POLAT MAKİNA CLARIFICATION TEXT ON THE PROCESSING AND PROTECTION OF PERSONAL DATA
Data Controller: Polat Makina San. ve Tic. A.Ş. (Hereinafter referred to as the "Company" or "Polat Makina".)
At Polat Makina, we attach great importance to protecting the personal data of our employees, employee candidates, interns, customers, suppliers, fair/exhibition participants, and all relevant individuals visiting our premises. This Clarification Text has been prepared in accordance with Article 10 of the Law on the Protection of Personal Data No. 6698 ("PDPL") to inform you regarding the purposes for which your personal data is processed by data categories, to whom and for what purposes it may be transferred, the methods and legal grounds of collection, and your rights under Article 11 of the PDPL.
1. Data Categories, Processing Purposes, and Legal Grounds
Your personal data is processed within the scope of the personal data processing conditions specified in Articles 5 and 6 of the PDPL for the following purposes and legal grounds, categorized by data subject groups:
A. For Employees
Processed Data: Identity, contact, personnel, financial (bank account details), family and relative information, professional experience, legal action data, physical space security data, and health data (special category personal data).
Processing Purposes: Performance of the employment contract, creation of personnel files, payment of salaries and benefits, execution of mandatory insurance and tax notifications, fulfillment of occupational health and safety (OH&S) obligations, and execution of obligations arising from legislation.
Legal Grounds: Expressly provided for by law (Labor Law, Social Insurance and General Health Insurance Law), being directly related to the establishment or performance of a contract, fulfillment of the data controller's legal obligations; and for health data, the conditions prescribed by law for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment, and care services.
B. For Employee Candidates
Processed Data: Identity, contact, professional experience (CV, education, certificates, work experience), and reference details.
Processing Purposes: Execution of recruitment processes, evaluation of candidate suitability for the position, conducting reference checks, and contacting candidates for future positions when necessary.
Legal Grounds: Being directly related to the establishment or performance of a contract (pre-contractual stage), legitimate interests of Polat Makina provided that it does not harm the fundamental rights and freedoms of the data subject, or your explicit consent (storing CVs for future positions).
C. For Interns
Processed Data: Identity, contact, personnel (internship certificate, school details), financial (bank account for internship stipend, if applicable), and health and training data required under OH&S.
Processing Purposes: Planning and tracking internship training processes, fulfilling internship contract obligations, executing occupational health and safety processes, and submitting legal notifications.
Legal Grounds: Expressly provided for by law (Vocational Education Law No. 3308), fulfillment of legal obligations, and performance of a contract.
D. For Customers and Suppliers
Processed Data: Identity (full name, signature circulars), contact (phone number, email, address), financial (bank details, invoicing data, tax office/number), and legal action data.
Processing Purposes: Execution of contract processes, management of goods/services sales and procurement operations, tracking logistics and delivery activities, execution of finance and accounting affairs, tracking legal matters, and customer relationship management (CRM).
Legal Grounds: Being directly related to the establishment or performance of a contract, fulfillment of Polat Makina's legal obligations (Tax Procedural Law, Turkish Commercial Code), and the necessity of data processing for the establishment, exercise, or protection of a right.
E. For Fair/Exhibition Participants and Visitors
Processed Data: Identity (full name), contact (email, phone number, business card details), and professional details (company/title). Visual data if included in group photos taken at fair venues. Marketing information if explicit consent is provided for fair invitations and marketing processes.
Processing Purposes: Management of fair organizations, business development, establishing potential customer/supplier relationships, promotion of Polat Makina products and services, and execution of commercial communication activities (newsletters, campaign notifications).
Legal Grounds: Legitimate interests of the data controller (business development and commercial communication) provided that it does not harm the fundamental rights and freedoms of the data subject, or your explicit consent for commercial electronic message delivery/data processing operations.
F. Closed-Circuit Television (CCTV) / Physical Space Security
Processed Data: Physical space security information (Camera recordings).
Processing Purposes: Ensuring physical space security across Polat Makina premises, factory, and office buildings, maintaining internal security, protecting movable goods and products, and providing evidence in potential legal disputes.
Legal Grounds: Legitimate interests of Polat Makina (security) provided that it does not harm the fundamental rights and freedoms of the data subject, and the necessity of data processing for the establishment, exercise, or protection of a right.
Note: CCTV surveillance activities are conducted only in common areas such as building entrances, corridors, production lines, warehouse areas, and building exteriors. No cameras are placed in areas that may violate individual privacy (restrooms, break rooms, etc.).
2. Transfer of Processed Personal Data
Your personal data may be transferred in line with the realization of the above-mentioned purposes and in accordance with Articles 8 and 9 of the PDPL to:
Authorized Public Institutions and Organizations: To fulfill legal obligations (Social Security Institution, Ministry of Finance, İŞKUR, Judicial Authorities, Police Headquarters, etc.),
Business Partners and Suppliers: Third parties from whom external services are procured to carry out company operations (cargo/logistics firms, independent audit companies, financial advisors, OH&S experts, information technology/software support firms, etc.),
Group Companies: Polat Group Holding A.Ş. and its subsidiaries for joint database management, reporting, and implementation of corporate policies,
Fair/Exhibition Organization Companies: Within legal boundaries to manage fair participation processes in compliance with legislation.
3. Method of Personal Data Collection
Your personal data is collected via fully or partially automated methods, or non-automated methods provided that it forms part of a data filing system:
Via Automated Methods: Closed-circuit television (CCTV) systems, applications submitted through our websites, emails, and data recorded in Polat Makina’s IT infrastructure,
Via Non-Automated Methods: Job application forms, physical personnel files, hand-delivered business cards, forms completed at fairgrounds, printed contracts, and official reports.
4. Your Rights Under Article 11 of the PDPL
As a personal data subject, you may exercise the following rights by applying to Polat Makina under Article 11 of the PDPL:
To learn whether your personal data is processed,
To request information if your personal data has been processed,
To learn the purpose of processing your personal data and whether it is used in accordance with its purpose,
To know the third parties to whom your personal data is transferred domestically or abroad,
To request correction of your personal data if it is processed incompletely or incorrectly,
To request the deletion or destruction of your personal data within the framework of the conditions stipulated in Article 7 of the PDPL,
To request notification of correction, deletion, and destruction operations to third parties to whom your personal data has been transferred,
To object to the occurrence of a result against you by analyzing the processed data exclusively through automated systems,
To demand compensation for damages in case you suffer damage due to unlawful processing of your personal data.
5. Application Method
To exercise your above-mentioned rights, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller:
You may submit your physically signed application in person by presenting identification or send it via a notary public to [Company Address],
You may send it signed with a secure electronic signature or mobile signature to our Company's Registered Electronic Mail (KEP) address at [Company KEP Address],
You may send it to [Company Contact Email Address] using your email address previously notified to our Company and registered in our systems.
Your application must legally include your full name, signature (for physical applications), Turkish ID number (passport number or nationality for foreigners), residential or business address for notifications, email address for notifications, and a clear statement regarding the subject of the request. Polat Makina will conclude your request free of charge within 30 (thirty) days at the latest, depending on the nature of the request.
