ALTUN GIDA ANONİM ŞİRKETİ

PERSONAL DATA PROTECTION AND PROCESSING POLICY

DEFINITIONS

Personal Data Any information relating to an identified or identifiable natural person.
Special Categories of Personal Data Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs,
appearance and dress, association, foundation or trade union membership, health, sexual life, criminal conviction,
security measures, as well as biometric and genetic data are special categories of personal data.
Explicit Consent Consent that is based on information, given freely and relates to a specific subject.
Anonymisation Making personal data impossible to associate with an identified or identifiable natural person in any way, even by
matching it with other data.
Processing of Personal Data Any operation which is performed on personal data, whether or not by automatic means, such as collection, recording,
storage, preservation, alteration, re-organisation, disclosure, transfer, acquisition, making available, classification
or preventing the use of personal data, provided that it is part of a data recording system, in whole or in part.
Board Personal Data Protection Board
Policy Altun Gıda A.Ş. Personal Data Protection Policy
Data Controller The person who determines the purposes and means of processing personal data and manages the place where the data
are kept in a systematic manner.
Data Processor Any natural or legal person who processes personal data on behalf of the data controller, on the basis of the
authority granted by the data controller.
  1. SECTION

1.1. INTRODUCTION

First and foremost, we would like to state that as the Altun Gıda A.Ş. family, we have built our company policy on trust, loyalty and transparency. In this respect, the protection of personal data is considered one of our company’s most important priorities. This Policy has been prepared in order to determine the fundamental principles and implementation rules to be adopted to ensure compliance with the obligations introduced by the Personal Data Protection Law. This Policy explains the principles for the processing of personal data that need to be known by natural persons whose personal data we process. As our esteemed producers/employees/employee candidates, you share your personal data with us through your visits to our website, your submission of CVs and other means.

This Policy provides information regarding the methods of collection of your data, the purposes for which they are used, how long they are retained by us, our obligations, your rights, the transfer processes of your personal data, as well as the anonymisation, deletion and protection of your data. By approving this Policy, your explicit consent is deemed to have been given.

Pursuant to the Constitution of the Republic of Türkiye, everyone who owns personal data has the right to request the protection of such data. With regard to the protection of personal data, which is a constitutional right, Altun Gıda has adopted as a principle that it will exercise due care in protecting the personal data of its producers/employees/employee candidates/visitors through this Policy. Within this principle and in accordance with the relevant legislation, our company takes the necessary administrative and technical measures for the protection of personal data that it processes.

The basic principles adopted by our company in the processing of personal data within the scope of this Policy are as follows:

  • To process your personal data lawfully and in good faith,
  • To keep your personal data accurate and up to date,
  • To process your personal data for specific, explicit and legitimate purposes,
  • To process your personal data in a manner that is relevant, limited and proportionate to the purposes for which they are processed,
  • To retain your personal data for the period stipulated in the relevant legislation or required for the purposes for which they are processed,
  • To inform and enlighten personal data subjects,
  • To establish the necessary system to enable personal data subjects to exercise their rights,
  • To take the necessary measures for the preservation of your personal data,
  • To act in accordance with the relevant legislation and the regulations of the Personal Data Protection Board when transferring your personal data to third parties in line with the requirements of the processing purpose,
  • To show particular sensitivity in the processing and protection of special categories of personal data.

1.2. PURPOSE OF THE POLICY

The main purpose of this Policy is to inform you, as the Altun Gıda A.Ş. family, that the personal information you have shared with us is protected and secured on the basis of confidentiality principles in accordance with the Personal Data Protection Law.

1.3. SCOPE

This Policy covers all personal data of our producers/employees/employee candidates that are processed by automatic means or by non-automatic means provided that they are part of any data recording system.

1.4. APPLICATION OF THE POLICY AND THE RELEVANT LEGISLATION

With regard to the processing/anonymisation of your personal data and similar issues, the relevant legal regulations and legislation shall primarily apply. In the event of any inconsistency between this Policy and the relevant legislation, the provisions of the applicable legal regulations, legislation and decisions of the Personal Data Protection Board shall apply. In the event of changes or amendments to the legal legislation, Altun Gıda A.Ş. will act in accordance with the statutory periods foreseen in the Personal Data Protection Law (KVKK) and carry out the necessary preparations accordingly.

1.5. EFFECTIVENESS OF THE POLICY

This Policy prepared by our Company is dated 11/12/2019. In case the Policy as a whole or certain articles of it are renewed, the effective date of the Policy will also be updated.

The Policy is published on our Company’s website at
http://www.altungida.com/tr/kurumsal/58/kisisel-verilerin-korunmasi-kanunu.
It is made available to relevant persons upon request of personal data subjects.

