Personal Data Policy
1. Purpose and Scope of the Policy
THE POLICY OF PROTECTION AND PROCESSING OF PERSONAL DATA ("Policy") OF DOĞTAŞ KELEBEK MOBİLYA SANAYİ VE TİCARET A.Ş., has been prepared by DOĞTAŞ KELEBEK MOBİLYA SANAYİ VE TİCARET A.Ş. (“Doğtaş Kelebek Mobilya”) in order to determine the procedures and principles regarding the processing activities and the protection of the personal data being processed.
The protection of personal data is constitutionally guaranteed by the paragraph added to Article 20 of the Constitution as a consequence of the amendment made in 2010 and in this context, the Law No. 6698 on the Protection of Personal Data entered into force on 07.04.2016. In this regard, Doğtaş Kelebek Mobilya makes this a company policy by arranging the necessary operations to raise awareness within the company and harmonizing the internal operation with the legislation on the protection of personal data, which is a constitutional right.
The purpose of this Policy is to provide guidance in terms of the implementation of the law on the protection of personal data and the regulations set forth by the legislation by Doğtaş Kelebek Mobilya.
2. DEFINITIONS OF TERMS
EXPLICIT CONSENT: Consent regarding a specific subject, based on being informed and expressed with free will.
ANONYMIZING: Rendering personal data impossible to link with an identified or identifiable natural person,
PERSONAL DATE SUBJECT: Natural person whose personal data is processed. e.g. Customers, employees
PERSONAL DATA: all kinds of information related to an identified or identifiable natural person,
SENSITIVE PERSONAL DATA: Data related to race, ethnicity, political opinion, philosophical belief, religion, religious sect or other beliefs, appearance, membership of associations, foundations or trade unions, health, sexual life, criminal conviction and security measures and biometric and genetic data are sensitive data.
PROTECTION OF PERSONAL DATA: All kinds of operations performed upon personal data such as collection, recording, storage, retention, alteration, re-organization, disclosure, transferring, taking over, making retrievable, classification or preventing the use thereof, fully or partially through automatic means or provided that the process is a part of any data registry system, through non-automatic means
PROCESSOR: The natural or legal person who processes personal data on behalf of the controller upon his authorization
CONTROLLER: the natural or legal person who determines the purpose and means of processing personal data and is responsible for establishing and managing the data registry system.
KVKK: Law No. 6698 on the Protection of Personal Data
3. RECORDING MEDIUM OF PERSONAL DATA
Personal data is processed by Doğtaş Kelebek Mobilya through the following recording media:
- Communication servers
- Removable storage (USB, Memory Card etc.)
- Information security devices (firewall, log file, antivirus, etc.)
- Personal computers
- Optical disks (CD, DVD etc.)
- Printer, scanner, copier
- Software (office software, government-owned software)
- Mobile devices (phones, tablets, etc.)
- Non-electronic written, printed, visual media
4. EMPLOYEES AND APPLICANTS
4.1. Personal Data Collected Regarding the Applicant
Doğtaş Kelebek Mobilya may process the following information regarding the applicants who applied for a job.
• Curriculum vitae, Work Experience, Educational Background,
• Name and Surname, TR Identity No., Place and Date of Birth, Marital Status, Passport Photograph, Gender
• Phone Number, Address, E-mail (Contact information),
• Entry-exit recordings and camera records,
• Records of information obtained by means of teleconferencing, video calls, phone calls or face to face interviews,
• References or information obtained as a result of researching made by Doğtaş Kelebek Mobilya
• Salary expectation
4.2. Personal Data Collected Regarding the Employees
Doğtaş Kelebek Mobilya processes the following information regarding the employees and their business relationships/execution of employment contracts.
