Policy of Confidentiality
FOREWORD
The subject of protection of personal data is of great importance for Altınyağ Madencilik ve Enerji Yatırımları San. ve Tic. A.Ş. We retain the personal data of all persons who have contacted us in some way and shared any of his/her personal information with us with utmost care. We have already put in place all necessary administrative and technical measures to ensure the security of such data. Therefore, knowing that your data are secure at ALTINYAĞ brand, you may do your transactions with confidence. We shall respect your rights guaranteed by the constitution of Republic of Turkey and the relevant laws and regulations. We now wish to share with you our corporate confidentiality policy which we have prepared with confidence and awareness and in line with the universal principles of "openness" and "accountability" for the security of personal data. Please rest assured that we shall treat your proposals for improvement, your applications and complaints with care. You may apply to us for any doubts you may have about your personal data. We shall show the same care that we show in providing all our services, for the protection of your personal data.
Respectfully Yours,
Altınyağ Madencilik ve Enerji Yatırımları San. ve Tic. A.Ş.
PURPOSE
Until now, the personal data that we As ALTINYAĞ Madencilik ve Enerji Yatırımları San. ve Tic. A.Ş. (Hereinafter ‘’ALTINYAĞ ’’) have collected have been kept confidential, in consideration of the sensitive nature of our business and have never been shared with third parties, except for legitimate purposes. The protection of personal data is the basic policy of our company. Even before the current legislation were adopted, our company attached great importance to the confidentiality of personal data and applied it as a business principle. We, as ALTINYAĞ ,undertake to fulfill all the obligations that are brought by the law on the protection of personal data, as well.
1. Scope and amendment
This policy statement of our company has been prepared in accordance with law no:6698 on the protection of personal data (‘’KVK ’’). This law with all its’ provisions has entered into force as of today. The data that we have obtained with your consent or through other lawful means shall be used for the purpose of raising the quality of our services and improving our quality assurance policy.
Some of the data that we have are being converted to impersonal data and thus being anonymized. These data are used for statistical computations and as such are not subject to the provisions of the relevant law or our confidentiality policy.
ALTINYAĞ confidentiality policy aims to protect the personal data obtained through automatic means belonging to our clients, potential clients, employees and the clients and employees of the firms collaborating with us as solution partners and other third persons and covers the measures and rules for that end.
Our company reserves the right to amend our policy and personal data protection rules, provided that the amendments are in line with laws and result in better protection of personal data.
2. Basic rules governing personal data processing
a) Lawfulness and conformity with rules of bona fides: ALTINYAĞ questions the sources of the personal data that it collects or receives from other firmsand attaches importance to the collection of such data in compliance with the legislation and rules of bona fides.
b) Accuracy and being up to date, where necessary: ALTINYAĞ considers it important that all the data it processes are correct, not contain incorrect information and makes sure that when it is informed about changes, the data files are duly updated.
c)Processing for specific, explicit and legitimate purposes: ALTINYAĞ processes the personal data that it obtains while providing services only for purposes for which it obtains data subjects’ consent. It does not process, use or let be used the personal data for purposes other than the conduct of its’ business.
d)Being relevant with, limited to and proportionate to the purpose of processing: ALTINYAĞ uses the data only for the purpose of processing and only to the extent provision of service requires.
e) Being retained for the period of time stipulated by relevant legislation or needed for achieving the purpose of processing: ALTINYAĞ retains personal data obtained through business contracts for as long as necessary to cover the legal deadlines for disputes, or as required by legislation governing commerce and taxation. when these legal reasons cease to exist, it either anonymizes or destructs the concerned personal data. It erases or anonymizes the concerned data by following the directive for erasure of personal data. Let us emphasize that the principles listed
above shall apply to the processing of personal data regardless of whether the data were obtained with explicit consent or through other lawful means.
3. The rights of data-subject as listed in article 11 of KVK law
As per article 11 of KVK law, you have the rights explained below. in order to make it easier for you to exercise your rights, an application form has been designed by ALTINYAĞ and offered in our internet website. The persons who have their personal data being processed by us may apply to the person named byALTINYAĞ in our website and exercise their rights concerning their personal data:
a* to learn whether or not his/her personal data are processed
b* to request information on data if his/her personal data are processed
c* to learn the purpose of data processing and whether his/her data are used for the intended purposes
d* to know the third persons in Turkey or abroad to whom his/her personal data are transferred
e* to request correction of the incomplete or inaccurate data, if any, and demand that the third parties to whom his/her personal data are transferred be notified accordingly
f* under the conditions stipulated in article 7 of KVK law, to request erasure or destruction of his/her personal
data when the legal reasons for the processing of the data no longer exist , even though the data were originally collected and processed in conformity to the provisions of KVK law and other relevant laws and to request that the third parties to whom his/her data are transferred be notified accordingly
g* to object to the processing of his/her personal data exclusively by automatic means which has an unfavorable
impact on him/her
h* to request compensation for the damage arising from unlawful processing of his/her personal data, if any.