 

  1. SECTION

2 – MATTERS RELATING TO THE PROTECTION OF PERSONAL DATA

Altun Gıda, in accordance with the Personal Data Protection Law, processes personal data and takes all necessary administrative and technical measures and carries out or has carried out the necessary audits in order to prevent unlawful processing, prevent unlawful access and ensure the preservation of the data.

2.1. ENSURING THE SECURITY OF PERSONAL DATA

Altun Gıda takes the necessary legal, technical and administrative measures regarding data security in the issues specified below. Since this matter is among the priorities of our company, the highest level of care and diligence is exercised. The measures taken by our Company as the data controller to ensure “data security” pursuant to the Personal Data Protection Law are as follows:

  • Our Company takes technological, technical and administrative measures in order to ensure that personal data are processed lawfully. Employees have been informed that they may not process the personal data they have learned contrary to the provisions of the Personal Data Protection Law, that they may not disclose, transfer or use such data for purposes other than processing, and that this obligation will continue even after they leave their position. In this respect, undertakings are obtained from them.
  • Our Company takes technological, technical and administrative measures within its technological means to prevent the negligent or unauthorised disclosure, access, processing, transfer or any other unlawful processing of personal data.
  • As the data controller, our Company contractually imposes on the institutions acting as data processors, with which it has various relationships such as producer, the obligation to comply with the legal, administrative and technical measures developed regarding the obligations to be observed when processing personal data, in accordance with the nature of the data-processing activity they perform.
  • Our Company takes technological, technical and administrative measures to ensure that personal data are stored in secure environments and to prevent their unlawful destruction, loss, classification or alteration.
  • Our Company carries out or has carried out the necessary audits within its body in accordance with the Personal Data Protection Law. Activities are conducted to improve the measures taken.
  • In the event that the processed personal data are obtained by others by unlawful means, this situation will be reported to the relevant personal data subject and the Personal Data Protection Board as soon as possible in accordance with Article 12 of the Personal Data Protection Law.
  • How data security is ensured by us with respect to the personal data of employees and persons applying by CV.

2.2. RESPECTING THE RIGHTS OF THE DATA SUBJECT

Our Company establishes and maintains the necessary mechanisms, internal functioning and administrative and technical arrangements in accordance with the Personal Data Protection Law in order to evaluate the rights of personal data subjects and to provide them with the necessary information.

Where personal data subjects submit their requests relating to their rights listed below to our Company in writing, our Company finalises the request free of charge as soon as possible and within thirty days at the latest, depending on the nature of the request. However, if the operation requires an additional cost, the fee in the tariff determined by the Personal Data Protection Board may be charged by our Company. Personal data subjects have the right to:

  • Learn whether personal data are processed,
  • Request information if personal data have been processed,
  • Learn the purpose of the processing of personal data and whether they are used in accordance with that purpose,
  • Know the third parties to whom personal data are transferred at home or abroad,
  • Request the rectification of personal data if they are incomplete or incorrectly processed and request that third parties to whom the personal data have been transferred be informed of the correction,
  • Request the deletion or destruction of personal data in the event that, although they have been processed in accordance with the provisions of the Personal Data Protection Law and other relevant laws, the reasons requiring their processing no longer exist, and request that third parties to whom the personal data have been transferred be informed of the deletion or destruction,
  • Object to a result arising to their detriment as a result of analysis of the processed data exclusively through automated systems,
  • Request compensation for any damage incurred due to unlawful processing of personal data.

Pursuant to the Personal Data Protection Law, you must submit your request to exercise your rights specified above “in writing” or by using other methods determined by the Personal Data Protection Board to our Company. Since the Personal Data Protection Board has not yet determined any method at this stage, you must submit your application to our Company in writing.

You can submit your request containing your explanation regarding the right you wish to exercise under the Personal Data Protection Law by filling in the form available at
http://www.altungida.com/tr/insan-kaynaklari,
and delivering a signed copy of the form together with documents identifying your identity by hand to the address
“E-5 Karayolu (Çay Cad.) Yeşilköy Mah. No:30/A Dörtyol/Hatay”.
If you wish, you may also send it via a notary public or by other methods specified in the Personal Data Protection Law, or you may send the relevant form signed with a secure electronic signature to
altun.gida@hs02.kep.tr.

2.3. PROTECTION OF SPECIAL CATEGORY PERSONAL DATA

The Personal Data Protection Law (KVKK) gives special importance to certain personal data due to the risk of causing harm, discrimination, or humiliation to individuals if processed unlawfully.

This data includes: race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Our company attaches great importance to the protection of special category personal data, which is defined as “special category” by the KVKK and processed lawfully. In this context, since our company does not specify any method for protecting special category personal data, you must submit your application to our company in writing as required by the mandatory provision of the law.

