Our Company Policy on the Protection and Processing of Personal Data

This policy explains on which principles and legal grounds our company processes personal data, which data categories and groups of persons it covers, to whom data is transferred, how long it is kept and how it is destroyed, and how the rights under Law No. 6698 can be exercised.

This Policy consists of nine parts: general provisions and definitions; measures to protect data; principles and conditions of processing and transfer; data categories and groups of persons; collection method and legal grounds; purposes of processing; purposes of transfer and recipients; destruction and retention periods; and finally informing the data subject and the data subject's rights. You can go straight to the topic you are looking for via the relevant section heading.

General Provisions

1.1 Introduction

When it comes to protecting and processing personal data, our company, whose trade name is General Taş Kırma Makinaları Sanayi ve Ticaret Anonim Şirketi (the “Company” for short), gives top priority to the fundamental rights and freedoms of individuals and, foremost among them, to the privacy of private life guaranteed by Article 20 of the Constitution. Within the framework of the Personal Data Protection Law No. 6698 (the “Law” or “PDP Law”), the Company pays attention to protecting and processing data lawfully and shapes all of its planning and activities according to this principle.

We do not view the protection and processing of personal data, which underpin the privacy of private life, solely from the angle of legal compliance; the starting point of our approach is the value we place on people. With this understanding, our Company takes every administrative and technical measure required for the lawful protection and processing of personal data.

1.2 Purpose of the Policy

This document, referred to below simply as the “Policy”, pursues two goals in line with the purpose of the Law. The first is to protect as broadly as possible the fundamental rights and freedoms of individuals, above all the privacy of private life under Article 20 of the Constitution, with regard to personal data processed wholly or partly by automated means, or by non-automated means provided that it forms part of a data recording system. The second is to explain to the relevant persons (data subjects) the obligations our Company assumes and the procedures and principles it will follow under the Law.

In connection with these aims, the Policy seeks full compliance with legislation in the data protection and processing activities carried out by our Company, and protection of data subjects' right to privacy and to data security.

1.3 Scope of the Policy

The Policy has been prepared for natural persons only and applies to the following groups: people applying for a job; trainers; service providers and their employees and representatives; customers and customer representatives; suppliers and supplier representatives; subcontractor employees; drivers and carriers; company shareholder partners and company representatives; third parties named as references or notified as an employee's emergency contact; and visitors. By publishing the Policy on its website, the Company informs these data subjects about the Law.

Legal entities, in whatever capacity, fall outside the scope of the Policy. For our Company's employees, the separately prepared “Personal Data Processing Policy for Employees” applies.

The Policy applies where the data of the persons listed above is processed by our Company wholly or partly by automated means, or by non-automated means provided that it forms part of a data recording system. If a piece of information does not qualify as “Personal Data” within the meaning defined below, or if processing takes place outside these means, the Policy does not apply.

1.4 Definitions

Wherever the terms below appear in this Policy, they are to be understood with the meanings given in the following table. The definitions follow those used in the Law and in the secondary legislation issued by the Personal Data Protection Authority:

Explicit Consent	Approval that relates to a specific matter, is given after the person has been informed, and reflects the person's own free will.
Making Public	Rendering information accessible to everyone. Article 5 of Law No. 6698 lists data made public by the data subject among the exceptions to the rule that explicit consent must be obtained before processing.
Obligation to Inform	The data controller's duty to tell the persons whose data it processes who will process the data, for what purpose and on what legal ground, and to whom and for what purpose it may be transferred.
Relevant User	Persons who process personal data within the data controller's organisation or under the authority and instructions received from the data controller, other than the person or unit responsible for the technical storage, protection and backup of the data.
Destruction	The collective name for deletion, destruction and anonymisation.
Processing of Personal Data	Any operation performed on personal data wholly or partly by automated means, or by non-automated means provided that it forms part of a data recording system: for example obtaining, recording, storing, keeping, altering, reorganising, disclosing, transferring, taking over, making accessible, classifying or preventing the use of the data.
PDP Board	The Personal Data Protection Board.
Data Subject / Relevant Person	Every natural person whose data (including special categories of data) is processed and who belongs to one of the groups of persons listed within the scope of the Policy: candidates, trainers, service providers and their employees and representatives, customers and their representatives, suppliers and their representatives, subcontractor employees, drivers, carriers, shareholder partners, company representatives, reference and emergency contact persons, and visitors.
Personal Data	Any information relating to an identified or identifiable natural person.
Authority	The Personal Data Protection Authority, made up of the Board and the Presidency.
Automated Data Processing	Processing carried out automatically, without human intervention, by devices containing a processor (e.g. computers, telephones, watches) through their software or hardware features and within the framework of pre-prepared algorithms.
Special Category of Personal Data	Data on a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, clothing and attire, membership of an association, foundation or trade union, health, sex life, criminal convictions and security measures, as well as biometric and genetic data.
Registry	The Data Controllers' Registry.
Company / Our Company	The data controller publishing this Policy, namely General Taş Kırma Makinaları Sanayi ve Ticaret Anonim Şirketi.
Data Processor	A natural or legal person who processes personal data on behalf of the data controller and within the authority received from it.
Data Recording System	Any recording system in which data is organised and processed according to predetermined criteria.
Data Category	A class into which the personal data of a group or groups of data subjects is brought together according to shared characteristics.
Group of Data Subjects	The community formed by the relevant persons whose data is processed by the data controller.
Data Controller	The natural or legal person who decides for what purposes and by what means personal data will be processed, and who sets up and manages the data recording system.