We as ALTINYAĞ recognize these rights.
4. Principle of maximizing savings
In accordancewith our principle called as maximizing savings or stinginess, the data that reach ALTINYAĞ are processed only to the extent that is necessary. Therefore, we decide on what sort of data we collect on the basis of purpose. Unneeded data are not collected.Other data that come to our company are sent to our information technology systems. Unneeded data are not recorded in the system and are either destroyed or anonymized.
5. Erasure of personal data
Upon expiry of the of legally required retention periodsor closing of judicial processes or when other requirements for data retention no longer exist, the concerned personal data are deleted or destroyed or anonymized either automatically or upon application by data subject.
6. Data being accurate and up-to-date
As a rule, the data that come to ALTINYAĞ are processed as stated in the declarations by data subjects. ALTINYAĞ is not under obligation to investigate the accuracy of the data declared by our clients or the persons who come into contact with ALTINYAĞ and doing so would be not legitimate and be against our principles. The information given in declarations are deemed to be accurate. ALTINYAĞ adheres to the principles of personal data being accurate and up to date. Our company updates the personal data in its’ files based on official documents received or upon request of the concerned data subject. All necessary measures for this purpose are taken.
7. Confidentiality and data security
Personal data are private and confidential and ALTINYAĞ respects this confidentiality. Only authorized employees may reach the personal data files in the company. All technical and administrative measures are taken to ensure that the personal data obtained by ALTINYAĞ are protected, not accessed by unauthorized persons and the data subjectsdo not suffer grievances.In this regard, we keep our software up to date, take care in selecting the third persons and ensure that the confidentiality rules are strictly followed in the company.We demand from the firms with whom we legitimately share personal data to also adhere to the data protection rules.
8. Purpose of data processing
All personal data shall be processed for the purposes stated in ALTINYAĞ ’s processing of personal data public disclosure text.
9. Personal data of clients, potential clients and business and solution partners
a*Collection and processing of personal data within the framework of business contract.
If there is a contractual relationship with clients or potential clients, the personal data acquired in the process may be used without obtaining explicit consent from them. But such usage is limited to the purpose of the contract in question. The personal data are used only to the extent better execution of the contract and providing services require and such data are updated when necessary, by contacting clients. b*Personal data belonging to business and solution partners
It is ALTIYAĞ’s guiding principle to act within the law in sharing personal data with business partners and solution partners. we share personal data only with commitments from business and solution partners for confidentiality and only to the extent service requires and these partners are definitely asked to take all necessary measures for data protection.
10. Data processing for advertising purposes
As per the provisions of the law on regulation of e-commerce and the directive on commercial communication and commercial electronic communication, electronic messages for the purpose of advertising may be sent only to those persons from whom explicit content is received in advance. The presence of the explicit consent of the person to whom advertising messages are sent is absolutely required.
ALTINYAĞ also complies with the details (letter) of the format of ‘consent’ as described in the relevant legislation.The ‘consent’ to be obtained must cover all commercial electronic messages sent by the company to the e-mail addresses of clients for the purposes of introducingour goods and services, marketing, informing about the facilities of the company and increasingrecognition of the company with messages of celebration and good wish. This consent may be obtained in the form of a written document or as message sent in any kind of electronic communication. What is important is that the consent text contains a statement whereby the client agrees to receive such commercial electronic messages, the name and family name and e-mail address.
11. Legal obligations of the company and
data processing activities performed as clearly required by laws
Personal data may be processed without obtaining consent if clearly provided for by the relevant legislation or for the purpose of fulfilling a legal obligation stipulated by the relevant legislation. The nature and scope of such data processing must be justified by being necessary for the performance of the legally permitted data processing and conform to the relevant provisions of the concerned legislation.
12. Data processing by the company
Personal data may be processed by the company for providing services and achieving its’ legitimate goals. But these data may never be used for illegal services.
13. Processing of personal data of specialnature
ALTINYAĞ takes all necessary measures required by the board in processing personal data of special nature. Our company processes the personal data of special nature in accordance with ‘’policy on protection and processing of personal data of special nature’’.
14. Data processed by automatic systems
Regarding the personal data processed by automatic means, ALTINYAĞ complies with the provisions of the relevant laws. Without the consent of the data subject, the information derived from such personal data may not be used against such persons. But ALTINYAĞ may make decisions about the persons with whom it will deal, based on the data existing in its’ own system.
15. User information and internet
When personal data are collected through web sites belonging to ALTINYAĞ and other systems and applications, and then processed and used, the concerned persons are notified with our public disclosure and if necessary, with information about the cookies used. Data subjects are given information about our applications in internet websites. All personal data are processed in conformity to the laws and regulations.
