, implementing preventive medicine, providing medical diagnosis, treatment and care services, and planning and managing health services and their financing.
Special categories of personal data relating to the health and sexual life of the data subject may be processed by persons or authorized institutions and organizations bound by an obligation of confidentiality, for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of health services and their financing.
Conditions for Transferring Personal Data
Our company may transfer personal data to third parties in accordance with Article 8 of the Law, taking the necessary security measures and based on one or more of the following personal data processing conditions:
- The explicit consent of the relevant person,
- There is a clear regulation in the laws regarding the transfer of personal data,
- The transfer of personal data is necessary for the protection of the life or physical integrity of the data subject or another person, and the data subject is unable to express their consent due to factual impossibility or their consent is not legally valid.
- It is necessary to transfer personal data of the parties to a contract, provided that it is directly related to the establishment or execution of a contract,
- Personal data transfer is necessary for our company to fulfill its legal obligations.
- Personal data having been made public by the data subject,
- If the transfer of personal data is necessary for the establishment, exercise or protection of a right,
- Personal data transfer is necessary for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the data subject.
Special categories of personal data may be transferred only under one of the following conditions and only within a limited scope, provided that adequate precautions are taken:
- The explicit consent of the relevant person,
- If the person concerned has special personal data other than his/her health and sexual life, there must be a clear regulation in the law regarding the transfer of this data.
- If the person concerned has special personal data regarding his/her health and sexual life, these data may be transferred by persons or authorized institutions and organizations that are under a confidentiality obligation for the purposes of protecting public health, providing preventive medicine, medical diagnosis, treatment and care services, and planning and managing health services and their financing.
Conditions for Transferring Personal Data Abroad
Our company may transfer personal data abroad in accordance with Article 9 of the Law, based on the explicit consent of the data subject, by taking the necessary security measures.
However, subject to the provisions of international agreements to which Türkiye is a party, and provided that one of the conditions specified in the second paragraph of Article 5 and the third paragraph of Article 6 of the Law exists, our Company may transfer personal data to foreign countries declared by the Personal Data Protection Board to have adequate protection, or, in the absence of adequate protection, to foreign countries where the data controllers in Türkiye and the relevant foreign country have provided a written guarantee of adequate protection and the permission of the Personal Data Protection Board has been obtained, without seeking the explicit consent of the data subject.
CATEGORIES OF PERSONAL DATA AND GROUPS OF DATA SUBJECTS
Personal Data Categories
Personal data is processed by our Company and categorized as follows:
| ID | Data containing information about the identity of personal data owners includes: name and surname, Turkish Republic identity number, marital status, mother's and father's name and surname, place and date of birth, and other identification information, as well as copies of driver's licenses, national identity cards, and passports containing this information; tax number, social security number, signature information, etc. |
| Contact | Contact information of personal data owners: Telephone number, address, email address, registered electronic mail address (KEP), fax number, etc. |
| personnel | Information processed for the purpose of obtaining data that will form the basis for the protection of the personal rights of data subjects includes: Curriculum vitae, title information; employment entry and exit records; social security/pension information, payroll information, asset declaration information, information in disciplinary investigation and performance evaluation reports, etc. |
| Location | Information regarding the location of personal data subjects: Location information obtainable while using company vehicles or devices; location data obtainable through systems such as toll collection systems, vehicle identification systems, and meal vouchers. |
| Legal action | Data processed within the scope of determining and tracking the company's legal receivables and rights, fulfilling its debts, and legal obligations includes: power of attorney information, court and administrative body decisions, information from correspondence with judicial authorities, information from case files, etc. |
| Customer Transaction | Our company's customer information includes request details, order information, invoice, promissory note, check, receipt information, etc. |
| Physical Space Security | Personal data relating to records and documents collected upon entry to and while inside the company's physical premises: Entry and exit records, magnetic card records, security camera recordings, vehicle license plates, etc. |
| Transaction Security | Personal data processed during the conduct of company operations, relating to the technical, administrative, legal and commercial security of both the personal data owner and the Company, includes: IP address information, website login and logout (traffic) information, internet access records, password and login information, etc. |