1.5 Entry into Force

The Policy prepared by our Company has been in force since 25/11/2022. So that everyone can reach it, the text is published on our website at www.general-makina.com.tr.

2. Protection of Personal Data

2.1 Security of Data

As required by the Law, our Company takes every administrative and technical measure that ensures an appropriate level of security in order to store personal data safely and to prevent its unlawful processing and unlawful access to it. These measures are described in detail in a separate policy governing the Company's retention and destruction processes.

To guarantee that it acts in accordance with the Law and other relevant legislation, our Company has set up a “Personal Data Protection Management System”. In addition, a Personal Data Protection Committee has been formed within the company to put this Policy and the related policies into practice.

2.2 Audit

To ensure data security and the regular and continuous functioning of the measures taken, our Company carries out the necessary audits itself or has them carried out externally. Auditing the security measures is the duty of the Personal Data Protection Committee. If audits reveal shortcomings, the necessary corrections are made without delay.

2.3 Confidentiality

So that the relevant data controllers and data processors do not disclose the personal data they hold to others in breach of the Law and the Policy, and do not use it outside the purpose of processing, our Company takes all necessary administrative and technical measures in proportion to technological possibilities and implementation costs. Accordingly, employees receive information and training on the Law and the Policy, and confidentiality agreements are signed with the relevant employees as part of the recruitment process.

2.4 Unauthorised Disclosure of Data

Should personal data processed by our Company fall into the hands of others by unlawful means, our Company ensures that notification is made both to the relevant person and to the Board within the periods set by the PDP Board. If the PDP Board considers it necessary, the situation is announced on the Board's website or by another method the Board deems appropriate.

2.5 Respect for Data Subjects' Rights

All legal rights arising from the application of the Policy and the Law are observed by our Company, and every measure necessary to protect these rights is taken. Applications from data subjects are assessed according to the procedure explained in section 9.3.

2.6 Protection of Special Categories of Data

The special categories of data defined in section 1.4 (such as race, ethnic origin, beliefs, health, sex life, trade union membership, criminal convictions, biometric and genetic data) are subject to a separate protection regime. If such data became known to others, the person concerned could suffer harm or discrimination. Aware of this, our Company meticulously applies the adequate measures prescribed by the Board to protect such data that it processes lawfully. A systematic, clearly ruled, manageable and sustainable policy and procedure devoted solely to the security of special categories of data is also in place.

3. Processing and Transfer of Personal Data

3.1 General Principles Followed in Processing and Transfer

Our Company processes personal data according to the procedures and principles laid down in the Law and in this Policy and adheres to the principles below in doing so. These principles are applied together at every stage, from the collection of data to its destruction; complying with one does not mean the others can be set aside.

3.1.1 Compliance with the Law and the Rules of Good Faith

Personal data is processed in accordance with the relevant legislation and the rule of good faith and is used within these limits. The good-faith principle requires us, while pursuing our goals, also to weigh the interests of the data subject and what that person may reasonably expect; we act so as to prevent outcomes that the person did not foresee and could not be expected to foresee. Under the same principle, processing is kept transparent for the relevant person and the obligations to inform and warn are respected.

3.1.2 Accuracy and, Where Necessary, Being Up to Date

Taking into account data subjects' fundamental rights and legitimate interests, care is taken that the information processed is accurate and current. This includes knowing the source from which data was obtained, confirming its accuracy and assessing whether it needs updating. Under the duty of active care, channels that allow the data subject's information to be kept accurate and up to date are always kept open. Keeping data accurate and current protects both our Company's interests and the fundamental rights and freedoms of the relevant person.

3.1.3 Processing for Specific, Explicit and Legitimate Purposes

The purpose of each processing activity is stated clearly and precisely, and it is ensured that this purpose is legitimate. For a purpose to be considered legitimate, the data processed must relate to the work we carry out or the service we provide and must be necessary for them. Data is not processed outside the stated purposes; for this reason care is taken that the contracts, forms and information notices describing the purposes are clear and specific.

3.1.4 Being Relevant, Limited and Proportionate to the Purpose

The data processed must be suitable for achieving the stated purposes; data that is unrelated to the purpose or not needed is not processed. Our Company does not collect or process data for purposes that have not yet arisen and are only expected to arise in the future. If data is to be processed for needs that arise later, the processing conditions in the Law are satisfied anew, as if processing were starting for the first time. The data processed is kept limited to what is needed to achieve the purpose, and in line with the principle of proportionality a reasonable balance is struck between the processing and the purpose to be achieved.