Your request, which should include your explanations regarding the right you wish to exercise as specified in the KVKK, should be submitted as follows: You can submit a signed copy of the form found at http://www.altungida.com/tr/insan-kaynaklari along with identification documents to the following address: “E-5 Karayolu (Çay Cad.) Yeşilköy Mah. No:30/A Dörtyol/Hatay”. Alternatively, you can send it via a notary public or other methods specified in the Personal Data Protection Law (KVKK), or send the form with a secure electronic signature to altun.gida@hs02.kep.tr.

2.4. INFORMING AND EDUCATING THE DATA SUBJECT

Our company informs data subjects in accordance with the Personal Data Protection Law (KVKK) during the collection of personal data. In this context, our company informs personal data owners about the identity of our company during the collection of their personal data, the purpose for which the personal data will be processed, the duration for which it will be kept within our company, to whom and for what purpose the processed personal data may be transferred, the method and legal basis of personal data collection, and the rights of the personal data owner under the Personal Data Protection Law (KVKK).

Along with the Constitution, everyone has the right to be informed about personal data concerning them. As an extension of this right, Article 11 of the KVKK includes “the right to request information” among the rights of the personal data owner. In this context, our company provides the necessary information when the personal data owner requests information, in accordance with Article 20 of the Constitution and Article 11 of the KVKK.

SECTION
MATTERS RELATING TO THE PROCESSING OF PERSONAL DATA

Our company, in accordance with the Constitution and the KVKK, processes personal data in a manner that is lawful and fair; accurate and, when necessary, up-to-date; Our company processes personal data for specific, clear, and legitimate purposes, in a manner that is relevant to the purpose, limited, and proportionate. Our company retains personal data within the company for the period stipulated by law or required by the purpose of personal data processing.

In accordance with Article 20 of the Constitution and Article 5 of the Personal Data Protection Law (KVKK), our company processes personal data based on one or more of the conditions stipulated in Article 5 of the KVKK regarding the processing of personal data.

Our company acts in accordance with the regulations stipulated in Article 6 of the KVKK regarding the processing of special categories of personal data.

In accordance with Articles 8 and 9 of the KVKK, our company acts in compliance with the regulations stipulated in the law and established by the KVKK Board regarding the transfer of personal data.

3.1. PROCESSING OF PERSONAL DATA IN ACCORDANCE WITH THE PRINCIPLES STIPULATED IN THE LEGISLATION

3.1.1. Processing in Accordance with the Law and the Rule of Honesty

Our company acts in accordance with the principles established by legal regulations and the general rule of trust and honesty in the processing of personal data. In this context, our company pays attention to the proportionality requirements in the processing of personal data and does not use personal data for purposes other than those intended.

3.1.2. Ensuring the Accuracy and Timeliness of Personal Data

Our company ensures the accuracy and timeliness of the personal data it processes, taking into account the fundamental rights of personal data owners and its own legitimate interests. In this regard, it takes the necessary administrative and technical measures.

3.1.3. Processing for Specific, Clear, and Legitimate Purposes

Our company clearly and precisely defines the legitimate and lawful purpose of personal data processing.

3.1.4. Being Relevant, Limited, and Proportional to the Purpose for Which They Are Processed

Our company processes personal data in a manner suitable for achieving the defined purposes. It avoids processing personal data that is not related to or needed for the achievement of these purposes.

3.1.5. Retention for the Period Stipulated in Relevant Legislation or Necessary for the Purpose for Which They Are Processed

Our company retains personal data only for the period specified in the relevant legislation or required for the purpose for which it is processed. Within this scope, our company first determines whether a period is stipulated in the relevant legislation for the storage of personal data; if a period has been determined, it acts in accordance with that period, and if no period has been determined, it stores personal data for the period required for the purpose for which it is processed. Upon the expiry of the period or the cessation of the reasons requiring its processing, personal data is erased, destroyed or anonymized by our company.

3.2. PROCESSING OF PERSONAL DATA ON THE BASIS OF ONE OR MORE OF THE PERSONAL DATA PROCESSING CONDITIONS AND LIMITED TO THOSE CONDITIONS

The protection of personal data is a right arising from the Constitution. Fundamental rights and freedoms may, without infringing upon their essence, be subject only to the framework drawn by the Constitution and may be restricted only by law. Pursuant to the Constitution, personal data may be processed only in the cases stipulated by law or with the explicit consent of the person. Accordingly and in compliance with the Constitution, our company processes personal data only in the cases stipulated by law or with the explicit consent of the person.

The giving of explicit consent by the personal data subject is the legal basis for the lawful processing of personal data. Apart from explicit consent, personal data may also be processed where one of the other conditions set out below exists.