| Finance | Personal data processed relating to information, documents and records showing the outcome of all kinds of financial relationships established by the Company with personal data owners, as well as bank account information, credit information, balance sheet information, financial profile, asset and insurance information, etc. |
| Professional Experience | Personal data of individuals is recorded during and after the recruitment process, including information such as diplomas, transcripts, education/course/certificate information, driver's license information, foreign language skills, reference information, etc. |
| Marketing | Customer number, campaign information, order information, habits/preference reports, cookie records. |
| Audiovisual Records | Photographs, video and audio recordings, and other documents to which this data is transmitted, that may be obtained outside the scope of physical security of personal data owners: Photographs attached to forms, video interview and meeting recordings, etc. |
| Communication Records | Communication data obtainable through the company's communication and information systems includes: corporate telephone call records, corporate mail and e-mail records and contents, etc. |
| SPECIAL NATURE PERSONAL DATA | |
| Health Information | Personal data of data subjects includes health information such as examination details, medical reports, disability status, medical permits, blood type information, etc. |
| Criminal Conviction and Security Measures | Documents containing information about criminal convictions and security measure decisions concerning personal data owners: Criminal records. |
| Biometric Information | Biometric data of personal data owners: Fingerprint registration, facial recognition, eye scan, etc. |
Data Subject Groups
Only natural persons can benefit from the protection of this Policy and the Law. Personal data owners within this scope are grouped as follows:
| Employee Candidate | These are individuals who have applied for a job at our company through any means or who have made their resumes and related information available for our company's review. |
| Family Members of the Job Applicant | They are family members of individuals who have applied for a job with our company in any way or who have made their resumes and related information available for our company's review. |
| Company Shareholder/Partner | These are the individuals who are shareholders/partners of Afacanpark Children's Play Groups and Centers Ltd. |
| Company Official | These individuals are authorized representatives of Afacanpark Children's Play Groups and Centers Ltd. |
| Intern | These are real people interning at our company. |
| Customer Representative | Our dealers, distributors, sales points, etc., who deliver our company's products to the end consumer under a contractual relationship, are natural persons or authorized natural persons of legal entities. |
| Customer Service | Our employees are identified/identifiable employees of dealers, distributors, sales points, etc., who are natural or legal persons and deliver our company's products to the end consumer under a contractual relationship. |
| Service Provider Representative | Customers, Subcontractors, and Suppliers are natural persons or authorized representatives of legal entities who are independent of our Company but with whom our Company has a business relationship. |
| Service Provider Employee | Customers, Subcontractors, and Suppliers are individuals or natural person employees of legal entities that are independent of our company but with whom our company has a business relationship. |
| Subcontractor Representative | These are the natural persons or legal entities, or their authorized representatives, with whom our company has established a principal employer-subcontractor relationship through a contract. |
| Subcontractor Employee | These are identified/identifiable employees of natural or legal persons with whom our company has established a principal employer-subcontractor relationship through a contract. |
| Supplier Representative | They are natural persons or authorized representatives of legal entities who supply inputs, raw materials, or products to our Company for the purpose of providing a product or service. |
| Supplier Employee | They are identified/identifiable employees of natural or legal persons who supply inputs, raw materials, or products to our Company for the purpose of providing a product or service. |
| Business Partner | Participants, Subcontractors, and Suppliers are natural persons or legal entities independent of our Company with whom our Company has a business relationship, even though they are not included in these groups. |
| Partner Representative | Participants are natural persons or authorized representatives of legal entities who are independent of our Company but with whom our Company has a business relationship, and who are not included in the Participant, Subcontractor, or Supplier groups. |
| Partner Employee | Participants are identified/identifiable employees of natural or legal persons who are not included in the Participant, Subcontractor, and Supplier groups but with whom our Company has a business relationship and who are independent of our Company. |
| Scholarship recipient | These are individuals who receive scholarships from our company. |
| Potential Customer Representative | They are authorized representatives of natural persons who have requested or shown interest in using our products and services, or who are assessed as having an interest in such use in accordance with commercial practices and rules of honesty. |
