Protection of Personal Data

This translation is provided for information purposes only; the legally binding version is the Turkish text.

1 - INTRODUCTION

Under Article 20 of the Constitution of the Republic of Türkiye, everyone has the right to request the protection of personal data concerning them. Regarding this constitutional right, this personal data protection policy, prepared by E2 TEKNOLOJİ SAN TİC LTD ŞTİ ("E2 TEKNOLOJİ") in its capacity as Data Controller, governs the secure protection of the personal data of natural persons such as company employees, job applicants, interns, suppliers, supplier employees, subcontractors, subcontractor employees, customers, third parties and visitors. E2 TEKNOLOJİ has taken all necessary administrative and technical measures for the protection of personal data processed pursuant to Law No. 6698 on the Protection of Personal Data and secondary legislation.

2 - PURPOSE

The primary purpose of E2 TEKNOLOJİ in implementing this Policy is to ensure the security of personal data processed by automatic or non-automatic means (provided the data forms part of a data recording system) belonging to the natural persons listed above with whom it has legal and commercial relations, primarily company employees, through the administrative and technical measures taken within the scope of lawful personal data processing and protection activities.

3 - SCOPE

This Policy relates to all personal data of employees, customers, subcontractors, subcontractor employees, suppliers, supplier employees, job applicants, interns, third parties and visitors of E2 TEKNOLOJİ, processed by automatic means or by non-automatic means provided the data forms part of a data recording system.

4 - PURPOSES OF PERSONAL DATA PROCESSING BY THE DATA CONTROLLER

Within this scope, E2 TEKNOLOJİ processes personal data for the following purposes:

Conducting corporate sustainability activities
Managing relations with suppliers and subcontractors
Carrying out personnel recruitment processes
Conducting internal audit and legal proceedings
Carrying out corporate governance and communication activities
Managing requests and complaints
Providing legally required information to authorised persons or institutions
Creating and tracking visitor records

Where a processing activity carried out for the above purposes does not meet any of the conditions stipulated under Law No. 6698, E2 TEKNOLOJİ obtains the explicit consent of the data subjects for the relevant processing.

5 - PRINCIPLES OF PERSONAL DATA PROCESSING

At E2 TEKNOLOJİ SAN TİC LTD ŞTİ, work is carried out in accordance with the following fundamental principles adopted for the processing of personal data under this Policy:

Processing personal data lawfully and in good faith
Keeping personal data accurate and up to date where necessary
Processing personal data for specific, explicit and legitimate purposes
Processing personal data in a manner connected with, limited to and proportionate to the purposes for which it is processed
Retaining personal data for the period stipulated in the relevant legislation or required for the processing purpose
Informing and enlightening data subjects
Establishing the necessary systems for data subjects to exercise their rights
Taking the necessary measures for the safekeeping of personal data
Acting in accordance with the relevant legislation and Personal Data Protection Board regulations when transferring personal data to third parties in line with processing purposes
Showing the necessary care in the processing and protection of special categories of personal data

6 - CONDITIONS OF PERSONAL DATA PROCESSING

E2 TEKNOLOJİ processes personal data under this Policy under the following conditions:

Where processing of personal data is expressly provided for by law
Where processing is directly related to and necessary for the establishment or performance of a contract
Where processing is mandatory for E2 TEKNOLOJİ to fulfil its legal obligations, or where the data has been made public by the data subject
Where processing is mandatory for the establishment, exercise or protection of the rights of the data subject or third parties
Where processing is mandatory for the legitimate interests of E2 TEKNOLOJİ, provided that it does not harm the fundamental rights and freedoms of the data subject
Where processing is mandatory for the protection of the life or physical integrity of the data subject or another person, and the data subject is unable to give consent due to actual or legal incapacity

7 - ENSURING THE SECURITY OF PERSONAL DATA

E2 TEKNOLOJİ takes all technical and administrative measures necessary according to current technological capabilities and practices to ensure that personal data is processed lawfully. In this context:

The system established for personal data processing activities within the company is audited by the IT Department through IT specialists appointed by E2 TEKNOLOJİ, and the technical measures taken are reported periodically to senior management as part of the internal audit mechanism.
Employees' knowledge and awareness of personal data protection law and lawful data processing are continuously improved through training.
Business processes carried out by all units of E2 TEKNOLOJİ have been analysed, personal data identified, data processors determined, job descriptions prepared, and data processor agreements signed with each of them.
The personal data processing activities of all E2 TEKNOLOJİ units have been determined in accordance with the personal data processing conditions required by Law No. 6698.
Provisions imposing obligations not to process, disclose, use or share personal data unlawfully are included in the documents governing the legal relationship between E2 TEKNOLOJİ and its employees, interns, job candidates, subcontractors and suppliers; awareness is raised and audits are carried out.
E2 TEKNOLOJİ takes technical measures in line with technological developments; these measures are periodically updated and renewed.
Access rights to personal data are restricted, authorisation matrices are established, and authorisations are reviewed regularly.
Software and hardware including virus protection systems and firewalls are installed.
Regular security scans are performed to identify security vulnerabilities in applications where personal data is collected.
Employees are informed that personal data learned in the course of their duties cannot be disclosed to others contrary to the provisions of Law No. 6698 or used for purposes other than processing, and that this obligation continues after they leave their position; the necessary undertakings are obtained accordingly.
Provisions are added to agreements (confidentiality agreements) concluded with subcontractors and suppliers to the effect that the necessary security measures will be taken and compliance ensured within their own organisations.
Lawful backup programmes are used to ensure that personal data is stored securely.
Access to data storage areas containing personal data is logged, and improper access or access attempts are instantly reported to the relevant parties.