16. Personal data of our employees
a* Processing of data for working relationship
The personal data of our employees may be processed without obtaining consent to the extent required for working relationship and health insurance. However, ALTINYAĞ keeps confidential and protects the personal data of its’ employees.
b*Processing being legally required
ALTINYAĞ may process the personal data of its’ employees without consent when such processing is clearly provided for by the relevant legislation or is necessary for the performance of the legal obligations stipulated in the relevant legislation. Such processing is limited in scope to the legal obligations arising from the relevant legislation.
c* Processing for the benefit of employees
ALTINYAĞ may process the personal data of its’ employees without obtaining consent for things that benefit its’ employees such as private health insurance. ALTINYAĞ may process personal data of employees also for disputes arising from working relationship.
d*Processing of personal data of special nature
According to the law, information on data subjects’ race, ethnic background, political views, philosophical beliefs, religion, sect or other beliefs, dressing, membership to associations, foundations or labor unions, health
status, sexual life, criminal records, security files and also biometric and genetic data are personal data of special nature. ALTINYAĞ in processing personal data of special nature, in addition to obtaining explicit consent of the data subject, takes other necessary measures stipulated by the board. Personal data of special nature may be processed without consent of the concerned person only in the cases and to the extent stipulated in the law.
e* Data processing by automatic systems
Those personal data of our employees that are collected by automatic means,may be used for promotions and performance evaluations. Our employees have the right to object to the unfavorable findings and may exercise their right by following the company’s internal procedures. The objections of the employees are also considered in the company.
f* Telecommunication and internet
The computers, phones, e-mail addresses and other applications given to the employees by the company are to be used for work only. Employee may not use any of these for his/her own affairs and communication. The company may control and inspect all the data on these gadgets. Employee agrees and undertakes not to have any personal data or information, not related to work, on the computer, phone and other instruments assigned to him/her, from the first day at work onward.
17. Transfer of personal data in Turkey or cross-border
ALTINYAĞ may share the personal data it keeps with the major shareholder and business and solution partners, in order to be able to provide its’ services. ALTINYAĞ may transfer personal data to its’ suppliers, limited to the purposeof receiving the foreign-origin services it needs in order to carry out its’ commercial activities.ALTINYAĞ has the right to transfer personal data to third parties in Turkey or abroad, under the conditions set by the board and in compliance to the other provisions of the law, provided that the data subject gives consent.
18. Rights of data subject
ALTINYAĞ recognizes the data subject’s rights to require his/her consent to be obtained before his/her personal data is collected and to control the destiny of his/her personal data after processing. Data subjects may apply to the authorized person named by ALTINYAĞ in our website and exercise their rights:
a* to learn whether or not his/her personal data are processed,
b* to request data information in case his/her personal data are processed,
c* to learn the purpose of his/her data processing and whether the data is used for the intended purposes, ç* to know the third parties in Turkey or abroad to whom his/her personal data are transferred,
d* to request correction of personal data records in case of incompleteness or inaccuracy,
e* under the conditions listed in article 7 above, to request erasure or destruction of personal data, f* to request that the third parties to whom such data are transferred be notified about the actions taken according to the paragraphs d. and e.,
g* to object to the processing of his/her personal data exclusively by automatic means
which leads to an unfavorable consequence for him/her,
ğ* to demand compensation in case unlawful processing of his/her personal data causes suffering of damages.
On the other hand, data subjects have no right over the personal data anonymized in the company. ALTINYAĞ may share personal data, required for business and contract relationships, in order to comply with a judicial or a government body’s order exercising their authority, with such organizations and establishments. Data subjects may lodge their requests for their rights listed above by filling out the application form made available in the official web site of the company in full and sign, attach a photocopy of identification document (for Turkish identity cards, photocopy of only front side) and send it to the company by registered mail. Your application shall be replied in the shortest possible time depending on the nature of request, but within 30 days from the date your letter reaches us, at the latest. iIt is necessary that you apply with registered mail.Also, only that the part of your requests about yourself will be treated and applications for your spouse, relative or friend will not be accepted. ALTINYAĞ may demand additional information and documents in relation to applications.
19. Principle of confidentiality
The personal data of our employees and other persons processed in ALTINYAĞ are kept confidential. Nobody may use, copy, duplicate, transfer to third parties, use for non-business these data for any purpose other than being provided for by contracts or laws.
20. Process security
All necessary technical and administrative measures are taken for protecting the personal data collected by ALTINYAĞ , for preventing access by unauthorized persons and for keeping our clients and potential clients safe from grievance. In this context, we make sure that software programs are up to standards, third parties are carefully selected and rules of confidentiality are strictly enforced in the company. The (data) security measures are being continuously renewed and developed.
21. Inspection
ALTINYAĞ arranges for internal and external inspections to ensure personal data security.
22. Notification of breaches
When ALTINYAĞ is informed about any personal data breach, it acts with the knowledge that this incident needs to be reported to personal data protection board without delay, within 72 hours from time of notification at the latest. The company minimizes damage and compensates the data subject in question. When personal data are accessed by unauthorized persons from outside, the company promptly reports it to personal data protection board. You may lodge applications concerning data breaches following the procedure explained in our corporate internet website. Please click for application and information request form.