This Clarification Text has been prepared and published by the Data Controller, Att. Mevlüt Elmalı & Att. Kerem Ustaoğlu – AY-YILDIZ Law Firm (Erenköy District, İğdelidere Cad. 4/1, Melikgazi/KAYSERİ, Tel: (0352) 333 1881, Fax: (0352) 333 1938, Website: www.ayyildizhukuk.org/en, Email: bilgi@ayyildizhukuk.org), pursuant to the Turkish Personal Data Protection Law No. 6698 (hereinafter referred to as the “PDPL”) and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Duty to Inform (hereinafter referred to as the “Communiqué”), for the purpose of informing employees about the procedures and principles to be followed in the protection of their personal data in the context of their relationship with our office.
Article 10 of the PDPL: “During the acquisition of personal data, the data controller or the person authorized by the data controller is obliged to inform the relevant persons about the identity of the data controller and, if any, of the data controller’s representative; the purposes for which personal data will be processed; to whom and for what purposes the processed personal data may be transferred; the method and legal basis of collecting personal data; and the other rights set forth in Article 11.”
Personal Data: Any information relating to an identified or identifiable natural person.
Processing of Personal Data: Any operation performed on personal data, wholly or partly, by automated means or by non-automated means provided that it forms part of any data recording system, such as collection, recording, storage, preservation, alteration, re-arrangement, disclosure, transfer, taking over, making available, classification, or restriction of use.
Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system. Within the scope of this text, the Data Controller is Att. Mevlüt Elmalı.
Data Recording System (VERBİS): The registration system in which personal data is processed by being structured according to specific criteria.
Explicit Consent: Consent relating to a specific subject, based on information, and declared with free will.
The Board: Refers to the Personal Data Protection Board.
Personal data relating to employees may be processed by our office in accordance with the purposes and processing conditions set forth in this text. The personal data subject to processing are as follows:
Within the scope of Article 10 of the PDPL and Article 5 of the Communiqué, and in compliance with the processing conditions set out in Article 4 of the PDPL, employees’ personal data may be processed for the following purposes:
Personal data may be obtained directly from the Data Subject, from third parties, and from legal authorities during the establishment of the legal relationship. In this context, personal data may be collected orally, in writing, or electronically through means such as e-mail and application forms, as well as through written or oral communication channels. Personal data may be collected in order to enable employers to fulfil their obligations arising from employment contracts and from legislation, in particular the Labor Law and Social Security Laws, in a complete and accurate manner.
Pursuant to Article 5 of the PDPL, personal data may not be processed without the Explicit Consent of the Data Subject. The Law exceptionally sets forth cases in which Explicit Consent is not required. Where there is an express provision in the law; where processing of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the conclusion or performance of that contract; where it is mandatory for Att. Mevlüt Elmalı & Att. Kerem Ustaoğlu – AY-YILDIZ Law Firm to fulfil its legal obligations; where the data has been made public by the Data Subject; where processing is mandatory for the establishment, exercise, or protection of a right; or where processing is mandatory for the legitimate interests of the Data Controller, provided that it does not harm the fundamental rights and freedoms of the Data Subject – personal data may be processed by the Law Firm without seeking Explicit Consent.
For the Law Firm to continue its activities, personal data may be processed on the legal grounds set out above, within the scope of the personal data processing conditions and purposes stipulated in Articles 5 and 6 of the PDPL and in accordance with the principles and procedures foreseen by other relevant legislation, in order to achieve the purposes stated in this Clarification Text and to fulfil legal obligations.
Employees’ personal data may be shared with, and transferred abroad to, suppliers, shareholders, authorized dealers, private law persons from whom services are procured (in matters such as security, training, audit, event and organization, health, occupational safety, legal, etc.), independent audit firms, financial institutions, business partners located both in Turkey and abroad including direct and indirect subsidiaries, companies located in Turkey and abroad from whom storage, archiving, and information technology support is procured (servers, hosting, software, cloud computing), and legally authorized public institutions and private law persons, in accordance with the data transfer and processing conditions set forth in Articles 8 and 9 of the Law and in order to achieve the purposes set out above, subject to the adoption of adequate and effective measures in compliance with the security and confidentiality principles established by the legislation.
In accordance with the provisions of the PDPL, your personal data processed for the purposes set out in this “Clarification Text on the Processing of Personal Data” shall, pursuant to Article 7/1 of the PDPL, be deleted, destroyed, or anonymized by us, taking into account the Personal Data Retention and Destruction Policy, once the purpose requiring their processing has ceased to exist and/or the statutory limitation periods within which we are required to process your data under the applicable legislation have expired.
The Data Subject has the right to: learn whether their personal data is being processed; request information if their personal data has been processed; learn the purpose of processing of personal data and whether the data is used in accordance with such purpose; know the third parties within Turkey or abroad to whom the personal data has been transferred; request rectification of personal data if it has been processed incompletely or inaccurately; request the deletion or destruction of personal data where the reasons requiring its processing have ceased to exist, notwithstanding that the data has been processed in compliance with the PDPL and other applicable laws; request that any rectification, deletion, or destruction of personal data by the Law Firm upon such request be notified to third parties to whom the data has been transferred; object to any outcome adverse to the Data Subject that arises from the exclusive analysis of the processed data by automated systems; and claim compensation for damages arising from unlawful processing of personal data.
Pursuant to Article 28/2 of the Law, in the following cases, save for the right to claim compensation for damages, Data Subjects shall not be able to benefit from the rights set out in Article 11 of the Law:
The Data Subject may submit requests concerning the rights set out above to Att. Mevlüt Elmalı & Att. Kerem Ustaoğlu – AY-YILDIZ Law Firm in accordance with the application procedures set out in the Communiqué on the Procedures and Principles of Application to the Data Controller.
Requests within the scope of the rights enumerated in Article 11 of the Turkish Personal Data Protection Law No. 6698 may be submitted in writing pursuant to Article 13 of the PDPL and Article 5 of the Communiqué on the Procedures and Principles of Application to the Data Controller.
Applications submitted to the Law Firm shall, pursuant to Article 13/2 of the PDPL, be answered within thirty (30) days from the date on which the application reaches the Law Firm, depending on the nature of the request. Responses to the application shall, pursuant to Article 13 of the PDPL, be delivered in writing to the applicant in person with a wet-ink signature or through a notary public.
In the event that the request is accepted, or rejected with an explanation of the reasons therefor, the response shall be communicated to the applicant in writing. Where the request contained in the application is accepted, the Law Firm shall carry out the necessary action without delay.
In the event that the evaluation and decision-making process entails a separate cost, the tariff determined by the Personal Data Protection Board shall be applied.
Data Subject