| Lead Employee | They are employees of natural persons who, in accordance with commercial practices and rules of honesty, have requested or shown interest in using our products and services, or who may have such interest. |
| Consumer | Customers are natural persons who use the products and services offered by our company, regardless of whether or not they have any contractual relationship with our company. |
| Exhibition Stand | These are real people who participated in the design competitions organized by Afacanpark. |
| Jury Members | In design competitions organized by Afacanpark, the evaluations regarding compliance with competition rules and ranking are conducted by individuals. |
| Auditor | This is the individual who inspects whether our company complies with laws, regulations, and circulars and prepares the necessary reports. |
| Environmental Consultant | According to the Environmental Law, a facility auditor is a natural person who evaluates the compliance of the activities of institutions, organizations, or businesses subject to inspection with the legislation, assesses whether the measures taken are effectively implemented, and organizes annual internal audit programs within the facility, or provides environmental management services. |
| Student | These are individuals who request sponsorship from the company for their graduation projects and receive academic support from the company. |
| Family Members of Employees/Shareholders/Officials/Interns | Afacanpark Children's Play Groups and Centers Ltd. Co. employees/shareholders/officials/interns are their family members. |
| Third Party | The Afacanpark Children's Play Groups and Centers Ltd. Co. Personal Data Protection and Processing Policy for Employees, prepared for company employees, covers individuals other than those included in any data subject group in this Policy. |
| Visitor | These are all natural persons who have entered our company's physical premises for various purposes or who have visited our websites for any purpose. |
METHOD OF COLLECTING PERSONAL DATA AND LEGAL BASIS
Method of Collecting Personal Data
Our company collects personal data, wholly or partly through automated or non-automated means, in all forms of verbal, written, and electronic media, for the purposes stated in Article 6.1, through the following channels, but not limited to:
- Job application forms,
- Personnel information forms,
- Recruitment documents,
- Various documents submitted to the company,
- Emails sent to the company,
- Invoices and e-invoices,
- Internet platforms,
- Computers and servers, Firewall,
- Arvento,
- Telephone, Time and Attendance System (PDKS),
- Entry and exit records,
- Incident report/defense/disciplinary records,
- Judicial/administrative proceedings, lawsuits,
- Health reports,
- Security cameras,
- Data subjects and third parties.
Legal Basis for Collecting Personal Data
Our company collects personal data in accordance with Articles 5 and 6 of the Law, based on one of the following legal grounds:
- Explicit consent of the relevant person,
- It is clearly stated in the laws;
- Personal data has been made public by the relevant person,
- Provided that it is directly related to the establishment or performance of a contract, it is necessary to process the personal data of the parties to the contract,
- It is necessary for our company to fulfill its legal obligations.
- Data processing is mandatory for the establishment, use or protection of a right,
- Data processing by our Company is necessary for its legitimate interests, provided that it does not harm the fundamental rights and freedoms of the data subjects.
PURPOSE OF PROCESSING PERSONAL DATA
Matching Data Subject Groups with the Processing Purposes of Personal Data Categories
The purposes for processing the personal data of the data subject groups defined and outlined above are matched below: (Natural persons can only be included in one group of persons.)
- Employee Candidate
Data Categories: Identity, Communication, Professional Experience, Physical Environment Security, Health Information, Criminal Conviction and Security Measure Information
Processing Purposes: Managing job application processes, managing job/intern selection and placement processes, conducting communication activities, ensuring physical security of the premises, conducting audit/ethics activities, and managing emergency response processes.
- Family Members of the Job Applicant
Data Categories: Identity, Professional Experience
Purposes of Processing: Execution of Job Candidate/Intern Selection and Placement Processes
- Company Shareholder/Partner
Data Categories: Identity, Communication, Personal Information, Legal Transactions, Finance, Professional Experience, Physical Security, Health Information, Biometric Information
Purposes of Processing: Execution of Emergency Management Processes, Execution of Employee Satisfaction and Engagement Processes, Fulfillment of Employment/Legislative Obligations for Employees, Execution of Employee Benefits and Fringe Processes, Execution of Audit/Ethics Activities, Ensuring Compliance with Legislation, Execution of Finance and Accounting, Ensuring Physical Security of the Premises, Follow-up and Execution of Legal Affairs, Execution of Communication Activities, Execution/Supervision of Business Activities, Execution of Occupational Health/Safety Activities, Organization and Event Management, Execution of Advertising/Campaign/Promotion Processes, Execution of Contract Processes, Execution of Sponsorship Activities, Execution of Wage Policy, Execution of Investment Processes, Providing Information to Authorized Persons/Institutions and Organizations, Execution of Management Activities.