3.1.5 Retention for the Period Laid Down in Legislation or Required by the Purpose

Where legislation lays down a period for retaining data, our Company complies with that period; where there is no such period, data is kept only for as long as necessary for the purpose for which it is processed. When no valid reason remains that justifies keeping a piece of data longer, it is deleted, destroyed or anonymised. The details of the retention and destruction steps are set out in the separate company policy on this subject.

3.2 Under Which Conditions Is Data Processed?

As a general rule, our Company does not process personal data without the explicit consent of the relevant person. Processing without seeking explicit consent is possible only where one of the following conditions is met:

3.2.1 Processing Is Expressly Provided for by Law

In cases expressly provided for by law, our Company may process the personal data of the relevant person without obtaining explicit consent.

3.2.2 Necessity to Protect the Life or Bodily Integrity of a Person Unable to Give Consent, or of Another Person

Where it is necessary to protect the life or bodily integrity of a person who cannot express consent due to actual impossibility, or whose consent is not legally valid, or of another person, our Company may process personal data without seeking explicit consent.

3.2.3 Necessity to Process Data of the Parties in Direct Connection with the Conclusion or Performance of a Contract

If processing the personal data of the parties to a contract is necessary in direct connection with its conclusion or performance, our Company may process the relevant persons' data without seeking explicit consent, in line with the ordinary course of life and limited to this purpose.

3.2.4 Necessity for Our Company to Fulfil Its Legal Obligation

Where this is necessary for it to fulfil its legal obligations as data controller, our Company may process the relevant person's data without obtaining explicit consent.

3.2.5 The Data Has Been Made Public by the Data Subject

For data made public by the relevant person themselves, i.e. shared with the public in any way, it is accepted that the legal interest requiring protection has ceased to exist because the data has become knowable by everyone. Our Company may process such data limited to the purpose of its being made public.

3.2.6 Establishing, Exercising or Protecting a Right

Where data processing is necessary for exercising or protecting a legally legitimate right, our Company may process the relevant persons' data without seeking explicit consent.

3.2.7 Necessity for Legitimate Interests, Provided That Fundamental Rights and Freedoms Are Not Harmed

Provided that the fundamental rights and freedoms of relevant persons protected by the Law and the Policy are not harmed, personal data may be processed where this is necessary for our Company's legitimate interests. In this respect our Company takes care that the basic principles of data protection are complied with and that the balance of interests between itself and data subjects is observed. A legitimate interest is a lawful, specific and currently existing interest of sufficient weight to be balanced against the fundamental rights and freedoms of the relevant person. Additional safeguards are applied to protect the data subject's rights, and the Company's interest and the person's fundamental rights and freedoms are kept in reasonable balance.

3.3 Conditions for Processing Special Categories of Data

Special categories of personal data are not processed without the relevant person's explicit consent either. Processing without seeking explicit consent is possible only if one of the following conditions exists:

3.3.1 Expressly Provided for by Law

In cases expressly provided for by law, explicit consent is not required for special categories of data other than health and sex life.

3.3.2 Protection of Public Health, Preventive Medicine, Medical Diagnosis, Treatment and Care, and Planning and Management of Health Services and Their Financing

Data on health and sex life may only be processed by persons under a duty of confidentiality or by authorised institutions and organisations, and for the following purposes: protecting public health, practising preventive medicine, making diagnoses, providing treatment and care, and planning and managing health services and their financing.

3.4 Transfer of Data to Third Parties

Provided that the necessary security measures are taken and in accordance with Article 8 of the Law, our Company may transfer personal data to third parties on the basis of, and limited to, one or more of the following processing conditions:

the relevant person has given explicit consent,
there is an express provision in the laws on the transfer of the data,
the transfer is necessary for the life or bodily integrity of the relevant person, who cannot express consent due to actual impossibility or whose consent is not legally valid, or of another person,
transferring the data of the parties to a contract is necessary in direct connection with its conclusion or performance,
the transfer is necessary for our Company to fulfil its legal obligation,
the data has been disclosed to the public by its owner,
the transfer is necessary for establishing, exercising or protecting a right,
the transfer is necessary for the Company's legitimate interest without harming the person's fundamental rights and freedoms.

Special categories of personal data, on the other hand, may be transferred with adequate measures in place, only on the basis of and limited to one of the following conditions:

the relevant person has given explicit consent,
in the case of special categories other than health and sex life, there is an express provision in the laws on the transfer of such data,
in the case of data on health and sex life, the transfer is carried out by persons under a duty of confidentiality or by authorised institutions and organisations for the health-related purposes listed in section 3.3.2.