• Curriculum vitae, Passport Photograph, Work experience, Diploma, Certificate, Professional Competence Certificate, Psychotechnics, SRC4/SRC2 Documents, E/G Driving License
• Name and Surname, TR Identity No., Identity Serial Number, Mother's Name, Father's Name, Place and Date of Birth, Marital Status, Religion, Blood Type, Signature, Passport Photograph, Registered Province, District, Neighborhood, Village, Volume Number, Family Serial Number, Gender, Criminal Record Certificate
• Phone Number, Address, E-mail, Phone Number of a Chosen Relative (Contact Information)
• References or information obtained as a result of researching made by Doğtaş Kelebek Mobilya
• Salary expectation, payment method
• Criminal record, medical report (Chest Radiography, Eye Examination Report, Hearing Audiometry, Hepatitis Test, Pulmonary Function Test), Documents of Execution Proceeding
• Military service registration certificate, SGK service sheet
• Financial data, camera recordings, information related to business travels, location data,
• Vehicle allocation information, personal accident insurance, work clothes sizes, private health insurance
4.3. Purposes of Collecting and Processing Applicants' Personal Data
Doğtaş Kelebek Mobilya processes the personal data of the applicants considering the nature of the application for the following purposes:
• To evaluate the applicant's qualification, experience, interest and suitability for the open position
• To check the accuracy of the information submitted by the applicant or to conduct a reference check for the applicant by contacting third parties, when necessary
• To contact the applicant for the application and recruitment process or for any position opened later, when appropriate
• To meet the requirements of any legislation or the demands of an authorized institution or organization,
• To develop and improve the recruitment principles applied by Doğtaş Kelebek Mobilya
• To perform the activities which are required within the framework of occupational health and safety
4.4. Purposes of Collecting and Processing Employees' Personal Data
Doğtaş Kelebek Mobilya processes the personal data of the employees for the following purposes:
• To develop and improve the principles of the employment agreement applied by Doğtaş Kelebek Furniture,
• To manage emergency procedures
• To conduct audit ethical activities
• To manage human resources procedures
• To meet the demands of authorized public institutions or organizations in case of disputes that may arise or in a judicial case that may occur
• To fulfill the legal obligations regarding the employment of the employee,
• To open payroll account for the employees, to provide a rental car when necessary, to provide telephones, telephone lines, meal card and to fulfill automatic private pension transactions
• To follow-up the necessary health conditions for the employee to fulfill their duty
• To follow-up the employee's wage garnishment
• To ensure and control the quality, information security and privacy policies and standards of Doğtaş Kelebek Mobilya
• To organize the travels of the Company
• To contact with the people chosen by the employee with their consent in case of emergencies
• To determine and control the arrival and leaving times of employees
• To prepare reports and analyzes to be made to Executives
• To carry out operations such as software, enterprise resource planning, reporting, marketing, etc.
• To evaluate performance and determine wage policies
• To record footage for the privacy and security practices in the workplace
• To meet the requirements laid down by the laws and regulations (All relevant legislation such as tax legislation, social security legislation, obligations law legislation, commercial law legislation, occupational health and safety law, electronic communication legislation etc.)
• To perform the activities which are required within the framework of occupational health and safety
• 4.5. Collecting and Processing Methods of Personal Data of Employees and Applicants
In the recruitment process, the personal data of applicants are collected together with other methods and means specified in this Policy or additionally by the following methods and means:
• Application form published in print or electronic form,
• Curricula vitae sent by the applicant to Doğtaş Kelebek Mobilya by e-mail, reference and similar means
• Employment or consultancy companies, İşkur, HR web sites and LinkedIn,
• The controls performed to verify the accuracy of the information given by the applicant and the researches made by Doğtaş Kelebek Mobilya
Doğtaş Kelebek Mobilya processes the collected personal data automatically or non-automatically through computer systems and human resources personnel.
4.6. Reference Check About Applicants
Doğtaş Kelebek Mobilya can check references about the applicants with the information given by the applicants in the relevant fields of the job application form.
The aim of the reference check is generally to verify the accuracy of the information given by the applicant. Another aim of this is also to determine the information that the applicant keeps about themselves and that may cause risks for Doğtaş Kelebek Mobilya.