- Company Official
Data Categories: Identity, Communication, Personal Information, Legal Transactions, Physical Security, Finance, Professional Experience, Health Information, Biometric Information
Purposes of Processing: Execution of Emergency Management Processes, Execution of Employee Satisfaction and Engagement Processes, Fulfillment of Employment/Legislative Obligations for Employees, Execution of Employee Benefits and Fringe Processes, Execution of Audit/Ethics Activities, Ensuring Compliance with Legislation, Execution of Finance and Accounting, Ensuring Physical Security of the Workplace, Follow-up and Execution of Legal Affairs, Execution of Internal Audit/Investigation/Intelligence Activities, Execution of Communication Activities, Execution/Auditing of Business Activities, Execution of Occupational Health/Safety Activities, Execution of Business Continuity Activities, Organization and Event Management, Execution of Advertising/Campaign/Promotion Processes, Execution of Contract Processes, Execution of Sponsorship Activities, Execution of Investment Processes, Providing Information to Authorized Persons/Institutions and Organizations, Execution of Management Activities. Execution
- Intern
Data Categories: Identity, Personal Information, Legal Transactions, Physical Security, Finance, Health InformationPurposes of Processing: Execution of Emergency Management Processes, Fulfillment of Employment/Legislative Obligations for Employees, Ensuring Compliance with Legislation in Operations, Execution of Financial and Accounting Matters, Ensuring Physical Security of the Workplace, Follow-up and Execution of Legal Matters, Execution/Supervision of Work Activities, Execution of Occupational Health and Safety Activities, Execution of Contract Processes, Execution of Wage Policy, Providing Information to Authorized Persons, Public Institutions/Organizations.
- Customer Representative
Data Categories: Identity, Contact, Legal Transaction, Customer Transaction, Finance, Marketing, Communication Records
Purposes of Processing: Ensuring compliance with regulations, managing finance and accounting, managing company/product/service loyalty processes, monitoring and managing legal matters, conducting communication activities, managing/monitoring business activities, ensuring business continuity, managing logistics activities, providing after-sales support services for goods/services, managing goods/service sales processes, managing goods/services purchasing processes, managing goods/services/production and operations processes, managing customer relationship management processes, conducting customer satisfaction activities, conducting marketing analysis studies, managing advertising/campaign/promotion processes, managing contract processes, monitoring requests/complaints, and managing product/service/marketing processes.
- Customer Service
Data Categories: Identity, Contact, Customer Transaction, Finance, Marketing, Communication Records
Purposes of Processing: Ensuring compliance with regulations, managing finance and accounting, managing company/product/service loyalty processes, conducting communication activities, managing/monitoring business activities, ensuring business continuity, managing logistics activities, providing after-sales support services for goods/services, managing sales processes for goods/services, managing procurement processes for goods/services, managing production and operation processes for goods/services, managing customer relationship management processes, conducting customer satisfaction activities, conducting marketing analysis studies, managing advertising/campaign/promotion processes, managing contract processes, following up on requests/complaints, managing product/service/marketing processes.
- Service Provider Representative
Data Categories: Identity, Contact, Finance, Professional Experience, Marketing, Communication Records
Purposes of Processing: Conducting Audit/Ethics Activities, Ensuring Compliance with Legislation, Managing Finance and Accounting, Managing Assignment Processes, Conducting Communication Activities, Conducting/Auditing Business Activities, Conducting Occupational Health/Safety Activities, Managing Goods/Services Procurement Processes, Managing Goods/Services/Production and Operation Processes, Conducting Marketing/Analysis Studies, Conducting Advertising/Campaign/Promotion Processes, Conducting Contract Processes, Managing Supply Chain Management Processes, Managing Product/Service Marketing Processes.
- Service Provider Employee
Data Categories: Identity, Contact, Finance, Professional Experience, Marketing, Communication Records
Purposes of Processing: Conducting Audit/Ethics Activities, Ensuring Compliance with Legislation, Managing Finance and Accounting, Managing Assignment Processes, Conducting Communication Activities, Conducting/Auditing Business Activities, Conducting Occupational Health/Safety Activities, Managing Goods/Services Procurement Processes, Managing Goods/Services/Production and Operation Processes, Conducting Marketing/Analysis Studies, Conducting Advertising/Campaign/Promotion Processes, Conducting Contract Processes, Managing Supply Chain Management Processes, Managing Product/Service Marketing Processes.
- Subcontractor Representative
Data Categories: Identity, Communication, Legal Transactions, Physical Security, Finance, Marketing, Communication Records
Purposes of Processing: Execution of Emergency Management Processes, Conducting Audit/Ethics Activities, Ensuring Compliance with Legislation, Managing Finance and Accounting, Ensuring Physical Security of Premises, Executing Assignment Processes.