8 - RIGHTS OF THE DATA SUBJECT AND APPLICATION PROCESS

The rights held under Article 11 of Law No. 6698 regarding personal data shared with the company within the scope of the purposes and processing methods specified in this Policy are listed below:

To learn whether personal data is processed
To request information if personal data has been processed
To learn the purpose of processing and whether the data is used in accordance with that purpose
To know the third parties to whom personal data is transferred domestically or abroad
To request correction of personal data that is incomplete or inaccurately processed
To request the deletion or destruction of personal data under the conditions stipulated in Law No. 6698
To object to a result arising against the person through the analysis of processed data exclusively by automated systems
To request compensation for damages arising from unlawful processing of personal data

To exercise the rights listed above, you may contact our company using the "Application Form" available on our website https://www.e2teknoloji.com.tr and the methods specified in that form. Applications duly submitted by data subjects will be concluded by E2 TEKNOLOJİ free of charge within thirty days at the latest, depending on the nature of the request.

9 - DATA RETENTION PERIODS AND DESTRUCTION METHOD

E2 TEKNOLOJİ retains personal data for the periods stipulated in the relevant laws, legislation and its Personal Data Retention and Destruction Policy. If no period is stipulated in the legislation, data is retained according to the practices of the company and the customs required by its commercial life, and is subsequently deleted, destroyed or anonymised. Even where the processing purpose has ended, personal data may be retained as evidence in potential legal disputes or for the assertion or defence of related rights. In such cases, retained data is not accessed for any other purpose. In any case, at the end of the relevant period, personal data is destroyed using one or more of the technical methods specified in the Personal Data Retention and Destruction Policy most appropriate to the company's business processes. Camera surveillance records are deleted every 30 days.

10 - DATA SUBJECT GROUPS AND DATA CATEGORIES

Under this Policy, E2 TEKNOLOJİ processes the data of company employees, job applicants, interns, suppliers, supplier employees, subcontractors, subcontractor employees, third parties and visitors. For persons employed under an employment contract pursuant to Labour Law No. 4857, identity, contact, location, family and relatives, criminal record, visual, education, finance, personnel, health and biometric data are processed. For persons employed by subcontractors and suppliers, identity, contact, criminal record, visual, finance, personnel and health data are processed; for subcontractors and suppliers themselves, identity, contact, visual, signature and finance data; for interns under Vocational Education Law No. 3308, identity, contact, criminal record, visual, finance, personnel and health data; for job candidates who have applied by any means or opened their CVs to our review, identity, contact, education and location data; for third parties such as family members, relatives and former employees not covered by this Policy, identity data; and for visitors who have entered the company's physical premises for various purposes, identity and visual data.

11 - TRANSFER OF PERSONAL DATA

In accordance with Articles 8 and 9 of Law No. 6698, E2 TEKNOLOJİ may transfer the personal data of data subjects governed by this Policy to the following categories of persons:

Senior executives of E2 TEKNOLOJİ
Authorised officers of E2 TEKNOLOJİ
Legally authorised persons, institutions and organisations, and legally authorised private-law persons

E2 TEKNOLOJİ does not transfer personal data processed under this Policy abroad. The applicable legal regulations on the processing and protection of personal data take precedence. In the event of any inconsistency between the legislation in force and this Policy, E2 TEKNOLOJİ accepts that the legislation in force shall apply. This Policy may be amended or updated in line with new legal regulations and company policy. The updated policy text is announced to the relevant persons via the website. Cookies are used on https://www.e2teknoloji.com.tr to track the site usage habits of online visitors.

12 - CAMERA SURVEILLANCE ACTIVITIES IN BUILDINGS AND FACILITIES

E2 TEKNOLOJİ camera surveillance activities are conducted in accordance with the Law on Private Security Services and related legislation, Law No. 6698 and the personal data processing conditions listed in the E2 TEKNOLOJİ SAN TİC LTD ŞTİ Camera Surveillance Policy. Camera surveillance is carried out to ensure the security of the company and the health and safety of others. Data subjects are informed about camera surveillance activities in accordance with Article 10 of Law No. 6698. Camera records are not shared with anyone other than authorised persons, institutions or organisations.

13 - ENTRY INTO FORCE

This Policy, implemented by E2 TEKNOLOJİ SAN TİC LTD ŞTİ, entered into force on 31 DECEMBER 2019.