  • Existence of the Explicit Consent of the Personal Data Subject

One of the conditions for the processing of personal data is the explicit consent of the personal data subject. The explicit consent of the personal data subject must relate to a specific matter and must be declared with free will on the basis of being informed.

  • (ii) Being Expressly Stipulated in the Laws

The personal data of the data subject may be processed lawfully where this is expressly stipulated in the law.

  • (iii) Inability to Obtain the Explicit Consent of the Person Concerned Due to Actual Impossibility
Where it is compulsory to process personal data in order to protect the life or bodily integrity of the person who is unable to declare consent due to actual impossibility or whose consent cannot be given legal validity, or of another person, the personal data of the data subject may be processed.

Example: Using the contact details of an employee who has fainted in order to reach their relatives

  • (iv) Being Directly Related to the Conclusion or Performance of a Contract

Provided that it is directly related to the conclusion or performance of a contract, personal data may be processed where it is necessary to process the personal data of the parties to the contract.

  • (v) Fulfilment of the Legal Obligation of the Company

Where processing is compulsory in order for our company to fulfil its legal obligations as data controller, the personal data of the data subject may be processed.

  • (vi) The Personal Data Subject Making Their Personal Data Public

Where the data subject has made their personal data public themselves, the relevant personal data may be processed.

  • (vii) Data Processing Being Compulsory for the Establishment or Protection of a Right

Where data processing is compulsory for the establishment, exercise or protection of a right, the personal data of the data subject may be processed.

  • (viii) Data Processing Being Compulsory for the Legitimate Interest of Our Company

Where data processing is compulsory for the legitimate interests of our company, provided that it does not harm the fundamental rights and freedoms of the personal data subject, the personal data of the data subject may be processed.

 

3.3. PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA

The KVKK has attached particular importance to certain personal data due to the risk that, when processed unlawfully, it may cause harm to individuals, discrimination or an event that is humiliating for them. Such personal data is referred to as ‘’special categories of personal data’’. Our company approaches such data with sensitivity.

In compliance with the KVKK, special categories of personal data are processed by our company in the following cases, provided that the adequate measures to be determined by the Personal Data Protection Board are taken:

  • If the explicit consent of the personal data subject exists, or
  • If the explicit consent of the personal data subject does not exist;
  • Special categories of personal data other than those relating to the health and sexual life of the personal data subject are processed in the cases stipulated in the laws,
  • Special categories of personal data relating to the health and sexual life of the personal data subject are processed only for the purposes of protecting public health, preventive medicine, medical diagnosis, the carrying out of treatment and care services, and the planning and management of health services and their financing, by persons under an obligation of confidentiality or by authorized institutions and organizations.

 

3.4. TRANSFER OF PERSONAL DATA

In line with lawful personal data processing purposes, our company may transfer the personal data and the special categories of personal data of the personal data subject to third parties by taking the necessary security measures. Accordingly, our company acts in compliance with the arrangements stipulated in the KVKK.

 

  • Transfer of Personal Data Abroad

Personal data is transferred by our company to foreign countries declared by the Personal Data Protection Board to have adequate protection or, in the absence of adequate protection, to foreign countries where the data controllers in Türkiye and in the relevant foreign country have undertaken adequate protection in writing and the permission of the Personal Data Protection Board exists. Accordingly, our company acts in compliance with the arrangements stipulated in Article 9 of the KVKK.

 

3.5. PERSONAL DATA PROCESSING ACTIVITIES CARRIED OUT AT BUILDING AND FACILITY ENTRANCES AND WITHIN BUILDINGS AND FACILITIES, AND WEBSITE VISITORS

For the purpose of ensuring security, our company carries out personal data processing activities in our company buildings and facilities through security camera monitoring and for the purpose of monitoring visitor entries and exits.

Personal data processing activity is carried out by our company through the use of security cameras and the recording of visitor entries and exits.

Within this scope, our company acts in compliance with the Constitution, the KVKK and other relevant legislation.

Image recordings of our visitors are taken at the entrances of our company buildings and facilities and within the facilities by means of a camera monitoring system.

Within the scope of security camera monitoring activity, our company pursues purposes such as increasing the quality of the service provided, ensuring its reliability, and ensuring the security of the company, of customers and of other persons.

Our company acts in compliance with the arrangements set out in the KVKK when carrying out camera monitoring activity for security purposes.

The camera monitoring activity carried out by our company is conducted in compliance with the Law on Private Security Services and the relevant legislation.

Only a limited number of company employees have access to the records that are recorded and stored in the digital environment.

In compliance with the KVKK, our company takes the necessary technical and administrative measures to ensure the security of the personal data obtained as a result of camera monitoring activity.

Apart from the camera recording set out above, our company carries out personal data processing activities in our company buildings and facilities for the purpose of monitoring visitor entries and exits, for the purposes of ensuring security and the purposes set out in this policy.