GAZIMETAL ONLINE

Corporate

KVKK POLICY

 

GAZİ METAL SAN. VE TİC. A.Ş.

PERSONAL DATA PROTECTION AND PROCESSING POLICY

 

 

Document No.: 122.8
Issue Date: 2019
Revision No.: 1
Revision Date: 01.08.2026
Prepared by: Gazi Metal Personal Data Protection Committee
Approved by: Chairman of the Board of Directors of Gazi Metal

Table of Contents

SECTION 1 – INTRODUCTION

SECTION 2 – MATTERS CONCERNING THE PROTECTION OF PERSONAL DATA

SECTION 3 – MATTERS CONCERNING THE PROCESSING OF PERSONAL DATA

SECTION 4 – CATEGORIZATION AND PURPOSES OF PROCESSING OF PERSONAL DATA PROCESSED BY OUR COMPANY

SECTION 5 – RETENTION AND DISPOSAL OF PERSONAL DATA

SECTION 6 – RIGHTS OF DATA SUBJECTS AND THE EXERCISE OF THESE RIGHTS

SECTION 7 – SPECIFIC CIRCUMSTANCES IN WHICH PERSONAL DATA IS PROCESSED

SECTION 1 – INTRODUCTION

1.1 Introduction

The protection of personal data is among the highest priorities of Gazi Metal Anonim Şirketi (“Gazi Metal” or the “Company”), which strives to comply with all applicable legislation in this regard. This Gazi Metal Anonim Şirketi Personal Data Protection and Processing Policy (the “Policy”) explains the principles adopted in carrying out the personal data processing activities performed by our Company and the fundamental principles adopted to ensure that our Company’s data processing activities comply with the provisions of Turkish Personal Data Protection Law No. 6698 (the “Law”). In this way, our Company ensures the necessary transparency by informing data subjects. Fully aware of our responsibility in this regard, we process and protect your personal data within the scope of this Policy.

1.2 Scope

This Policy applies to all personal data belonging to our customers, prospective customers, job applicants, Company shareholders, Company officers, visitors, employees, shareholders and officers of institutions with which we cooperate, and third parties, where such data is processed by automated means or by non-automated means as part of a data filing system.

This Policy also covers personal data processing activities conducted within the scope of the IK Mobil and GM Stok mobile applications developed on behalf of Gazi Metal Mamulleri Sanayi ve Ticaret Anonim Şirketi by Atıf Zafrak, an employee of the Information Technology Department, and made available exclusively for use by Gazi Metal employees.

1.3 Implementation of the Policy and Applicable Legislation

The applicable statutory provisions governing the processing and protection of personal data shall take precedence. In the event of any inconsistency between the applicable legislation and the Policy, our Company acknowledges that the applicable legislation shall prevail. The Policy sets out the rules established by the applicable legislation in the context of Gazi Metal A.Ş. practices.

1.4 Effective Date of the Policy

This Policy entered into force on 18.12.2019 and is updated in line with legislative amendments and the Company’s internal processes.

This Policy is published under the data protection section of Gazi Metal’s website at https://www.gazimetal.com.tr/en/corporate/legal-notice/ and is made available to data subjects upon request.

SECTION 2 – MATTERS CONCERNING THE PROTECTION OF PERSONAL DATA

2.1 Ensuring the Security of Personal Data

In accordance with Article 12 of the Law and the guidelines published by the Turkish Personal Data Protection Authority, our Company takes the necessary administrative and technical measures appropriate to the nature of the data concerned in order to prevent the unlawful processing, disclosure, access or transfer of personal data, or any other security breaches that may occur.

2.2 Protection of Special Categories of Personal Data

The Law accords particular importance to certain personal data due to the risk that its unlawful processing may cause individuals to suffer harm or discrimination. Such data comprises data relating to race, ethnic origin, political opinion, philosophical belief, religion, religious sect or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Gazi Metal exercises the utmost care in protecting personal data designated as “special categories” under the Law. In this context, Gazi Metal fully complies with the decisions of the Turkish Personal Data Protection Board and the applicable legislation concerning the adequate measures to be taken by data controllers when processing special categories of personal data; the necessary technical and administrative measures are implemented with due care, and the necessary audits are conducted within the Company. Detailed information on the processing of special categories of personal data is provided in Section 3.3 of this Policy.

Detailed information on the processing of special categories of personal data is provided in Section 3.3 (“Processing of Special Categories of Personal Data”) of this Policy.

2.3 Raising Awareness and Conducting Audits of Business Units Regarding the Protection and Processing of Personal Data

Gazi Metal A.Ş. arranges the necessary training for its business units to raise awareness of measures intended to prevent the unlawful processing of and unlawful access to personal data and to ensure the secure retention of personal data.

The necessary systems are established to raise awareness among Gazi Metal A.Ş. employees regarding the protection of personal data, and consultants are engaged where necessary. Accordingly, our Company evaluates participation in relevant training programs, seminars and information sessions and updates and renews its training activities in parallel with amendments to the applicable legislation.