Legal Affairs Monitoring and Execution, Communication Activities, Business Activities Execution/Supervision, Procurement Processes for Goods/Services, Production and Operation Processes for Goods/Services, Marketing/Analysis Studies, Advertising/Campaign/Promotion Processes, Contract Processes, Supply Chain Management Processes, Product/Service Marketing Processes, Providing Information to Authorized Persons/Institutions and Organizations.
- Subcontractor Employee
Data Categories: Identity, Communication, Physical Space Security, Finance, Marketing, Communication Records, Health Information
Purposes of Processing: Execution of Emergency Management Processes, Fulfillment of Employee Obligations Arising from Employment Contracts/Legislation, Ensuring Compliance with Legislation in Activities, Execution of Finance and Accounting, Ensuring Physical Security of the Premises, Execution of Assignment Processes, Execution of Communication Activities, Execution/Supervision of Business Activities, Execution of Occupational Health/Safety Activities, Execution of Goods/Services Procurement Processes, Execution of Goods/Services/Production and Operation Processes, Execution of Marketing/Analysis Studies, Execution of Advertising/Campaign/Promotion Processes, Execution of Contract Processes, Execution of Supply Chain Management Processes, Execution of Product/Service Marketing Processes, Providing Information to Authorized Persons, Public Institutions/Organizations.
- Supplier Representative
Data Categories: Identity, Communication, Legal Transactions, Physical Security, Finance, Marketing, Communication Records
Purposes of Processing: Execution of Emergency Management Processes, Execution of Audit/Ethics Activities, Ensuring Compliance with Legislation, Execution of Finance and Accounting Operations, Execution of Company/Product/Service Loyalty Processes, Ensuring Physical Security of Premises, Execution of Assignment Processes, Follow-up and Execution of Legal Affairs, Execution of Communication Activities, Execution/Auditing of Business Activities, Execution of Goods/Services Procurement Processes, Execution of Goods/Services/Production and Operation Processes, Execution of Marketing/Analysis Studies, Execution of Advertising/Campaign/Promotion Processes, Execution of Contract Processes, Execution of Supply Chain Management Processes, Execution of Product/Service Marketing Processes, Providing Information to Authorized Persons/Institutions and Organizations.
- Supplier Employee
Data Categories: Identity, Communication, Physical Space Security, Finance, Marketing, Communication Records
- Purposes of Processing: Execution of Emergency Management Processes, Execution of Audit/Ethics Activities, Ensuring Compliance with Legislation, Execution of Finance and Accounting Operations, Execution of Company/Product/Service Loyalty Processes, Ensuring Physical Security, Execution of Assignment Processes, Execution of Communication Activities, Execution/Auditing of Business Activities, Execution of Goods/Services Procurement Processes, Execution of Goods/Services/Production and Operation Processes, Execution of Marketing/Analysis Studies, Execution of Advertising/Campaign/Promotion Processes, Execution of Contract Processes, Execution of Supply Chain Management Processes, Execution of Product/Service Marketing Processes.Business Partner
Data Categories: Finance, Marketing, Communication Records
Purposes of Processing: Execution of Company/Product/Service Loyalty Processes, Conducting Communication Activities, Executing/Monitoring Business Activities, Executing Goods/Services Procurement Processes, Conducting Marketing/Analysis Studies, Executing Advertising/Campaign/Promotion Processes, Executing Contract Processes, Executing Product/Service Marketing Processes
- Partner Representative
Data Categories: Identity, Communication, Legal Transactions, Finance
Purposes of Processing: Ensuring compliance with regulations, managing finance and accounting, managing company/product/service loyalty processes, monitoring and managing legal affairs, conducting communication activities, managing/auditing business activities, managing goods/services procurement processes, managing advertising/campaign/promotion processes, managing contract processes, managing product/service marketing processes, and providing information to authorized persons/institutions and organizations.
- Partner Employee
Data Categories: Identity, Communication, Finance
Purposes of Processing: Ensuring compliance with regulations, managing finance and accounting, managing company/product/service loyalty processes, conducting communication activities, managing/monitoring business activities, managing goods/services procurement processes, managing advertising/campaign/promotion processes, managing contract processes, and managing product/service marketing processes.
- Scholarship recipient
Data Categories: Identity, Communication, Finance
Purposes of Processing: Managing scholarship application and selection processes, conducting communication activities, and managing finance and accounting processes.
- Potential Customer Representative
Data Categories: Identity, Communication
Purposes of Processing: Execution of company/product/service loyalty processes, conducting communication activities, executing advertising/campaign/promotion processes, executing product/service marketing processes.
