Clarification Text on the Protection and Processing of Personal Data

Ingredients

1. Introduction
2. Purpose
3. Scope
4. General Principles Regarding the Processing of Personal Data
5. Terms of Processing Personal Data
6. Methods of Collection and Processing of Personal Data
7. Purposes of Processing Personal Data and Retention Periods
8. Third Parties to which Personal Data is Transferred and Purposes of Transfer
9. Ensuring the Security and Confidentiality of Personal Data
10. Deletion, Destruction or Anonymization of Personal Data
11. The Company's Liability to Clarification
12. Rights of Personal Data Owners

1. Introduction

            The Law on the Protection of Personal Data No. 6698 regulates the protection of fundamental rights and freedoms of individuals in the processing of personal data, the obligations of natural and legal persons who process personal data, and the procedures and principles to be followed. The purpose of this Clarification Text prepared in this direction is to ensure compliance with the obligations related to the Personal Data Protection Law regulations.

            The protection of personal data of visitors, customers, suppliers, business partners and third parties governed by the Clarification Text, the obligations of natural and legal persons who process personal data, and the procedures and principles to be complied with are regulated. The protection of the personal data of our employees, in line with the principles in this clarification text, is carried out by Ilsan Tekstil Sanayi ve Ticaret A.Ş. It is regulated under the Clarification Text on the Processing of Personal Data of the personnel.

2. Purpose

            It has been prepared in order to protect the fundamental rights and freedoms of individuals, especially the privacy of private life, in the processing of personal data, and to regulate the obligations of natural and legal persons who process personal data and the procedures and principles to be followed.

3. Scope

            Within the scope of the Clarification Text, data owners whose personal data are processed are categorized as board members, employees and interns, employee candidates, customers, suppliers, visitors and third parties (family members and other natural persons, including but not limited to:

4. General Principles Regarding the Processing of Personal Data

            Pursuant to Article 3 of the Personal Data Protection Law, obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring personal data completely or partially automatically or non-automatically provided that it is a part of any data recording system, All kinds of operations carried out on data, such as the acquisition, making available, classification or prevention of use, fall within the scope of processing personal data.

            It is obligatory to comply with the following principles in the processing of personal data:

• Compliance with the law and honesty rules
• Being accurate and up-to-date when necessary
• Processing for specific, explicit and legitimate purposes
• Being connected, limited and restrained for the purpose for which they are processed.
• Preservation for the period required by the relevant legislation or for the purpose for which they are processed.

Our company acts in accordance with the rules of law and honesty in the processing of personal data, ensures the accuracy and up-to-dateness of personal data, clearly and precisely states the purpose of data processing, processes enough information to achieve the purposes and stores the data for the period stipulated in the legislation or required by the data processing purposes. .

5. Terms of Processing Personal Data

             Personal data and sensitive personal data are processed by our company with the explicit consent of the personal data owner or without seeking explicit consent in cases stipulated in Articles 5 and 6 of the Personal Data Protection Law.

            Data processing conditions specified in Article 5 of the Personal Data Protection Law;

• expressly stipulated in laws
• It is compulsory for the protection of life or physical integrity of the person or another person, who is unable to express his consent due to actual impossibility or whose consent is not legally recognized.
• It is necessary to process the personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract.
• It is mandatory for our company to fulfill its legal obligation.
• The fact that the personal data owner has been made public by himself
• Data processing is mandatory for the establishment, exercise or protection of a right
• Data processing is mandatory for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the personal data owner.

                Data processing conditions specified in Article 6 of the Personal Data Protection Law;

            Our company processes the personal data specified as special quality, which carries the risk of discrimination when processed unlawfully, in accordance with the data processing conditions. It is prohibited to process sensitive personal data without the explicit consent of the personal data owner. However, provided that adequate precautions are taken, sensitive personal data may be processed in the following cases, even without the explicit consent of the personal data owner:

• Written express consent of the personal data owner
• Protection of public health
• Preventive medicine
• Execution of medical diagnosis, treatment and care services
• Planning and management of health services and financing

            Data Processing Activities within the Company and on the Website

            In order to protect the interests of our company, our employees and third parties who come to our company, camera monitoring is carried out in and around the company. In line with the regulations in the Personal Data Protection Law, this Clarification Text is published on our website regarding the camera monitoring activity by our company. There is no monitoring in areas that may result in interference with the privacy of the person. Only a limited number of Company employees and, if needed, security company employees who are suppliers can access the security camera recordings.

            Personal data processing is carried out in order to monitor the entrances and exits of our guests who come to visit our guardhouses at the entrance of our company. While obtaining the name and surname information of the people who come to our company, the said data is only processed for this purpose and the relevant personal data is recorded in the physical environment in the registration system.

             Personal data collection and recording is not done in any way regarding the people who visit the website of our company.