SECTION 3 – MATTERS CONCERNING THE PROCESSING OF PERSONAL DATA

3.1 Processing of Personal Data in Accordance with the Principles Prescribed by Legislation

3.1.1 Processing Lawfully and Fairly

When processing personal data, Gazi Metal A.Ş. acts in accordance with the principles established by law and the general principles of trust and good faith. Within this framework, personal data is processed only to the extent required by and limited to our Company’s business activities.

3.1.2 Ensuring That Personal Data Is Accurate and, Where Necessary, Kept Up to Date

Gazi Metal A.Ş. takes the necessary measures to ensure that personal data remains accurate and up to date throughout the period in which it is processed and establishes the necessary mechanisms to verify the accuracy and currency of personal data at regular intervals.

3.1.3 Processing for Specified, Explicit and Legitimate Purposes

Gazi Metal A.Ş. clearly identifies the purposes for which personal data is processed and processes such data for purposes connected with its business activities.

3.1.4 Being Relevant, Limited and Proportionate to the Purposes for Which Data Is Processed

Gazi Metal collects personal data only to the extent and of the nature required by its business activities and processes it solely for the specified purposes.

3.1.5 Retaining Personal Data for the Period Prescribed by Applicable Legislation or Required for the Purpose for Which It Is Processed

Gazi Metal retains personal data for the period required for the purpose for which it is processed and for at least the minimum period prescribed by the legislation applicable to the relevant activity. In this context, our Company first determines whether the applicable legislation stipulates a retention period for personal data and, where such a period has been specified, complies with it. Where no statutory period exists, personal data is retained for the period required for the purpose for which it is processed. At the end of the specified retention periods, personal data is disposed of in accordance with the periodic disposal periods or an application by the data subject, using the designated disposal methods (erasure and/or destruction and/or anonymization).

3.2 Conditions for Processing Personal Data

Except where the data subject has provided explicit consent, a personal data processing activity may be based on one or more of the conditions set out below. Where the data processed falls within a special category of personal data, the conditions specified in Section 3.3 of this Policy (“Processing of Special Categories of Personal Data”) shall apply.

3.2.1. The Data Subject’s Explicit Consent
3.2.2. Expressly Provided for by Law
3.2.3. Due to Actual Impossibility...
3.2.4. Establishment of a Contract...
3.2.5. The Company’s Legal Obligation...
3.2.6. The Data Subject Making Personal Data Public
3.2.7. Establishment of a Right...
3.2.8. Our Company’s Legitimate Interest...

3.3 Processing of Special Categories of Personal Data

As a general rule, special categories of personal data may not be processed without explicit consent. However, such data may also be processed without explicit consent where at least one of the following conditions applies:

 

  • The data subject has provided explicit consent,
  • It is expressly provided for by law,
  • It is necessary to protect the life or physical integrity of the data subject or another person where the data subject is unable to express consent due to actual impossibility or where the data subject’s consent is not legally valid,
  • It relates to personal data made public by the data subject and is consistent with the data subject’s intention in making it public,
  • It is necessary for the establishment, exercise or protection of a right,
  • It is processed by persons subject to a duty of confidentiality or by authorized institutions and organizations for the purposes of protecting public health; preventive medicine; medical diagnosis; treatment and care services; and the planning and management of healthcare services and their financing,
  • It is necessary for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security or social assistance,
  • It is processed by foundations, associations or other non-profit organizations or entities established for political, philosophical, religious or trade-union purposes, in accordance with their statutes and purposes, in relation to their current or former members and affiliates or persons who are in regular contact with such organizations, provided that the data is not disclosed to third parties.

When processing special categories of personal data, the adequate measures specified by the Turkish Personal Data Protection Board must be implemented.

 

3.4 Informing the Data Subject

Gazi Metal A.Ş. informs data subjects in accordance with Article 10 and the other provisions of the Law.

3.5 Processing of Personal Data by the Company

Personal data is processed to ensure that the activities of Gazi Metal A.Ş. are conducted in accordance with its principles, objectives and strategies and to protect its rights, interests and reputation.

3.6 Transfer of Personal Data

Our Company may transfer a data subject’s personal data and special categories of personal data to third parties (third-party companies, public and private authorities, and third-party natural persons) by taking the necessary security measures in accordance with its lawful personal data processing purposes.

3.6.1 Domestic Transfer of Personal Data

Our Company may transfer personal data and special categories of personal data to third parties in accordance with Article 8 of the Law, provided that at least one of the processing conditions specified in Sections 3.2 and 3.3 above is met.

3.6.2 Cross-Border Transfer of Personal Data

The procedure for transferring personal data abroad has been restructured in accordance with the amendments introduced by Law No. 7499. Our Company may transfer personal data abroad only where one of the following mechanisms is available:

3.6.2.1. Adequacy Decision: The Turkish Personal Data Protection Board has issued an adequacy decision concerning the country to which the transfer will be made, specific sectors within that country, or international organizations.