When contacted, the authorized person of Doğtaş Kelebek Mobilya is obliged to inform the contacted people for reference check.
Within the scope of reference check, the necessary personal data such as identity information, work and education experiences of applicant can be shared with third parties. In addition, personal data about applicant can be obtained from third parties.
Applicants can always contact with Doğtaş Kelebek Mobilya about the reference check to be made about them.
4.7. Rights of Employees and Applicant Regarding Their Personal Data
Applicants who want to exercise their rights arising from Article 11 of Law No. 6698 on the Protection of Personal Data (''KVKK'') can apply to Doğtaş Kelebek Mobilya within the scope of the procedures and principles described in this Policy.
4.8. The Personal Data, Collected During the Candidacy, to be Processed During the Recruitment Process
All personal data collected and processed about the applicant during the recruitment process are transferred to the personal file, if the applicant is decided to be employed in the relevant position.
4.9. Security of Personal Data of Employees and Applicant
Doğtaş Kelebek Mobilya does not discriminate between the data subject groups (such as apllicants, persons, interns) in terms of the security of the personal data it processes. Detailed information about the security of personal data can be found in the security of personal data section of this document.
5. CLIENTS
5.1. Collected Personal Data Regarding Clients
Although the service offered by Doğtaş Kelebek Mobilya to the client may vary depending on the product or commercial activity, the following personal data obtained orally, in writing or electronically by Doğtaş Kelebek Mobilya are processed during your use of Doğtaş Kelebek Mobilya products and services.
• Name and surname, telephone number, e-mail address, contact information, voice recordings, camera recordings, professional information
• Client demands, suggestions and client audit reports.
5.2. Purposes of Collecting and Processing of Client Data
Doğtaş Kelebek Mobilya processes the personal data of the client for the following purposes, taking into account the service it provides to the client and the business relationship between them:
• To manage accounting and financial processes, to make and confirm collections
• To evaluate suggestion and request forms filled in by the client upon request and to develop the business
• To implement the serviced provided to the client wholesomely and to provide physical security measures
5.3. Collecting and Processing Methods of Personal Data of Clients
During the interview and/or evaluation process, the personal data of clients are collected together with other methods and means specified in this Policy or additionally by the following methods and means:
• Orally, in writing or electronically or by e-mail, written petition/suggestion-request forms.
5.4. Rights of Clients Regarding Their Personal Data
Clients who want to exercise their rights arising from Article 11 of Law No. 6698 on the Protection of Personal Data (''KVKK'') can apply to Doğtaş Kelebek Mobilya within the scope of the procedures and principles described in this Policy.
6. PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA
Doğtaş Kelebek Mobilya is sensitive regarding the protection of personal data as a company policy and acts accordingly in consideration of the following general principles.
6.1. Processing in accordance with the Law and the Rules of Bona Fides
While processing of personal data, the principles set forth by legal regulations and the rules of Bona Fides are followed.
6.2. Ensuring the Accuracy of Personal Data and Being Up-to-date, where necessary
Periodic checks and updates are made to ensure that the processed personal data of individual groups are accurate and up to date, and necessary measures are taken accordingly. In this context, systems for checking the accuracy of personal data and making necessary corrections are established within Doğtaş Kelebek Mobilya.
6.3. Processing for Specific, Explicit and Legitimate Purposes
Personal data should be processed based on specific, explicit and legitimate purposes. The purpose for which the data will be processed is detailed below.
6.4. Being relevant with, limited to and proportionate to the purposes for which they are processed
Personal data are processed in a relevant and limited and proportionate manner in order to achieve the stipulated purpose/objectives, and the processing of personal data that is not related to the realization of the purpose or is not needed is avoided.
6.5. Being retained for the period of time stipulated by relevant legislation or the purpose for which they are processed.