3.4.1 Conditions for Transfer Abroad

Taking the necessary security measures and in accordance with Article 9 of the Law, our Company may send data to recipients abroad where explicit consent has been obtained.

Where one of the conditions listed in the second paragraph of Article 5 or the third paragraph of Article 6 of the Law exists, transfer abroad may also take place without seeking explicit consent, subject to the provisions of international agreements to which Türkiye is a party. In that case the transfer may only be made to countries declared by the PDP Board to provide adequate protection or, where adequate protection is lacking, to countries for which the data controllers both in Türkiye and in the foreign country have undertaken adequate protection in writing and the PDP Board has given permission.

4. Data Categories and Groups of Data Subjects

4.1 Personal Data Categories

To make it easier to see which kinds of information are involved, the personal data processed by our Company is divided into the categories below. Each row describes what the category covers and gives typical examples; the examples are illustrative and not exhaustive:

Identity	Information showing who the person is. Examples: first name and surname, Turkish ID number, marital status, parents' names, date and place of birth; copies of identity cards, driving licences and passports bearing this information; tax and social security numbers, signature.
Contact	Information that makes it possible to reach the person. Examples: address, telephone and fax numbers, e-mail and registered e-mail (KEP) addresses.
Personnel File	Information forming the basis of personnel rights. Examples: CV and job title, records of joining and leaving, pension and social security information, payrolls, asset declarations, information from disciplinary and performance appraisal procedures.
Legal Transaction	Information processed while the Company determines and pursues its receivables and rights, pays its debts and fulfils its legal obligations. Examples: powers of attorney, content of court and administrative decisions, correspondence with judicial authorities, case files.
Physical Premises Security	Records created when entering and staying in company buildings. Examples: camera footage, card access and entry/exit logs, vehicle number plates.
Finance	Documents and records showing the outcome of financial relationships with the data subject. Examples: bank account and loan information, balance sheet, financial profile, insurance and asset information.
Professional Experience	Training and competence information recorded during and after recruitment. Examples: diplomas and transcripts, courses and certificates, driving licence, foreign language level, references.
Visual and Audio Recordings	Photos, video and audio recordings obtained outside premises security, and documents containing them. Examples: photos attached to forms, recordings of video interviews and meetings.
Transaction Security	Information kept, while activities are carried out, for the technical, administrative, legal and commercial security of both the person and the Company. Examples: IP addresses, website traffic records, internet access logs, user passwords.
SPECIAL CATEGORIES OF DATA
Health Information	Data on a person's state of health. Examples: blood group, examination results, medical reports, disability information, leave taken for health reasons.
Criminal Convictions and Security Measures	Documents showing conviction and security measure decisions issued about the person, above all the criminal record.

4.2 Groups of Data Subjects

Only natural persons benefit from the protection afforded by the Policy and the Law; information belonging to legal entities falls outside this scope. The natural persons whose data we process are classified into the following groups according to the nature of their relationship with our Company. Company employees are not included in this table; a separate policy applies to them.

Job Candidate	Natural persons who have applied for a job with our company by any means, or who have submitted their CV and related information for our company's review.
Trainer	Natural persons who provide training on various subjects to our company's employees.
Service Provider	Natural persons, or the natural persons of legal entities, that are not part of the Customer, Subcontractor or Supplier groups, are independent of our company and have a business relationship with it.
Service Provider Employee	The natural-person employees of natural or legal persons that are not part of the Customer, Subcontractor or Supplier groups, are independent of our company and have a business relationship with it.
Service Provider Representative	The natural-person representatives of natural or legal persons that are not part of the Customer, Subcontractor or Supplier groups and that provide services to our company independently of it.
Customer	Natural persons such as dealers, distributors and points of sale that, under a contractual relationship, bring our company's products to the end user.
Customer Representative	The natural-person representatives of firms that purchase our company's products under a contractual relationship.
Company Shareholder Partner	Persons holding a share in our company's capital.
Company Representative	Natural persons authorised to perform legal transactions on behalf of our company.
Driver	Natural persons who drive vehicles in our company's supply or sales processes and whose personal data appears on the relevant delivery notes.
Subcontractor Employee	Identified or identifiable employees of natural or legal persons with whom our company has established a principal employer–subcontractor relationship by contract.
Carrier	Natural-person transport firms that take part in our company's supply or sales processes and whose personal data appears on the relevant delivery notes.
Supplier	Natural persons who supply inputs, raw materials or products to our company so that a product or service can be offered.
Supplier Representative	Representatives of natural or legal persons who supply inputs, raw materials or products to our company so that a product or service can be offered.
Reference and Emergency Contact Persons (Third Parties)	Natural persons who have no direct legal relationship with our company and whose data has been obtained lawfully through indirect channels.
Visitor	All natural persons who enter our company's physical sites for any purpose or who visit our websites for any purpose.

