PROTECTION AND PROCESSING OF PERSONAL DATA
ALTAY YAZILIM SAVUNMA ENDÜSTRİYEL SANAYİ VE TİCARET A.Ş. INFORMATION NOTE AS PER THE PERSONAL DATA PROTECTION LAW No. 6698
This "Information Note" is prepared for the purpose of informing you on the issues of gathering methods of your personal data, processing, using, transferring, destruction within the framework of article 10 titled "Obligation to Inform Data Owners" and article 11 titled "Rights of the Relevant Person" in the PDPL by Altay Yazılım Savunma Endüstriyel Sanayi ve Ticaret A.Ş. (“Altay”) acting as data controller pursuant to the Personal Data Protection Law (PDPL) no. 6698.
Purpose of Processing of Personal Data
Your personal data will be processed for the following purposes in either verbal, written or electronic media within the framework of articles 4, 5 and 6 of the PDPL:
- Planning and execution of emergency management processes
- Planning, supervision and execution of information security processes
- Planning, supervision and execution of processes related to the Personal Security Clearance which should be taken in accordance with the Defense Industry Security Directive
- Establishment and management of defense, software and industrial technology infrastructure
- Planning and execution employee satisfaction and / or loyalty processes
- Performing the necessary doctor checks of the employees as required by Law on Occupational Health and Safety
- Planning and execution of fringe benefits and interests for employees
- Planning and execution of information access authorizations of the employees
- Follow-up and / or supervision of employees' business activities
- Event management
- Follow-up of finance and / or accounting works
- Follow-up of legal affairs
- Planning of human resources processes
- Planning and conducting business activities
- Planning and execution of the information access authorizations of business partners and / or suppliers
- Management of relationships with business partners and / or suppliers
- Planning and execution of corporate communication activities
- Planning and / or execution of corporate risk management activities
- Planning and execution of institutional sustainability activities
- Planning and execution of corporate governance activities
- Planning, supervision and execution of activities carried out with the Ministry of National Defense
- Planning and execution of customer relationship management processes
- Planning and / or follow-up of customer satisfaction processes
- Follow up of Customer requests and/or complaints
- Execution of staff procurement processes
- Fulfilment of obligations arising from the labour contract and / or legislation for the Company employees
- Ensuring the security of company fixtures and / or resources
- Planning and execution of company audit activities
- Planning and execution of internal and external training activities
- Planning and execution of the operational activities necessary for ensuring company's activities to be carried out in accordance with the Company's procedures and /or applicable legislation
- Planning and execution of intercorporate appointment, promotion and cease of employment processes
- Ensuring the security of the company settlement (camera recordings etc. to be made in accordance with the Defense Industry Safety Directive)
- Planning and / or execution of financial risk processes of the Company
- Planning and / or execution of operational risk processes of the Company
- Follow-up of contractual procedures and / or legal requirements
- Execution of the strategic planning activities
- Planning and execution of the human resource needs necessary for our activities to be carried out
- Ensuring that the data are accurate and up-to-date
- Giving information to authorized persons and / or organizations (e.g. Ministry of Defense) based on the legislation
- Creation and follow-up of visitor records
- Evaluation and Answering the suggestion, request, complaint and failure reporting and execution of improvement works pursuant to the reporting
Scope of Personal Data
As Altay, acting as Data Controller, within the framework of our legal obligations under the Turkish Code of Commerce no. 6102, PDPL, Labour Law no. 4857, Turkish Code of Obligations no. 6098, Turkish Penal Code no. 5237, Law On Regulation Of Publications On The Internet And Suppression Of Crimes Committed By Means Of Such Publications no. 5651 and other relevant Legislations and Regulations, our Company can acquire, record, store, update, for the purpose of maintaining the services, rearrange, transfer the personal data to national and foreign third parties in cases and to the extent permitted by the legislation by taking the necessary administrative and technical measures in other manners approved by the laws referring to your explicit consent in case entering our website and sharing of the personal data (name-surname, address, occupation, education, marital status, date and place of birth, curriculum vitae, e-mail, phone number, sex, vehicle license plate, location data opened in entering the website, IP address and camera recordings in the building) through automatic or non-automatic methods as required by the MSY 317-2 C Ministry of National Defense, Defense Industry Security Directive which we are subject to with the relevant legislation stated above for the aim of availability of our activities.