Doğtaş Kelebek Mobilya retains personal data only for the period stipulated by the relevant legislation or required for the purpose for which they are processed. In this context, first of all, it is determined whether a period of time is stipulated for the retention of personal data in the relevant legislation, and if a period of time is determined, this period is followed. If a period of time is not determined, personal data are retained for the time required for the purpose for which they are processed. In case of the expiration of the period of time, no reason for processing or If there is no legal reason to allow them to be processed for a longer period of time, Personal data are erased, destructed or anonymized according to Doğtaş Kelebek Mobilya's Personal Data Retention and Destruction Policy.
7. CONDITIONS FOR PROCESSING PERSONAL DATA OF PERSON GROUPS
The explicit consent of the relevant person groups is only one of the reasons of compliance with the law that enable the processing of personal data in accordance with the law. Apart from explicit consent, personal data may also be processed in the presence of one of the following reasons for compliance with the law. The basis of the personal data processing activity can be only one of the following reasons for compliance with the law, and more than one of these conditions can also be the basis of the same personal data processing activity. If the processed personal data is a sensitive personal data, the conditions stated below under the section of "Conditions Where Sensitive Personal May Be Processed" are applied. Person groups are informed about which personal data are processed with this Policy, for what purposes and reasons their personal data are processed, from which sources their personal data is collected, with whom these personal data will be shared and how they will be used.
7.1. If it is clearly provided for by the laws.
In cases where the processing of personal data is explicitly stipulated by the laws, Doğtaş Kelebek Mobilya processes the personal data of the person groups whose data will be processed without obtaining their explicit consent. For example, processing personal data in processes such as membership, commercial electronic permission, order, payment, delivery, cancellation or return of the product in accordance with the Law on the Regulation of Electronic Commerce.
7.2. In Case of Failure to Obtain Explicit Consent of the Relevant Person Due to Actual Impossibility
The data may be processed without the explicit consent of the person, if the personal data of a person who are unable to disclose their consent due to actual impossibility or whose consent cannot be validated in order to protect the life or bodily integrity of the person or another person.
7.3. Being Directly Related to the Fulfillment or Execution of the Contract
The data may be processed if it is necessary to process the personal data of the parties to the contract provided that it is directly related to the fulfillment or execution of a contract
7.4. Fulfilling the Legal Obligation of Doğtaş Kelebek Mobilya
Personal data of persons may be processed without explicit consent if processing is mandatory to fulfill legal obligations as a data controller.
7.5. Publicizing Personal Data of Persons
The data can be processed without the need for explicit consent, If the personal data of a person is made public by themselves. For example, personal data that the Member has publicly shared on the internet, on social media accounts can be processed if it is suitable for the will of sharing.
7.6. Being Mandatory for the Establishment or Protection of Any Right
The data may be processed without the explicit consent of the persons, if data processing is mandatory for the establishment, exercising or protection of a right. For example, having the information in a Member's complaint file based on a complaint made by the Member to the court.
7.7. Processing of Data Based on Legitimate Interest
Personal data can be processed without the explicit consent of persons, if data processing is mandatory for the legitimate interests of Doğtaş Kelebek Mobilya, provided that it does not harm the fundamental rights and freedoms of persons. For example, making satisfaction surveys by Doğtaş Kelebek Mobilya in order to ensure customer satisfaction.
7.8. Processing of Personal Data of Persons Based on Explicit Consent
Personal data of the persons will be processed based on explicit consent, in cases where it cannot be processed based on any of the conditions specified in Article 5 (2) above.
8. CONDITIONS WHERE SENSITIVE PERSONAL DATA MAY BE PROCESSED
Some of the personal data are organized separately as "sensitive personal data" and are subject to a special protection.
8.1. Processing of Sensitive Personal Data Based on Explicit Consent
Sensitive personal data can be processed by taking the principles specified in this Policy and the necessary administrative and technical measures, when obtained persons' explicit consent.