5. Collection Method and Legal Grounds

5.1 How Personal Data Is Collected

In line with the purposes described in section 6.1, our Company collects personal data wholly or partly by automated or non-automated means, in any oral, written or electronic medium. The main channels are as follows, although collection is not limited to them:

application and personnel information forms,
all kinds of documents submitted to the Company,
incoming letters and e-mails,
the switchboard system and company telephones,
ERP and payroll software, servers and other related programs,
purchase and sales invoices,
health insurance policies and medical reports,
camera systems,
employees in the Company's other departments, third parties (subcontractor firms) and the data subjects themselves.

5.2 Legal Grounds for Collection

Within the framework of Articles 5 and 6 of the Law, personal data is collected on the basis of one of the following legal grounds:

the explicit consent of the relevant person,
express provision in the laws,
the data has been disclosed to the public by its owner,
the need to process the parties' data in direct connection with the conclusion or performance of a contract,
necessity for our Company to fulfil its legal obligation,
a necessity for establishing, exercising or protecting a right,
a necessity for the Company's legitimate interest without harming the person's fundamental rights and freedoms.

6. Purposes of Processing Personal Data

6.1 Data Categories and Purposes of Processing by Group of Persons

For each group of persons defined above, the data categories processed and the purposes for which this data is processed are matched below. (A natural person may belong to only one group of persons.) For each group, the types of data processed are given first, followed by the purposes for which that data is used. The content of the categories is explained in the table in section 4.1 and the definitions of the groups in the table in section 4.2.