3.6.2.2. Appropriate Safeguards: In the absence of an adequacy decision, provided that at least one of the conditions set out in Articles 5 and 6 of the Law is met and the data subject has the opportunity to exercise their rights and seek effective legal remedies in the country to which the transfer will be made, one of the following appropriate safeguards must be provided:

  • An agreement that is not in the nature of an international treaty, entered into with public institutions and organizations or international organizations abroad, together with the authorization of the Turkish Personal Data Protection Board,
  • Approval of binding corporate rules (BCRs) by the Turkish Personal Data Protection Board,
  • Execution of the standard contract (Standard Contractual Clauses) published by the Turkish Personal Data Protection Board and notification thereof to the Turkish Personal Data Protection Authority within five business days,
  • Provision of a written undertaking ensuring adequate protection and obtaining the authorization of the Turkish Personal Data Protection Board.

3.6.2.3. Occasional Transfers (Exceptional Transfers): Where no adequacy decision exists and appropriate safeguards cannot be provided, a transfer may be made only where one of the occasional or exceptional circumstances specified in the Law applies, such as the data subject providing explicit consent, the transfer being necessary for the performance of a contract, an overriding public interest, or the establishment of a right.

SECTION 4 – CATEGORIZATION AND PURPOSES OF PROCESSING OF PERSONAL DATA PROCESSED BY OUR COMPANY

Within our Company, personal data is processed after data subjects have been informed in accordance with Article 10 of the Law and secondary legislation, solely for our Company’s personal data processing purposes and on the basis of at least one of the personal data processing conditions set out in Articles 5 and 6 of the Law.

SECTION 5 – RETENTION AND DISPOSAL OF PERSONAL DATA

Our Company retains personal data for the period required for the purpose for which it is processed and in accordance with the minimum periods prescribed by the legislation applicable to the relevant activity. Periodic disposal processes are conducted in accordance with the Retention and Disposal Policy prepared pursuant to the Regulation on the Erasure, Destruction or Anonymization of Personal Data.

SECTION 6 – RIGHTS OF DATA SUBJECTS AND THE EXERCISE OF THESE RIGHTS

6.1 Rights of the Data Subject

Pursuant to Article 11 of the Law, data subjects have the following rights:

6.1.1. To learn whether their personal data is being processed,
6.1.2. To request information if their personal data has been processed,
6.1.3. To learn the purpose for which their personal data is processed and whether it is used in accordance with that purpose,
6.1.4. To know the third parties to whom their personal data has been transferred in Türkiye or abroad,
6.1.5. To request the rectification of personal data that has been incompletely or inaccurately processed and to request that the action taken in this regard be communicated to the third parties to whom the personal data has been transferred,
6.1.6. To request the erasure or destruction of personal data where the reasons requiring its processing no longer exist, even though it has been processed in accordance with the Law and other applicable laws, and to request that the action taken in this regard be communicated to the third parties to whom the personal data has been transferred,
6.1.7. To object to any result arising to their detriment through the analysis of processed data exclusively by automated systems,
6.1.8. To claim compensation for damages incurred as a result of the unlawful processing of personal data.

6.2 Exercise of the Data Subject’s Rights

Data subjects may submit requests concerning their rights to our Company in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller (in writing, via a registered electronic mail (KEP) address, secure electronic signature, mobile signature, or the e-mail address registered in our Company’s system).

6.3 Our Company’s Response to Applications

Our Company shall conclude the relevant request as soon as possible and no later than 30 (thirty) days, depending on the nature of the request.

Where responding to an application entails an additional cost, the fee specified in the tariff determined by the Turkish Personal Data Protection Board may be charged. If the data subject’s application is rejected, the response is found to be inadequate, or no response is provided within the prescribed period, the data subject may lodge a complaint with the Turkish Personal Data Protection Board within 30 days of learning of the response and, in any event, within 60 days of the application date. Furthermore, pursuant to Law No. 7499, as of 1 June 2024, applications against administrative fines must be filed with administrative courts rather than criminal judgeships of peace.

SECTION 7 – SPECIFIC CIRCUMSTANCES IN WHICH PERSONAL DATA IS PROCESSED

7.1 Personal Data Processing Activities at Building and Facility Entrances and Within Buildings and Facilities, and Website Visitors

For security purposes, Gazi Metal conducts personal data processing activities at its facilities through security camera surveillance and the monitoring of guest entries and exits.

7.2 Camera Surveillance Activities Conducted at and Within Gazi Metal A.Ş. Buildings and Facilities

For the purpose of ensuring security at its buildings and facilities, Gazi Metal A.Ş. conducts camera surveillance activities in accordance with Law No. 5188 on Private Security Services and the applicable legislation. Access to live footage and digital recordings is restricted to a limited number of authorized personnel.

 

7.3 Monitoring of Guest Entries and Exits at and Within Gazi Metal A.Ş. Buildings and Facilities

 

Gazi Metal A.Ş. conducts personal data processing activities to monitor guest entries and exits at its facilities for security purposes and for the purposes specified in this Policy.

When the names and surnames of individuals visiting Gazi Metal A.Ş. buildings as guests are collected, the relevant data subjects are informed through notices displayed at Gazi Metal A.Ş. premises or otherwise made available to guests. Data collected for the purpose of monitoring guest entries and exits is processed solely for this purpose, and the relevant personal data is recorded in a data filing system maintained in a physical environment.

 

 

Introduction
Film