6. Methods of Collection and Processing of Personal Data

             Ilsan Tekstil Sanayi ve Ticaret A.Ş., its shareholders and officials, its personnel and interns and their relatives, real persons applying for a job, customers and suppliers, regardless of any reason, who come to Ilsan Tekstil Sanayi ve Ticaret A.Ş. Personal data of all visitors are collected and processed in accordance with Article 12 of the Personal Data Protection Law.

7. Purposes of Processing Personal Data and Retention Periods

Carrying out human resources processes, providing information to authorized institutions and organizations in accordance with the relevant legislation, following legal transactions, performing accounting and financial transactions such as bill payment and reconciliation, ensuring the continuity of business relations with customers and suppliers, monitoring risk management processes, entering the company - registering departing visitors, etc. Our company processes personal data for various reasons.

               If a period is foreseen in the relevant legislation for the storage of personal data, it is kept for this period, if a period is not foreseen, the personal data is kept for the period required for the purpose for which they are processed. Even if the retention periods determined by the company have been completed, the information in question may be retained in order to constitute evidence in possible legal disputes, to assert the relevant right related to personal data or to establish a defense.

8. Third Parties and Purposes of Transfer of Personal Data

            The procedures and principles to be applied in personal data transfers are regulated in Articles 8 and 9 of the Personal Data Protection Law, and the personal data and sensitive personal data of the personal data owner can be transferred to third parties at home and abroad. In order to perform the services, your personal data is public institutions and organizations authorized to receive information and documents in accordance with the Law and other legislation, private legal persons authorized to receive information and documents, and lawyers, real and legal persons with whom we are in a proxy relationship, our business partners and other legal persons for the resolution of legal disputes. may be shared with third parties. The said information sharing will be shared within legal frameworks, limited to the requested purpose. However, in any case, except in exceptional cases, personal data cannot be shared without the explicit consent of the personal data owner.

9. Ensuring the Security and Confidentiality of Personal Data

            Our company, in accordance with Article 12 of the Personal Data Protection Law, in order to prevent the illegal processing of the personal data it processes and the illegal access to the personal data, to ensure the protection of personal data and the appropriate level of security; Training and raising awareness of company employees who are authorized to access personal data, Adding a clause to the contracts concluded with the persons to whom personal data is transferred, that the party to which the personal data is transferred will fulfill the data security, Creation of a firewall with the SNC Firewall device, Antivirus program, Access control etc. uses methods.

            In the event that personal data is obtained by others through illegal means, the relevant data owner and the Personal Data Protection Board will be informed as soon as possible.

10. Deletion, Destruction or Anonymization of Personal Data

            Pursuant to Article 7 of the Personal Data Protection Law, although the personal data has been processed in accordance with the relevant legislation, the personal data is deleted, destroyed or anonymized by our company ex officio or upon the request of the personal data owner, in case the reasons for the processing are eliminated.

            Destruction and deletion of personal data are carried out by physically destroying them and securely deleting them from the software. Anonymization of personal data will also be carried out by using techniques such as masking, data derivation, pseudonymization, overwriting, data obfuscation.

11. The Company's Liability to Clarification

            Our company clarifies the personal data owners whose personal data are processed in accordance with Article 10 of the Personal Data Protection Law. In this context, our company's data controller and representative fulfill the obligation to inform about the purpose for which personal data will be processed, the data collection method and legal basis, the transfer of personal data to third parties and the rights of the personal data owner.

12. Rights of Personal Data Owners

            In accordance with Article 13 of the Personal Data Protection Law, personal data owners apply to our company in writing by filling out the personal data owner application form; to learn whether their personal data is processed, to learn the purpose of processing their personal data and whether they are used in accordance with its purpose, to learn about the third parties whose personal data are transferred in the country or abroad; to request correction of personal data in case of incomplete or incorrect processing and notification of corrections made in this context to third parties to whom personal data has been transferred; requesting their deletion, destruction or anonymization in the event that the reasons requiring the processing of personal data disappear, and that the transaction made within this scope be notified to the third parties to whom the personal data has been transferred; It is informed that they have the right to request that the processed data be analyzed through automatic systems and to be notified whether a result against them or not, and to demand the compensation of the damage in case of loss due to the unlawful processing of their personal data.

            In accordance with Article 13 of the Personal Data Protection Law, the application requests made by the personal data owner will be concluded free of charge as soon as possible and within 30 (thirty) days at the latest, depending on the nature of the request. If the transactions require additional costs, a fee will be charged based on the tariff determined by the Personal Data Protection Board. In cases where such applications prevent the rights and freedoms of third parties, require disproportionate effort, the information is publicly available, jeopardizes the confidentiality of third parties, and if one of the circumstances outside the scope of the Personal Data Protection Law exists, the application will be rejected.

            This clarification text may be revised by Ilsan Tekstil Sanayi ve Ticaret A.Ş, if deemed necessary. In case of revision, the most up-to-date version of the clarification text will be placed on the company's website.