Job Candidate
Data categories processed: identity information, contact details, personnel file information, health data, criminal record (convictions and security measures) data, professional experience and training data
Purposes of processing: receiving, reviewing and concluding job applications, choosing suitable people from the candidate pool and placing them in jobs, handling staff assignments, planning human resources needs, conducting and supervising the company's business activities.
Subcontractor Employee
Data categories processed: identity information, contact details, personnel file information, health data, criminal record (convictions and security measures) data, transaction security data, professional experience and training data, visual and audio recordings, physical premises security records, legal transaction data
Purposes of processing: preparing for and managing emergencies, meeting the obligations towards employees that arise from employment contracts and legislation, planning and managing fringe benefits granted to employees, planning, granting and tracking annual leave, carrying out audits and ensuring compliance with the company's ethical rules, planning and delivering training, defining and managing access rights to systems and areas, keeping all of the company's activities in line with the applicable legislation, securing buildings and facilities, i.e. the physical premises, monitoring and handling legal matters, proceedings and disputes, conducting internal audits, investigations and intelligence activities, planning human resources needs, conducting and supervising the company's business activities, responding to occupational accidents and following up afterwards, carrying out occupational health and safety activities, keeping business continuity uninterrupted at all times, procedures for benefiting from employer incentives, organising events and functions, assessing employee performance, checking staff attendance, identifying and managing risks, running processes relating to subcontracting agreements, safeguarding movable assets and other resources, giving the necessary information to authorised persons, institutions and organisations.
Trainer
Data categories processed: identity information, personnel file information
Purposes of processing: planning and delivering training, keeping all of the company's activities in line with the applicable legislation, preparing, signing and tracking contracts with the other party.
Service Provider
Data categories processed: identity information, contact details, personnel file information, financial information
Purposes of processing: preparing for and managing emergencies, meeting the obligations towards employees that arise from employment contracts and legislation, carrying out audits and ensuring compliance with the company's ethical rules, planning and delivering training, keeping all of the company's activities in line with the applicable legislation, issuing invoices and handling billing, running the company's finance and accounting work, handling staff assignments, monitoring and handling legal matters, proceedings and disputes, maintaining communication activities, conducting and supervising the company's business activities, carrying out occupational health and safety activities, keeping business continuity uninterrupted at all times, running logistics and shipping activities, operating the purchasing processes for goods and services, making payments on time, identifying and managing risks, preparing, signing and tracking contracts with the other party, managing the supply chain end to end.
Service Provider Employee
Data categories processed: identity information, contact details, personnel file information
Purposes of processing: preparing for and managing emergencies, meeting the obligations towards employees that arise from employment contracts and legislation, carrying out audits and ensuring compliance with the company's ethical rules, planning and delivering training, handling staff assignments, maintaining communication activities, responding to occupational accidents and following up afterwards, carrying out occupational health and safety activities, keeping business continuity uninterrupted at all times, running logistics and shipping activities, organising events and functions, identifying and managing risks, giving the necessary information to authorised persons, institutions and organisations.
Service Provider Representative
Data categories processed: identity information, personnel file information, contact details, legal transaction data
Purposes of processing: managing the supply chain end to end, operating the purchasing processes for goods and services, running the company's finance and accounting work, keeping business continuity uninterrupted at all times, preparing, signing and tracking contracts with the other party, conducting and supervising the company's business activities, monitoring and handling legal matters, proceedings and disputes.
Customer
Data categories processed: identity information, contact details, personnel file information, financial information, legal transaction data
Purposes of processing: keeping all of the company's activities in line with the applicable legislation, running the company's finance and accounting work, preparing and submitting price quotations to customers, monitoring and handling legal matters, proceedings and disputes, maintaining communication activities, conducting and supervising the company's business activities, keeping business continuity uninterrupted at all times, handling import and export operations, running logistics and shipping activities, providing after-sales support services, operating the sales processes for goods and services, managing customer relationships, work to measure and increase customer satisfaction, preparing, signing and tracking contracts with the other party, fully meeting tax obligations, giving the necessary information to authorised persons, institutions and organisations.
Customer Representative
Data categories processed: identity information, contact details
Purposes of processing: keeping all of the company's activities in line with the applicable legislation, running the company's finance and accounting work, conducting and supervising the company's business activities, keeping business continuity uninterrupted at all times, preparing, signing and tracking contracts with the other party, operating the purchasing processes for goods and services, monitoring and handling legal matters, proceedings and disputes, managing the supply chain end to end.
Company Shareholder / Partner
Data categories processed: identity information, contact details, legal transaction data, financial information
Purposes of processing: operating the processes that keep information secure, work aimed at raising employee satisfaction and commitment to the company, supplying the information requested for employees' credit limit assessments, carrying out audits and ensuring compliance with the company's ethical rules, defining and managing access rights to systems and areas, keeping all of the company's activities in line with the applicable legislation, monitoring and handling legal matters, proceedings and disputes, conducting and supervising the company's business activities, giving the necessary information to authorised persons, institutions and organisations, carrying out company management activities.
Company Representative
Data categories processed: identity information, contact details, legal transaction data, visual and audio recordings
Purposes of processing: preparing for and managing emergencies, operating the processes that keep information secure, work aimed at raising employee satisfaction and commitment to the company, meeting the obligations towards employees that arise from employment contracts and legislation, planning and managing fringe benefits granted to employees, supplying the information requested for employees' credit limit assessments, carrying out audits and ensuring compliance with the company's ethical rules, planning and delivering training, defining and managing access rights to systems and areas, keeping all of the company's activities in line with the applicable legislation, running the company's finance and accounting work, monitoring and handling legal matters, proceedings and disputes, conducting internal audits, investigations and intelligence activities, planning human resources needs, conducting and supervising the company's business activities, responding to occupational accidents and following up afterwards, carrying out occupational health and safety activities, keeping business continuity uninterrupted at all times, organising events and functions, assessing employee performance, identifying and managing risks, preparing, signing and tracking contracts with the other party, giving the necessary information to authorised persons, institutions and organisations, carrying out company management activities.
Driver
Data categories processed: identity information, personnel file information
Purposes of processing: running the company's finance and accounting work, issuing invoices and handling billing, issuing and receiving delivery notes, monitoring and handling legal matters, proceedings and disputes, fully meeting tax obligations.
Carrier
Data categories processed: identity information
Purposes of processing: running the company's finance and accounting work, issuing invoices and handling billing, issuing and receiving delivery notes, monitoring and handling legal matters, proceedings and disputes, fully meeting tax obligations.
Supplier
Data categories processed: identity information, contact details, personnel file information, financial information, legal transaction data
Purposes of processing: keeping all of the company's activities in line with the applicable legislation, issuing invoices and handling billing, running the company's finance and accounting work, monitoring and handling legal matters, proceedings and disputes, conducting and supervising the company's business activities, keeping business continuity uninterrupted at all times, operating the purchasing processes for goods and services, making payments on time, preparing, signing and tracking contracts with the other party, collecting quotations from suppliers, managing the supply chain end to end.
Supplier Representative
Data categories processed: identity information, personnel file information, contact details, legal transaction data
Purposes of processing: keeping all of the company's activities in line with the applicable legislation, running the company's finance and accounting work, monitoring and handling legal matters, proceedings and disputes, conducting and supervising the company's business activities, keeping business continuity uninterrupted at all times, operating the purchasing processes for goods and services, preparing, signing and tracking contracts with the other party, collecting quotations from suppliers, managing the supply chain end to end.
Third Parties (Reference Person)
Data categories processed: identity information, personnel file information, contact details
Purposes of processing: choosing suitable people from the candidate pool and placing them in jobs, receiving, reviewing and concluding job applications, handling staff assignments, conducting and supervising the company's business activities, planning human resources needs.
Third Parties (Employee's Emergency Contact)
Data categories processed: identity information, contact details
Purposes of processing: preparing for and managing emergencies, meeting the obligations towards employees that arise from employment contracts and legislation, carrying out audits and ensuring compliance with the company's ethical rules, planning and delivering training, carrying out occupational health and safety activities, identifying and managing risks.
Visitor
Data categories processed: identity information, personnel file information, physical premises security records, visual and audio recordings
Purposes of processing: preparing for and managing emergencies, meeting the obligations towards employees that arise from employment contracts and legislation, carrying out audits and ensuring compliance with the company's ethical rules, keeping all of the company's activities in line with the applicable legislation, securing buildings and facilities, i.e. the physical premises, conducting and supervising the company's business activities, carrying out company management activities, carrying out occupational health and safety activities, giving the necessary information to authorised persons, institutions and organisations, keeping and monitoring visitor logs.

