Illumination Text

Grazhan International Dış Ticaret Ltd.Şti.

INFORMATION TEXT REGARDING THE PROCESSING OF PERSONAL DATA

Prepared for the purpose of informing individuals regarding the processing of their personal data by the data controller within the scope of the Personal Data Protection Law No. 6698.

Our purpose of data processing is to collect and store your personal data lawfully, ensure sharing with public institutions and organizations as stipulated by the law, and to take the highest level of security measures to protect your privacy.

In accordance with Article 10 of the Personal Data Protection Law No. 6698, to inform you transparently about the methods of acquiring your personal data, processing purposes, shared parties, legal reasons, and your rights, in line with your satisfaction.

Data Controller

Your personal data, as per the Personal Data Protection Law No. 6698, will be collected and processed by Grazhan International Dış Ticaret Ltd.Şti. as the data controller within the scope explained below.

a) Methods and Legal Reasons for Acquiring Personal Data

Your personal data are collected in electronic or physical environments. Your personal data collected for legal reasons specified in the law can be processed and shared within the framework of personal data processing conditions stated in Articles 5 and 6 of the Law.

Personal data can be collected in categories such as identification information, contact information, customer information, customer transaction information, transaction security information, drawings, and accounts related to systems and facilities, the content of our project services. This includes project plans and related drawings considering the type of structure and usage purpose, taking into account valid standards, laws, and regulations as well as employer requests, operational data, legal transaction, and compliance information, and marketing sales information from customers, employees, potential customer candidates, employee candidates, business partners, suppliers, etc.

b) Purposes of Processing Personal Data

Your personal data are processed under the personal data processing conditions specified in Articles 5 and 6 of the Law for purposes such as customizing the products and services offered by the data controller according to the preferences, usage habits, and needs of the relevant individuals and recommending and promoting them to relevant individuals, conducting necessary work by business units to benefit relevant individuals from the offered products and services and executing relevant business processes, executing commercial activities for conducting necessary studies by relevant business units and executing related business processes, planning and executing commercial and/or business strategies, ensuring legal, technical and commercial-workplace safety of relevant individuals in a work relationship.

c) Parties to Whom Personal Data Can Be Shared and Purposes of Sharing

Your personal data, within the framework of personal data processing conditions and purposes specified in Articles 8 and 9 of the Law, can be shared with business partners of the Company, legally authorized institutions and organizations, and legally authorized private legal entities for purposes including customizing the products and services offered by the Company according to the preferences, usage habits, and needs of the relevant individuals and recommending and promoting them to relevant individuals, conducting necessary work by business units to benefit relevant individuals from the offered products and services and executing relevant business processes, executing commercial activities conducted by the Company, planning and executing commercial and/or business strategies of the Company, and ensuring the legal, technical and commercial-workplace safety of the Company and the relevant individuals in a work relationship with the Company.

d) Rights of Data Subjects and Exercising These Rights

If you communicate your requests concerning your rights specified below to the Company using the methods indicated under the Use of Rights by Data Subjects section, your requests will be evaluated and concluded by our Company as soon as possible and within 30 (thirty) days at the latest.

According to Article 11 of the Law, as a personal data owner, you have the following rights:

To learn whether your personal data are processed or not,
To request information about it if your personal data have been processed,
To learn the purpose of processing your personal data and whether they are used appropriately for their purpose,
To know the third parties to whom your personal data are transferred domestically or abroad,
To request the correction of your personal data if they have been processed incompletely or inaccurately, and to request that the third parties to whom your personal data have been transferred be notified of the operation carried out in this context,
To request the deletion or destruction of your personal data despite being processed under the provisions of this Law and other relevant laws, in case the reasons requiring processing are no longer valid, and to request the third parties to whom your personal data have been transferred be notified of the operation carried out in this context,
To object to the emergence of a result against yourself by analyzing processed data exclusively through automated systems,
To request compensation for the damage arising from the unlawful processing of your personal data.

According to the second paragraph of Article 28 of the Law, the rights demandable by data subjects are not applicable in these cases:

If personal data processing is necessary for the prevention of crime or investigation of a crime,
If personal data have been made public by the relevant person themselves,
If personal data processing is necessary for the supervision or regulation of institutions and organizations who have been authorized and tasked by the law or professional organizations with public institution status, and for the execution of disciplinary investigations or prosecutions,
If personal data processing is necessary for the protection of State’s economic and financial interests relating to budget, tax, and financial matters, in these instances, the rights regarding data cannot be exercised as stated above.

According to Article 28, paragraph 1 of the Law, in the following situations, data are outside the scope of the Law, and requests by data subjects will not be processed concerning these data:

If personal data are processed within the scope of research, planning, and statistics by converting them into anonymous with official statistics,
If personal data are processed by judicial authorities or execution authorities concerning an investigation, prosecution, trial, or execution procedures.

Use of Rights by Data Subjects:

To use the above-mentioned rights, data subjects should

submit their applications with identity-verifying documents via one of the following methods:

By filling out a petition and sending the wet-signed copy by hand, via notary, or by registered mail

By signing the form with a secure electronic signature under the Electronic Signature Law No. 5070 and sending it to the ………………………………. KEP address via registered electronic mail,
By following a method prescribed by the Personal Data Protection Board,
The Company responds to data subjects wishing to exercise their rights within the legal limits stipulated within the Law, again as stipulated within the Law, within a maximum of thirty (30) days. To enable third parties to submit applications on behalf of personal data owners, there should be a special power of attorney issued by the data owner through a notary on behalf of the person who will submit the application.
While data subject applications are processed free of charge in principle, a fee might be charged based on the tariff stipulated by the Personal Data Protection Board.
The Company may request information from the relevant person to verify whether the applicant is a personal data owner, and may direct questions to the personal data owner to clarify the issues specified in the application.

Legal Reasons Requiring Retention

Personal data processed within the scope of commercial activities are retained for the period stipulated in the relevant legislation. In this context, personal data are retained for the durations specified in:

· Personal Data Protection Law No. 6698,

· Turkish Code of Obligations No. 6098,

· Civil Servants Law No. 657,

· Social Insurance and General Health Insurance Law No. 5510,

· Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed Through These Publications,

· Public Financial Management Law No. 5018,

· Occupational Health and Safety Law No. 6361,

· Right to Information Act No. 4982,

· Law on the Use of Petition Right No. 3071,

· Labor Act No. 4857,

· Regulation on Health and Safety Measures to be taken in Workplace Buildings and Add-ons,

and other secondary regulations in force under these laws.

Reasons Requiring Destruction of Personal Data
· Amendment or repeal of the legislation forming the basis for processing,

· The purpose requiring processing or storage has been eliminated,

· In cases where processing of personal data occurs only based on the condition of explicit consent, withdrawal of the concerned individual's explicit consent,

· According to Article 11 of the Law, acceptance of the request made by the individual to delete or destroy their personal data,

· In instances where the data subject rejects, finds the response inadequate, or does not receive a response within the stipulated period from the Institution concerning the request to delete, destroy, or anonymize their personal data, lodging a complaint with the Board and having this request approved by the Board,

· When the maximum duration requiring retention of personal data has passed and no conditions justify storing personal data for a longer period, upon request by the concerned individual, it will be deleted, destroyed, or anonymized by the Institution, or automatically deleted, destroyed, or anonymized.