- Lead Employee
Data Categories: Identity, Communication
Purposes of Processing: Execution of company/product/service loyalty processes, conducting communication activities, executing advertising/campaign/promotion processes, executing product/service marketing processes.
- Consumer
Data Categories: Identity, Communication, Legal Procedures
Purposes of Processing: Ensuring that activities are carried out in accordance with legislation, managing company/product/service loyalty processes, monitoring and managing legal affairs, conducting communication activities, managing advertising/campaign/promotion processes, managing contract processes, managing product/service marketing processes, and providing information to authorized persons/institutions and organizations.
- Exhibition Stand
Data Categories: Identity, Communication, Finance, Professional Experience, Audiovisual Recordings
Purposes of Processing: Execution of Company/Product/Service Loyalty Processes, Conducting Communication Activities, Execution/Monitoring of Business Activities, Execution of Advertising/Campaign/Promotion Processes, Execution of Sponsorship Activities, Execution of Product/Service Marketing Processes, Compliance Check with Competition Rules
- Jury Members
Data Categories: Identity, Communication, Professional Experience, Visual and Audio Recordings
Purposes of Processing: Execution of Company/Product/Service Loyalty Processes, Conducting Communication Activities, Execution/Monitoring of Business Activities, Execution of Advertising/Campaign/Promotion Processes, Execution of Sponsorship Activities, Compliance Check with Competition Rules
- Auditor
Data Categories: Identity, Communication
Purposes of Processing: Auditing / Conducting Ethics Activities, Conducting / Auditing Business Activities
- Environmental Consultant
Data Categories: Identity, Communication
Purposes of Processing: Conducting Audit/Ethics Activities, Conducting/Auditing Business Activities, Conducting Occupational Health/Safety Activities
- Student
Data Categories: Identity, Professional Experience
Purposes of Processing: Receiving and evaluating suggestions for improving business processes, organizational and event management, conducting audit/ethics activities, conducting training activities, managing sponsorship activities, and managing communication activities.
- Family Members of Employees/Shareholders/Officers/Interns
Data Categories: Identity, Communication
Purposes of Processing: Execution of Emergency Management Processes, Fulfillment of Employment/Legislative Obligations for Employees, Execution of Employee Benefits and Advantages Processes, Execution of Audit/Ethics Activities, Ensuring Compliance with Legislation, Execution of Finance and Accounting Processes, Execution of Communication Activities, Execution/Auditing of Business Activities, Providing Information to Authorized Persons/Institutions and Organizations.
- Visitor
Data Categories: Identity, Physical Location Security, Transaction Security
Purposes of Processing: Implementing Information Security Processes, Ensuring Compliance with Legislation, Managing Access Permissions, Ensuring Physical Security of Premises, Creating and Tracking Visitor Records, Conducting Audit/Ethics Activities, Implementing Emergency Management Processes.
- Third Party
Data Categories: Identity, Communication, Legal Procedures
Purposes of Processing: Managing employee/intern selection and placement processes, ensuring activities are carried out in compliance with legislation, managing company/product/service loyalty processes, monitoring and managing legal matters, conducting communication activities, managing advertising/campaign/promotion processes, managing contract processes, managing product/service marketing processes, and providing information to authorized persons/institutions and organizations.
Personal Data Processing Activities Carried Out in Physical Spaces
To ensure security in our company buildings and facilities, entries and exits are recorded and common areas are monitored with cameras. Information regarding camera surveillance is provided in these areas.
Records regarding internet access provided in our company's buildings and facilities are kept in accordance with Law No. 5651 on the Regulation of Publications Made on the Internet and the Fight Against Crimes Committed Through Such Publications and other relevant legislation. These records can be shared with authorized public institutions and organizations upon request and can be used when necessary to fulfill relevant legal obligations in audit activities.
- Personal Data Processing Activities Carried Out on the Website
Traffic information of online visitors visiting our website is automatically processed for the purpose of carrying out information security processes. On the other hand, hosting providers are obliged to record and store website traffic information in accordance with Law No. 5651 and other legislation.
Detailed information regarding the processing of personal data through the website can be found on the relevant website.
- Personal Data Processing Activities Carried Out Through Communication Channels
Corporate email correspondence, internet access logs, and other communications conducted through these channels are monitored and recorded by our company for the purpose of implementing information security processes and managing access permissions.
Individuals should only use these channels for business purposes.