Data Processing Activities at Physical Premises

To ensure security in our Company's buildings and facilities, entries and exits are recorded and common areas are monitored by camera. Notices about this are displayed in areas under camera surveillance, so that everyone entering the area knows in advance that recording takes place.

Access records for the internet connection made available at our facilities are retained pursuant to Law No. 5651, which governs internet publications and the fight against crimes committed through them, and other legislation. These records may be shared with authorised public institutions and organisations on request and, where necessary, used during audits to fulfil the relevant legal obligation.

Processing Through Our Website

The traffic data of online visitors coming to our site is logged automatically by our systems to ensure information security. In addition, Law No. 5651 and related legislation require hosting providers to record and retain website traffic information. More detailed information about the data collected via the site is provided in the site's own privacy notice.

Processing in Communication Channels

Correspondence and conversations conducted by telephone (call centre), letter, e-mail and similar means are monitored and recorded by our Company in order to conduct and supervise business activities and to follow up requests and complaints. These channels should not be used for purposes outside the business relationship.

7. Purposes of Transfer and the Persons and Organisations to Which Data Is Transferred

7.1 Purposes of Transfer

Transfers are made in compliance with the conditions laid down in Articles 8 and 9 of the Law and are limited to one of the following purposes. Data is never shared merely because a recipient asks for it; there must always be a purpose on this list and a legal ground for the transfer:

preparing for and managing emergencies
operating the processes that keep information secure
choosing suitable people from the candidate pool and placing them in jobs
receiving, reviewing and concluding job applications
work aimed at raising employee satisfaction and commitment to the company
meeting the obligations towards employees that arise from employment contracts and legislation
planning and managing fringe benefits granted to employees
supplying the information requested for employees' credit limit assessments
planning, granting and tracking annual leave
carrying out audits and ensuring compliance with the company's ethical rules
planning and delivering training
defining and managing access rights to systems and areas
keeping all of the company's activities in line with the applicable legislation
monitoring and handling legal matters, proceedings and disputes
issuing invoices and handling billing
running the company's finance and accounting work
preparing and submitting price quotations to customers
securing buildings and facilities, i.e. the physical premises
handling staff assignments
conducting internal audits, investigations and intelligence activities
maintaining communication activities
planning human resources needs
issuing and receiving delivery notes
conducting and supervising the company's business activities
responding to occupational accidents and following up afterwards
carrying out occupational health and safety activities
keeping business continuity uninterrupted at all times
procedures for benefiting from employer incentives
handling import and export operations
running logistics and shipping activities
operating the purchasing processes for goods and services
providing after-sales support services
operating the sales processes for goods and services
managing customer relationships
work to measure and increase customer satisfaction
organising events and functions
making payments on time
assessing employee performance
checking staff attendance
identifying and managing risks
preparing, signing and tracking contracts with the other party
running processes relating to subcontracting agreements
safeguarding movable assets and other resources
planning and carrying out drills
collecting quotations from suppliers
managing the supply chain end to end
fully meeting tax obligations
giving the necessary information to authorised persons, institutions and organisations
carrying out company management activities

7.2 Persons and Organisations to Which Data Is Transferred

Transfers may be made to the recipients below, limited to the groups of persons and data required by the purpose of transfer. Which data is sent to which recipient is determined according to the purpose listed in section 7.1 and the relevant person's group in section 4.2:

Natural and legal persons in the private sector: banks; our customers and suppliers; certified public accountants (SMMM) and sworn financial advisers providing accounting services; our legal adviser; auditors; training firms; OSGB (occupational health and safety) consultants; an environmental consultancy firm; our software provider.
Authorised public institutions and organisations: courts and notaries; the General Directorate of Security (EGM) and the Gendarmerie; the Social Security Institution (SGK); the Ministry of Labour and Social Security and the Ministry of Health; tax offices (Tax Office Presidency); public bodies involved in incentive procedures; authorised health institutions where needed; and the relevant public bodies in the event of an inspection.

8. Destruction of Data and Retention Periods

8.1 Destruction of Personal Data

Where other laws contain special provisions on destruction, these apply. Otherwise, data for which the reason for processing has ceased to exist, even if it was processed lawfully, is deleted, destroyed or anonymised under our retention and destruction policy, either by the Company on its own initiative or upon an application by the data subject.

Deletion: the relevant users can no longer reach the data and can never use it again.
Destruction: the data is rendered such that no one can reach it by any means, recover it or reuse it.
Anonymisation: using techniques such as masking, variable removal or generalisation, the data is rendered such that it can in no way be linked to an identified or identifiable natural person, even if matched with other data.