8.2. Conditions Where Sensitive Personal Data May Be Processed Without Explicit Consent
Sensitive personal data may be processed in the following cases, where the explicit consent is not obtained, provided that adequate measures are taken by the Personal Data Protection Board ("Board").
• Sensitive personal data other than the health and sexual life of persons, in cases stipulated by laws
• Sensitive personal data related to the health and sexual life of persons can only be processed by persons under confidentiality obligation or authorized institutions and organizations for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, planning and management of health services and financing.
9. ENLIGHTENING AND INFORMING THE PERSONS
Kelebek Mobilya informs the persons during the acquisition of personal data, Doğtaş. In this context, they are informed about the identity of Doğtaş Kelebek Mobilya contact person, for what purpose the personal data will be processed, to whom and for what purpose the processed personal data can be transferred, the method of personal data collection and the rights of persons. The necessary information is provided upon the information request of persons regarding their personal data, when they send an e-mail to info@dogtas.com with their secure electronic signature, mobile signature and registered electronic mail (REP) or have a written application to İdealtepe Mah. Rıfkı Tongsir Cad. No:107 Küçükyalı / Maltepe / İstanbul address. Doğtaş Kelebek Mobilya Contact Person: ???
10. CATEGORIZATION OF PERSONAL DATA
Doğtaş Kelebek Mobilya processes personal data of persons in the following categories within the scope of this POLICY:
• Identity Information
• Contact Information
• Security Information of a Physical Place • Financial Information • Personnel Information • Informaiton about Applicants/Employees • Complaint Management Information • Website Information
11. PURPOSE OF PROCESSING PERSONAL DATA
11.1. Processing Conditions
Personal data are processed in a limited way under the following conditions. The conditions are:
• The relevant activity regarding the processing of your personal data is clearly stipulated in the laws, • The processing of your personal data by Doğtaş Kelebek Mobilya must be directly related and necessary with the establishment or execution of a contract. • In case the processing of personal data is mandatory for Doğtaş Kelebek Mobilya to fulfill its legal obligation • In case the personal data are made public by the persons, limited processing by Doğtaş Kelebek Mobilya for publicizing purposes, • Processing of personal data by Doğtaş Kelebek Mobilya is mandatory for Doğtaş Kelebek Mobilya or the establishment, exercising or protection of the rights of persons or third parties. • It is mandatory to carry out personal data processing for the legitimate interests of Doğtaş Kelebek Mobilya, provided that it does not harm the fundamental rights and freedoms of persons. • Personal data processing by Doğtaş Kelebek Mobilya is mandatory for the protection of the life or bodily integrity of the person concerned or another person, and in this case, the person concerned is unable to disclose their consent due to actual impossibility or legal invalidity.
In case of the above-mentioned conditions, Doğtaş Kelebek Mobilya obtains the explicit consent of personal data subjects to perform personal data processing.
11.2. Processing Purposes
Doğtaş Kelebek Mobilya processes personal data for the following purposes:
For Applicant/Employees:
• To perform recruitment processes • To evaluate the applicant • To create personal files • To carry out the performance evaluation • To determine whether the applicant is capable of fulfilling the job requirements • To carry out general insurance and other transactions of persons working within the framework of employment contract • To manage side benefits process, to carry out periodic health checks, to perform procedures related to the arrival and leaving times of employees • To realize the rewarding processes, • To organize in-house organizations • To organize domestic/international travels • To make legal proceedings
For Clients:
• To evaluate the suggestion and request forms filled in by the customer upon request and develop the business • To perform services such as technical service provided to clients
For public official, administrative institution employee representing the authority conducting the investigation or trial:
• To provide information and documents that may be needed in the management of legal and administrative processes • To fulfill the legal obligations
For Online Visitors:
• To comply with legal regulations • For the logging the system movements of online visitors and users.