PURPOSES OF TRANSFERRING PERSONAL DATA AND THE INDIVIDUALS/ORGANIZATIONS TO WHOM IT IS TRANSFERRED
Purposes of Transferring Personal Data
Our company transfers personal data only for the following purposes, within the framework of the conditions specified in Articles 8 and 9 of the Law:
- Execution of Emergency Procedures,
- Implementation of Information Security Processes,
- Fulfillment of Obligations Arising from Employment Contracts/Legislation for Employees,
- Managing Employee Benefits and Advantage Processes
- Providing a five percent discount on hospital/treatment fees for employees.
- Conducting Audit/Ethics Activities
- Conducting Educational Activities,
- Carrying out activities in accordance with legislation,
- Conducting Financial and Accounting Activities,
- Execution of Company/Product/Service Loyalty Processes,
- Ensuring Physical Security of Spaces,
- Execution of Assignment Processes
- Monitoring and Conducting Legal Affairs,
- Execution of Communication Activities
- Execution/Supervision of Business Activities,
- Implementation of Occupational Health and Safety Activities,
- Receiving and evaluating suggestions for improving business processes.
- Implementing Business Continuity Activities
- Introduction of the Jury Members and the Winning Contestants,
- Execution of Goods/Services Procurement Processes,
- Execution of After-Sales Support Services for Goods/Services,
- Execution of Goods/Services Sales Processes,
- Execution of Goods/Services/Production and Operation Processes,
- Tracking Work Entry and Exit Times,
- Conducting activities related to customer satisfaction.
- Organization and Event Management
- Conducting Marketing/Analysis Studies
- Making Salary Payments to Staff,
- Managing Advertising and Promotion Processes,
- Execution of Risk Management Processes,
- Conducting Social Responsibility and Civil Society Activities
- Execution of Contract Processes,
- Execution of Strategic Planning Activities,
- Execution of Product/Service Marketing Processes
- Ensuring the Security of Data Controller Operations,
- Sending out competition invitations and prizes.
- Execution of Investment Processes,
- Authorized Person, Providing Information to Public Institutions/Organizations,
- Execution of Management Activities
Individuals/Organizations to Whom Personal Data is Transferred
Our company may transfer personal data to the following individuals and organizations, limited to the data subject groups and data required by the purpose of the transfer:
- Suppliers,
- Authorized public institutions and organizations,
- Business Partners,
- Affiliates and subsidiaries,
- Community/Group Companies,
Natural persons or private legal entities (Organizations with which the Company cooperates to fulfill its contractual or statutory obligations: client company, supplier company, consulting firm, İŞKUR (Turkish Employment Agency), SGK (Social Security Institution), banks, insurance companies, factoring companies, relevant companies/agencies, hotels where events take place, institutions, exhibition areas, national market chains, exhibition companies, authorized travel agency, vocational qualification organization, official state institutions, certified public accountant, Trade Registry Gazette, tax office, independent auditing firms, cargo companies, Police Department, hosting company, judicial authorities within the scope of litigation processes, cooperating law firm, ministries, TPE (Turkish Patent and Trademark Office), Investa, Sistem Global, etc.)
DESTRUCTION AND STORAGE PERIODS OF PERSONAL DATA
Destruction of Personal Data
Without prejudice to the provisions of other laws regarding the destruction of personal data, our Company, in accordance with this Law and other laws, will delete, destroy, or anonymize the personal data it has processed, either automatically or upon the request of the data subject, in accordance with its Personal Data Storage and Destruction Policy, when the reasons requiring its processing cease to exist.
Deletion of personal data refers to the process of making personal data inaccessible and non-reusable for the relevant users in any way.
Destruction of data refers to the process of making personal data inaccessible, irreversible and reusable by anyone.
Anonymization of data refers to the process of making personal data incapable of being associated with an identified or identifiable natural person in any way, even if it is matched with other data using techniques such as masking, variable extraction, generalization, etc.
Personal Data Retention Periods
Our company stores personal data in accordance with the periods stipulated in laws and other regulations. If no retention period is stipulated in laws or other regulations, personal data is stored for as long as necessary to fulfill the purpose of processing that personal data, in accordance with our Company's Personal Data Retention and Destruction Policy, and then deleted, destroyed, or anonymized within the framework of periodic destruction schedules.