8.2 Retention Periods

When determining the retention period, legislation is consulted first: personal data is kept for the periods laid down in the laws and related legislation. If legislation does not provide for a retention period, the data is kept, in line with our retention and destruction policy, for as long as needed to fulfil the purpose of processing; it is then deleted, destroyed or anonymised within the periodic destruction intervals.

9. Informing the Data Subject and Rights Under the Law

9.1 Informing the Relevant Person

Pursuant to Article 10 of the PDP Law, our Company informs the relevant persons when personal data is obtained. This information covers the identity of the Company's representative, if any, the purpose for which the data will be processed, to whom and for what purpose it may be transferred, the method and legal ground of collection, and the rights the relevant person has.

9.2 Cases Where the Policy and the Law Do Not Apply in Whole or in Part

The Law itself defines situations that fall wholly or partly outside its scope. Accordingly, this Policy and the provisions of the Law do not apply in the following cases:

processing of data by natural persons solely within the scope of activities relating to themselves or to family members living in the same household, provided that the data is not given to third parties and data security obligations are complied with,
processing of data within official statistics or, after anonymisation, for purposes such as research, planning and statistics,
processing carried out for artistic, historical, literary or scientific purposes or in the exercise of freedom of expression; however, such processing must not constitute a crime and must not violate privacy, personal rights, national defence and national security, public safety and public order, or economic security,
processing of data by public institutions and organisations assigned and authorised by law to ensure national defence, national security, public safety, public order or economic security, within the scope of preventive, protective and intelligence activities,
processing of data by judicial authorities or enforcement bodies in connection with investigation, prosecution, trial or enforcement proceedings.

Furthermore, in the cases below, as long as the processing is consistent and proportionate with the aims and basic principles of the Policy and the Law, Article 10 on the obligation to inform, Article 11 on the rights of the relevant person (except the right to claim compensation for damage) and Article 16 introducing the obligation to register with the registry do not apply:

processing is necessary to prevent a crime or for a criminal investigation,
processing of data that the relevant person has made public themselves,
processing is necessary so that public institutions authorised by law and professional organisations having the status of public institutions can carry out their supervisory or regulatory duties or conduct disciplinary investigations or prosecutions,
processing is necessary to protect the economic and financial interests of the State in budgetary, tax and financial matters.

9.3 Rights of the Relevant Person Under the Law

Pursuant to Article 10 of the Law, our Company informs relevant persons of their rights, shows them how they can exercise these rights and sets up the internal processes and administrative-technical arrangements required for this. Under Article 11 of the Law, everyone whose personal data is processed has the right to:

find out whether their data is being processed,
request information about it if it has been processed,
learn the purpose of processing and whether the data is used in line with that purpose,
know the third parties in Türkiye or abroad to whom their data has been transferred,
request the correction of data that has been processed incompletely or incorrectly,
request the deletion or destruction of the data when the conditions in Article 7 of the Law are met,
request that the correction, deletion or destruction operations carried out under subparagraphs (d) and (e) also be notified to the third parties to whom the data has been transferred (Law, Art. 11),
object to a result to their detriment arising from the analysis of the processed data exclusively by automated systems,
claim compensation for damage if they suffer harm because their data has been processed unlawfully.

Requests concerning the application of the Law can be submitted by filling in the application form on our website (www.general-makina.com.tr). The completed form can be handed over in person and in writing at the Company's address (Yazıbaşı Sanayi Bölgesi, Balkan Cad. 322 Sk. 29 Ekim Torbalı/İzmir/Türkiye), sent through a notary, or sent electronically to our registered e-mail (KEP) address ([email protected]) using a secure electronic signature or mobile signature.

If the relevant person has an e-mail address previously notified to our Company and registered in our system, the application can also be sent from that address to [email protected].

The following information must be included in the application:

first name, surname and, for written applications, signature,
if you are a Turkish citizen, your Turkish ID number; if you are a foreign national, your nationality together with your passport number or, if available, your identity number,
the residential or business address to be used for notifications,
if available, the e-mail address, telephone and fax number to be used for notifications,
the subject of the request.

Information and documents relating to the matter should also be attached to the application. Complete information makes it easier to verify who the application belongs to and to conclude the request without delay.

Applications are answered as quickly as possible depending on the nature of the request and in any case within thirty days, free of charge. If the procedure entails an additional cost, a fee may be charged according to the tariff set by the Board.

The request may be accepted or rejected with reasons; the outcome is communicated to the applicant in writing or electronically. If the request is accepted, the necessary action is taken as soon as possible and the relevant person is informed. If the application arose from our Company's error, the fee charged is refunded to the relevant person.

If the application is rejected, the reply is considered insufficient or no reply is given within the time limit, the relevant person may lodge a complaint with the Board within thirty days of learning of the reply; in any case this period cannot exceed sixty days after the date on which the application was made.