These personal data can be processed taking all necessary data security measures referring to your explicit consent or provided that it is explicitly set forth in the laws, it is required for the establishment and performance of the contract, it is necessary for fulfilling the legal obligation or it is required on the grounds of legitimate interest on the condition that they are not used beyond the purposes and scope stated in the Altay Information Note on the Personal Data Protection; stored within the legal retention period or for the period required by the processing purpose and it will be continued to be used by our Company by anonymizing at the end of the period required by the processing purpose or it will be destroyed in accordance with the PDPL or the relevant legislation as required by the Company Procedures.
Processing of Personal data by Altay as required by PDPL;
- in Conformity with The Law and Good Faith
- as Accurate and up-to-date,
- for Specific, Open and Legitimate Purposes
- as relevant, limited and proportionate to the processing purposes,
- for the period designated by relevant legislation or necessitated by the purpose for which data are collected
is especially considered and necessary audits are performed for this purpose. As Altay, we take maximum precautions about the security of your personal data and take all necessary technical, administrative and legal precautions to protect your personal data.
Sharing Personal Data with Third Parties
Our company will only transfer your data referring to your explicit consent or for the reasons that it is explicitly set forth in the laws, it is required for the establishment and performance of the contract, it is necessary for fulfilling the legal obligation, it is requested by authorized public institutions and organizations or it is required on the grounds of legitimate interest provided that adequate measures are taken within the framework of security and privacy principles stated in the PDPL to real and legal persons, suppliers, sub-contractors, business partners, shareholders, legal, financial and tax advisors, auditors, auditing companies which we have an agreement in accordance with the operations we carry out directly/indirectly/at home/abroad for the purpose of performing the Company's operations or public institutions or organizations authorized to request these data in accordance with a legal obligation and other relevant persons or organizations within the scope of the personal data processing conditions and purposes stated in the articles 8 and 9 of PDPL.
Your rights under the Personal Data Protection Law
As personal data owners you have the rights to the following provided that the cases set forth in the article 28 of the PDPL titled "Exceptions" are reserved:
- the right to inquire whether your personal data has been processed, or not,
- the right to ask for information thereto, if your personal data has been processed,
- the right to be informed about the purpose of processing of your personal data and whether it is used in accordance with the purpose,
- the right to know any third party, to which your such personal data has been transferred, either domestically or internationally;
- the right to ask for correction thereof, in case any personal data has been processed imperfectly or inaccurately;
- the right to ask for deletion or destruction of your personal data as per the relevant section of the PDP Law;
- the right to ask for notifying of any third party, to which any such personal data has been transferred, of the actions taken as per the sub-paragraphs (d) and (e) hereof;
- the right to raise an objection against emergence of an outcome that is to the detriment of you upon the analysis of any such processed personal data solely by the automatic systems;
- the right to claim for indemnification of any damage, that might have been incurred in case any such personal data has been processed in breach of the law.
It is important that the information / data you share with Altay is correct and that they are transmitted to Altay accurately in terms of using your rights. The liability arising from false or misleading information belongs to the party that transmitted the information/data to Altay.
In this respect, your requests shall be submitted writing using the application form provided in the website of our Company including your name-surname, signature, T.R. Identity No, residence address or workplace address, e mail address (if any), telephone and fax number and the explanations on the rights you want to claim to Kavaklıdere Mahallesi, Kızılırmak Cd. No:2, 06640 Çankaya/Ankara address by hand or via notary public or through electronic environment with secure electronic signature or identified in the Electronic Signature Law no 5070 or by mobile signature or by using the email address which was notified to the relevant data controller previously by the relevant person and which is registered in the system of the data controller to the "email@example.com" address including the "Personal Data Information Request Form" statement to the subject section.
Our Company, as the data controller, will conclude the requests in the application as soon as possible at most within thirty days based on the nature of the request and the response will be send to either the email address or to the home address of the applicant (based on the preference of him/her).
However, if the operation requires an additional cost, the applicant may be charged with a fee specified by the Board.
You can find detailed informaiton in the POLICY OF PROTECTION AND PROCESSING OF PERSONAL DATA.