INFORMING THE DATA SUBJECT AND THEIR RIGHTS UNDER THE DATA PROTECTION LAW
Informing the Relevant Person
In accordance with Article 10 of the Personal Data Protection Law, our company informs data subjects during the collection of their personal data. This includes clarifying the identity of the company representative (if any), the purpose for which personal data will be processed, to whom and for what purpose the processed personal data may be transferred, the method and legal basis for collecting personal data, and the rights of the data subject.
Cases Where Policy and Law Will Not Be Applied, In Whole or Part
The provisions of this Policy and Law shall not apply in the following cases:
- Personal data may be processed by natural persons solely for activities related to themselves or family members living in the same household, provided that the data is not disclosed to third parties and that obligations regarding data security are complied with.
- The processing of personal data for purposes such as research, planning, and statistics through official statistics and by anonymizing it,
- Personal data may be processed for artistic, historical, literary or scientific purposes, or within the scope of freedom of expression, provided that it does not violate national defense, national security, public security, public order, economic security, privacy or personal rights, or constitute a crime.
- The processing of personal data by public institutions and organizations authorized by law to carry out preventive, protective, and intelligence activities aimed at ensuring national defense, national security, public safety, public order, or economic security.
- Processing of personal data by judicial authorities or enforcement agencies in relation to investigation, prosecution, trial or execution proceedings.
Subject to being consistent with the purpose and fundamental principles of this Policy and Law, and being proportionate, Articles 10 (regulating the data controller's obligation to inform), 11 (regulating the rights of the data subject, excluding the right to claim compensation for damages), and 16 (regulating the obligation to register with the Data Controllers Registry) shall not apply in the following cases:
- Personal data processing is necessary for the prevention of crime or for criminal investigation,
- Processing of personal data that has been made public by the data subject themselves,
- Personal data processing is permitted when authorized and competent public institutions and organizations, as well as professional organizations with the status of public institutions, are necessary for the performance of their supervisory or regulatory duties, or for disciplinary investigations or prosecutions, based on the authority granted by law.
- The processing of personal data is necessary for the protection of the economic and financial interests of the State with regard to budgetary, tax and financial matters.
Data Subject's Rights Under the Personal Data Protection Law
In accordance with Article 10 of the Law, our company informs data subjects of their rights, provides guidance on how to exercise these rights, and implements the necessary internal procedures, administrative and technical arrangements for all of this. The rights of individuals whose personal data is processed, in accordance with Article 11 of the Law, are listed below:
- Learning whether personal data is processed or not,
- Request information if personal data is processed,
- Learning the purpose of processing personal data and whether they are used in accordance with their purpose,
- Knowing the third parties to whom personal data is transferred at home or abroad,
- Requesting correction of personal data if it is incomplete or incorrectly processed,
- Requesting the deletion or destruction of personal data within the framework of the conditions stipulated in Article 7 of the Law,
- Requesting that the actions taken in accordance with clauses (d) and (e) of Article 11 of the Law (correction and destruction) be notified to third parties to whom personal data has been transferred,
- Object to the occurrence of a result against the person himself by analyzing the processed data exclusively through automated systems,
- Request compensation for damages in case of damage due to unlawful processing of personal data.
Requests and applications regarding the implementation of the law can be made by filling out the application form available on our website (www.afacanpark.com.tr).ASTIS Industrial Estate, Ata Neighborhood, 771 Street, No: 7E, Aydın, Türkiye
Requests and applications should be submitted to the Company if the relevant person has an email address previously provided to our Company and registered in the Company's system. “accounting@afacanpark.com.tr” It can also be sent to this address.
In requests and applications,
- Name, surname and signature if the application is in writing,
- For Turkish citizens, the Turkish Republic identity number; for foreigners, their nationality, passport number, or identity number if available.
- The residential or business address used for notification purposes,
- If available, the email address, telephone and fax number for notification purposes,
- Subject of the request
must be found.
Relevant information and documents must be attached to the application.
Our company processes the requests included in the application free of charge as soon as possible, and no later than thirty days, depending on the nature of the request. However, if the process requires additional costs, the fee specified in the tariff determined by the Board may be charged.
Our company may accept or reject the request, explaining its reasons, and will notify the applicant in writing or electronically. If the request is accepted, our company will take the necessary action as soon as possible and inform the applicant. If the application is rejected due to an error on our part, the fee paid will be refunded to the applicant.
If the application is rejected, the response is deemed inadequate, or no response is given within the specified time, the applicant has the right to lodge a complaint with the Board within thirty days of learning of the response, and in any case within sixty days of the application date.