Personal Data Protection Law
Text Details: KRC Barrier Automation Policy under the Law on the Protection of Personal Data
Target Audience: All natural persons whose personal data is processed by KRC Barrier Automation.
SECTION ONE
KRC Barrier Automation (hereinafter referred to as KRC) aims to inform all natural and legal persons whose personal data is processed by our Company, primarily Company Partners, Company Officials, Our Employees, Job Applicants and Third Parties, about the Law No. 6698 on the Protection of Personal Data ("the Law"), all administrative, technical and managerial measures we have taken regarding the processing and protection of personal data, to ensure the full compliance of our Company with the relevant legislation and to protect all the rights of personal data owners arising from the legislation regarding personal data.
PART TWO
PROTECTION, PROCESSING AND TRANSFER OF PERSONAL DATA
Personal data is protected, processed and transferred by KRC in accordance with the procedures and principles specified in the Law on the Protection of Personal Data and other relevant legislation.
Processing of Personal Data
General Principles
KRC acts in accordance with the law and principles of honesty in the processing of personal data while conducting its commercial activities.
KRC ensures that the personal data it processes is accurate and up-to-date.
KRC processes personal data for specific, explicit and legitimate purposes.
KRC acts in a manner that is relevant to the purpose, limited and proportionate when processing personal data.
KRC complies with the retention periods stipulated in the relevant legislation for the data. It retains personal data only for the period necessary for the purpose for which it was processed. At the end of this period, it securely deletes and/or destroys the relevant personal data. Conditions for Processing Personal Data
KRC takes the necessary care to obtain the explicit consent of the data subject regarding personal data. In some cases, as stated in the Law and as indicated below, the relevant data is processed by the data controller without obtaining the explicit consent of the data subject.
Explicitly provided for in the laws
It is necessary for the protection of the life or physical integrity of the person who is unable to express their consent due to factual impossibility or whose consent is not legally valid, or for the protection of the life or physical integrity of another person. For example, sharing personal information when the data subject is unconscious and requires emergency medical intervention.
It is necessary to process the personal data of the parties to a contract, provided that it is directly related to the establishment or performance of the contract. For example, sharing the notification addresses or bank information of the parties.
It is necessary for the data controller to fulfill its legal obligations. For example, sharing the birth certificate with relevant institutions for the processing of AGİ (Acceptable Income Tax).
The data has been made public by the data subject themselves. If the data subject has already disclosed their own data to the public, there is no longer a legal interest to be protected. The processing of data is necessary for the establishment, exercise, or protection of a right. For example, the use of certain personal data as evidence in a lawsuit filed against our company by one of its own employees.
The processing of data is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
Conditions for Processing Special Categories of Personal Data
KRC processes personal data related to health, criminal convictions, security measures, and other special categories of personal data with the explicit consent of the data subject.
Special categories of personal data other than health and sexual life may be processed without the explicit consent of the data subject in cases stipulated by law.
Special categories of personal data relating to health and sexual life may only be processed without the explicit consent of the data subject by persons or authorized institutions and organizations under an obligation of confidentiality for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and planning and management of health services and their financing. Deletion, Destruction, or Anonymization of Personal Data
KRC deletes, destroys, or anonymizes personal data automatically or upon the request of the data subject when the reasons requiring processing cease to exist, even though the data has been processed in accordance with the Law and other relevant legal provisions.
Personal data is deleted and destroyed in a way that makes it impossible to reuse or recover it. Accordingly, data is deleted from the documents, files, CDs, floppy disks, hard disks, etc., on which it is recorded in a way that prevents its recovery. Conditions for Transferring Personal Data Domestically/Internationally
Personal data is transferred domestically/internationally with the explicit consent of the data subject to the extent permitted by the Law and other relevant legislation during the conduct of operational activities (exceptionally, as stipulated in the Law and other legislation).
(Subject to the provisions of the law).
KRC acts in accordance with the regulations stipulated in the Law during the transfer of personal data.
SECTION THREE
INFORMING THE DATA SUBJECT, THE RIGHTS OF THE DATA SUBJECT UNDER THE DATA PROTECTION LAW AND KRC'S OBLIGATIONS
Obligation to Inform the Data Subject
KRC explains the purpose for which personal data is processed, to whom and for what purpose the processed personal data is transferred, the method and legal basis of collecting personal data. It also fulfills its obligation to inform the data subject about their rights.
Rights of the Data Subject Under the Data Protection Law
The data subject has the following rights:
Data subjects have the right to:
Learn whether their personal data is being processed,
Request information regarding processing if it is being processed,
Learn the purpose of processing and whether it is being used in accordance with its purpose,
Know the third parties to whom it is transferred domestically or internationally,
Request correction of incomplete or inaccurate data,
Request its deletion or destruction,
Request notification to third parties to whom personal data has been transferred,
Request compensation for damages incurred due to the unlawful processing of personal data.
KRC informs personal data subjects of their rights; provides guidance on how to exercise these rights; and implements the necessary internal procedures, administrative and technical arrangements for all of these.
Method to be Followed by the Data Subject When Exercising Their Rights
The data subject may submit their requests regarding the application of the Law to KRC in writing with an application form, or with a secure electronic signature, or by sending it to the address specified in the application form using other methods determined by the Personal Data Protection Board ("Board"). KRC processes the requests included in the application as soon as possible, and no later than thirty days, in accordance with the principles stipulated by the Law, depending on the nature of the request. KRC has the right to accept or reject the request in the application, explaining the reasons; it notifies the relevant person of its response in writing or electronically. If the request in the application is accepted, KRC takes the necessary action in line with the data owner's request. In cases where the application is rejected, the response is deemed insufficient, or no response is given to the application within the specified time; the data owner has the right to file a complaint with the Board within thirty days from the date they learn of the response and in any case within sixty days from the date of the application. Obligation to Ensure Data Security
KRC takes the necessary technical and administrative measures to prevent the unlawful processing of personal data, to prevent unlawful access to data, and to ensure its preservation. Obligation to Register with the Data Controllers Registry
KRC, in its capacity as data controller, will register with the Data Controllers Registry. CHAPTER FOUR
STORAGE, DELETION, DESTRUCTION, AND ANONYMIZATION OF PERSONAL DATA
Measures Taken by KRC
KRC retains the personal data it processes for the period stipulated in the Law and regulations or required by its purpose. Depending on the nature of the personal data, a different retention period may apply, as stipulated in the relevant legislation or as required for the purpose for which they are processed.
A data may be processed for more than one purpose, and in such a case, when all the reasons that caused the processing of the data cease to exist, the data is deleted, destroyed, or anonymized and retained.
Personal data processed in accordance with the Law is deleted, destroyed, or anonymized in such a way that it cannot be used or recovered in any way, either automatically or upon the request of the data subject, when the reasons requiring its processing cease to exist.
KRC has established the necessary systems and control mechanisms for the deletion, destruction, and anonymization of personal data. The storage and destruction procedure prepared by KRC is applied.