For Shareholders/ Partners:
• To provide information and documents that may be needed in the management of legal and administrative processes
12. TRANSFER OF PERSONAL DATA TO THIRD PARTIES DOMESTIC AND/OR ABROAD
Personal data of persons can be transferred to third parties (third party companies, third natural persons) by taking the necessary security measures in line with the processing purposes.
12.1. Transfer of Personal Data
Personal data can be transferred to third parties in case the conditions stipulated in Article 8 and Article 9 of the KVKK are met.
Anonymous information and website usage habits of online visitors are collected and shared with cookies.
12.2. Third Persons to whom Personal Data is Transferred and Transfer Purposes
Your personal data can be transferred to the data subject groups listed below:
• Business partners (Independent Auditors, contracted insurance companies)
• People who follow the company's social media accounts (for photos and videos taken in line with the explicit consent of the people (including photo sharing) at celebrations and events within the company)
• Shopping mall management
• Legally authorized public institutions and organizations,
Legally authorized private legal persons (Company Lawyer/Legal Adviser, Workplace Physician) Your personal data are transferred for the following purposes:
• To develop and improve the employment contract principles applied by Doğtaş Kelebek Mobilya
• To make sure that the employees can benefit from health promotions (Blood donation, private hospital agreement) etc.
• To manage emergency procedures
• To meet the demands of the authorized public institutions or organizations in case of disputes that may arise or in a judicial case that may occur To evaluate performance and determine wage policies
13. SECURITY OF PERSONAL DATA
In order to ensure the security of personal data, reasonable precautions are taken to prevent unauthorized access risks, accidental data loss, erasure of data or damage to data.
All necessary technical and physical measures are taken to prevent access to personal data by anyone other than those authorized to access it. In this context, the authorization system is specially designed in such a way that no one will be able to access more personal data than necessary. Stricter measures are taken while ensuring the security of sensitive personal data such as health data, when compared to other personal data.
Authorized persons go through the necessary security checks. In addition, these people are trained about their roles and responsibilities.
Access records of personal data are kept within technical possibilities and these records are reviewed at regular intervals. In case of unauthorized access, an investigation is conducted immediately.
Doğtaş Kelebek Mobilya complies with the following obligations in order to ensure the security of the processed data:
• Acting legally and honestly in the matters related to the protection of personal data
• Processing personal data accurately, exactly and completely
• Carrying out the necessary procedures to updating the personal data that is not current
• Informing the relevant manager when noticing any illegal actions in the processing of personal data
Making necessary directions for the exercise of legal rights regarding personal data.
14. LEGAL RIGHTS OF PERSONS AND METHODS OF EXERCISING
14.1. Rights Regarding Personal Data Under KVKK
The rights that can be exercised by persons regarding personal data are included in Article 11 of the KVKK and are as follows:
• To learn whether personal data are processed,
• To request information if personal data are processed,
• To learn the purpose of processing personal data and whether they are used appropriately for their purpose
• To know the third parties to whom personal data are transferred domestically or abroad
• To request correction of personal data in case of incomplete or incorrect processing
• To request the erasure or destruction of personal data within the framework of the conditions stipulated in the relevant legislation,
• To request notification of the transactions made pursuant to clauses (d) and (e) to third parties to whom personal data are transferred
• To object to the occurrence of a result against the person himself by analyzing the processed data exclusively through automated systems,
To demand the compensation of the damage that happened due to the processing of personal data illegally
14.2. Principles Regarding the Exercise of Rights Related to Personal Data
Persons who would like to exercise their rights related to their personal data can apply by sending an email to ............................. with their secure electronic signature, mobile signature and registered electronic mail (REP), by sending an e-mail by using the e-mail address registered in Doğtaş Kelebek Mobilya systems or by filling in the KVK Application Form at www.dogtas.com/tr. Your applications made in this way will be answered within 30 days at the latest.
15. EFFECTIVENESS AND UPDATEABILITY
This Policy has entered into force on the date of publication. The policy can be updated in order to adapt to changing conditions and legislation. Information about the relevant update will be provided at www.dogtas.com/tr.